Privacy Policy

within is a local-retail marketplace that connects shoppers with independent boutiques nearby, for same-hour pickup and delivery. This policy explains what we collect, why, who we share it with, and the choices you have. We follow Canada's PIPEDA and, where it applies, the GDPR.

Who we are

The service is operated by within (Toronto, Canada). For any privacy question or request, contact us at the email at the bottom of this page.

What we collect

Shoppers

• A random, anonymous device ID. When you browse, we set a random identifier in a cookie to personalize your feed and remember saved items. It is not tied to your name, email, or any real-world identity, and we do not sell it.
• Taste & activity signals. The items you view, save, search, and buy, used only to rank what we show you. Stored against the anonymous ID.
• Approximate location. An anchor point you choose — an area, not an address — kept in a cookie to show what's in stock near you. Precise device geolocation is used only if you tap to share it, and those coordinates are used on-device to sort results. They are not stored on our servers.
• Account details (optional). If you create an account, we store your email address (and any profile you add) so your saved items, boards, and preferences follow you across devices.
• Order & delivery details. When you buy, we process the contact and delivery information needed to fulfil and, for delivery orders, to dispatch a courier.

Boutiques (merchants)

• Store profile, catalogue, inventory, and order data synced from your commerce platform (Shopify, Square, or Lightspeed) to list your products and route orders.
• Payout details you provide to our payments processor to receive funds (handled by Stripe; see below).

How we use it

• Personalize and rank your feed, search, and recommendations.
• Show accurate, real-time local availability and pickup/delivery times.
• Process orders, route them to the boutique, and dispatch couriers for delivery.
• Send order updates and, if you opt in, restock/price-drop and marketing notifications.
• Prevent fraud and abuse, and operate and improve the service.

Who we share it with

We do not sell personal information. We share data only with providers that help us run the service:

• Shopify, Square, Lightspeed. The boutique's commerce platform, to sync catalogue and route orders.
• Stripe. Payment processing and merchant payouts (delivery/in-app orders).
• Uber Direct / courier partners. To dispatch and track deliveries.
• Hosting & infrastructure (Vercel, Railway, Supabase), analytics (Vercel Web Analytics, Google Analytics, PostHog), email/SMS (Resend, Twilio), and search/recommendation (Voyage AI) providers, acting on our instructions.

For pickup orders you complete on a boutique's own checkout, that boutique is the merchant of record and its own privacy terms also apply to the purchase.

Cookies & analytics

We use the minimum cookies needed to run the service: the anonymous device ID, your chosen anchor point, and (if you log in) your session.

To understand what's working and improve within, we use privacy-first analytics: Vercel Web Analytics (cookieless), Google Analytics, and PostHog (product analytics and, for a sample of sessions, screen replays with every typed input masked). We do not use advertising trackers, and we do not sell your data. Any analytics that would set or store an identifier stays off until you accept it in the banner shown on your first visit. Decline and only the cookieless measurement remains.

Turn off identifier-backed analytics

Retention

We keep anonymous taste signals only as long as they're useful for personalization and prune them over time. Order records are kept as required for tax, accounting, and dispute purposes. Account data is kept until you delete your account.

Your rights

You can request access to, correction of, or deletion of your personal information, and you can clear the anonymous ID any time by clearing cookies. Shoppers who bought through a boutique can also exercise rights with that boutique. Email us and we'll respond within the timeframes the law requires.

Security

We use encryption in transit, scoped access, and reputable processors. Payment card details are handled by Stripe and never touch our servers.

Children

The service is not directed to children under 16, and we don't knowingly collect their data.

Changes

We'll update this page and the date above when this policy changes; material changes will be highlighted in the app.

Contact

Questions or requests: support@shopwithin.co