Privacy policy
Plain-language policy. Last updated 21 September 2026. Operated by Bahamas Market LLC.
1. Who we are
BHS Market (bhsmarket.com) is a classifieds marketplace for The Bahamas, operated by Bahamas Market LLC. In this policy "we" means Bahamas Market LLC and "you" means anyone who visits the site, posts an ad, bids, or messages another user. For anything about your personal data, email [email protected].
2. What we collect
We collect only what the marketplace needs to work. Concretely:
Account
- Email address, used to sign you in. We sign people in with a one-time link sent by email (a "magic link"), with a password if you set one, or with a passkey. For a passkey we store only the public half of the key and an identifier for your device; the private half never leaves your device.
- Display name, the name shown on your ads and messages, and optionally your phone number and home island.
- If you use our Telegram bot, we store your Telegram chat ID and the name Telegram gives us, so the bot can recognise you and post ads for you. You can use the bot without giving us an email address.
- Credits, which pay for promoted ads and reserve auctions, and the history of how you earned and spent them. We do not store card numbers; when card payments launch, the card details will be handled by the payment provider, not by us.
What you post
- Ads: title, description, price, category, island and area, condition, the attributes for that category, and the photos you upload. Live ads are public and can be seen by anyone, including search engines.
- Bids you place in auctions, and the auctions you win.
- Messages between buyers and sellers, sent through the site's chat. Your phone number is hidden in chat until you choose to reveal it.
- Reports you make about an ad, and the reason you give.
- An identity document, only if you ask to be verified from your account page: a photo or scan of the document you choose. It is kept on our server outside the public site, opened only by our staff to check it, and deleted as soon as we approve or reject the request. We keep the type of document, the dates and the decision, which is what the Verified badge shows.
Technical and security data
- IP address and device information (browser, operating system) from your requests. We use these for security and anti-abuse: stopping spam, rate limiting, protecting sign-in and detecting bots. They appear in server logs and in Cloudflare's logs (see section 6).
- Ad-view counts. Every time an ad page is loaded, its public view counter goes up by one. Separately, to tell how many different people saw an ad, we set a first-party cookie (
bhs_vid, described in section 4) and keep a salted hash of it, or your user ID if you are signed in, per ad per day. IP addresses are not used for this count and the unique count is shown only to us, never publicly. - Usage analytics through Google Analytics, described in section 4.
3. What we use it for
- Running the marketplace: showing ads, running auctions, delivering messages, paying out credits.
- Signing you in and sending you the emails the service needs: sign-in links, outbid and auction notices, replies to your messages, moderation decisions. These are transactional emails; we do not send marketing newsletters.
- Moderating ads and enforcing the posting rules and terms.
- Keeping the site secure and fighting spam, scams and abuse.
- Understanding how the site is used so we can improve it (view counts and analytics).
We do not sell your data, and we do not use it for third-party advertising or to build profiles of you for other companies.
4. Cookies and analytics
We set the cookies below. There are no advertising cookies and no cross-site tracking for ads.
PHPSESSID· session (first-party)- Keeps you signed in and protects forms. Ends when you close the browser, or lasts 30 days if you tick "Keep me signed in".
bhs_vid· ad-view counting (first-party)- A random identifier that contains no personal data. It is used only to count how many different people viewed an ad. It lasts up to a year, is HttpOnly (scripts cannot read it), is never shared with anyone, and we store it only as a salted hash. It is not used across other websites.
_ga,_ga_*· Google Analytics (third-party)- We use Google Analytics 4 to measure traffic: which pages are visited, roughly where visitors come from, what devices they use, and how they move through the site. Google sets these cookies (
_galasts up to two years,_ga_*too), and the analytics script sends Google your page views, your browser and device details and your IP address, from which Google derives an approximate location. Google processes this data on our behalf under its own terms and may also use it as described in How Google uses information from sites that use its services. We do not link Google Analytics data to your account, email or ads. You can block it with the Google Analytics opt-out browser add-on, by blocking thegoogletagmanager.comdomain, or by using a content blocker.
The site also loads its fonts from Google Fonts, which means your browser requests the font files from Google's servers and Google sees your IP address for that request. Google does not set cookies for fonts.
5. Where your data is stored
- Our server is hosted with OVH in Germany. It holds the database (accounts, ads, bids, messages, credits, reports, view counts) and today also the listing photos.
- Listing photos are being moved to Cloudflare R2 object storage, delivered through Cloudflare's network, so pictures load fast in The Bahamas. Photos on live ads are public either way.
- Search runs on a Meilisearch index on the same server. It holds the public text of live ads only, not accounts or messages.
- Email is sent through Amazon SES (Amazon Web Services, United States). Amazon sees the recipient address and the content of each email we send you.
- Cloudflare sits in front of the site as a security and delivery layer, so every request passes through Cloudflare's network.
- Google receives the analytics and font requests described in section 4.
The Bahamas has a Data Protection (Privacy of Personal Information) Act. Because the site is hosted in Europe and uses United States services, your data is stored and processed outside The Bahamas.
6. Who else sees it
- Other users see what you publish: your ads, your display name, your bids (as an anonymised bidder), and the messages you send them. Your email address is never shown to other users. Your phone number is shown only when you reveal it in a chat.
- Service providers listed in section 5 (OVH, Cloudflare, Amazon, Google, and later the payment providers) process data for us so the site can run. They are not allowed to use it for their own purposes, except Google Analytics as described above.
- Authorities, if the law requires it or to protect someone from fraud or harm.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account (email, name, phone, Telegram ID, passkeys) | Until you delete your account, or until we remove it for breaking the rules. |
| Ads and photos | While the ad is live, sold or withdrawn, so you can relist and buyers can see what sold. Deleted with your account, or on request. |
| Bids and auction results | For as long as the auction's ad exists, because a winning bid is a commitment between two users. |
| Messages | Until either party deletes their account. |
| Reports | Until resolved, then as part of the moderation record. |
| Per-viewer ad-view records (hashed) | 90 days, then deleted automatically. Only the total counts remain. |
| Server access logs (IP address, request, browser) | 14 days. |
| Google Analytics data | Kept by Google for the retention period set on our Google Analytics property (Google's default is 2 months for user-level data; aggregate reports are kept longer). |
8. Your rights
Whatever country you are in, you can:
- See your data. Ask us and we will send you a copy of what we hold about you.
- Fix it. You can edit your name, phone, island and ads from your account at any time, or ask us to correct something.
- Delete it. Ask us to delete your account. We will remove your account, ads, photos and messages. We may keep a minimal record if it is needed to resolve a dispute, to prevent a banned user from returning, or where the law requires it.
- Object or complain. Tell us if you think we are handling your data wrongly. If you are in The Bahamas you can also contact the Office of the Data Protection Commissioner.
Email [email protected] from the address on your account. We answer within 30 days.
9. Security
The site is served only over HTTPS. Passwords, when you set one, are stored hashed. Sign-in links expire and can be used once. Identifiers used for analytics are stored as salted hashes. Access to the server and the database is limited to the people who run the site. No system is perfectly secure, so if we ever discover a breach that affects you, we will tell you.
10. Children
You must be 18 or older to have an account, post, bid or message. We do not knowingly collect data from anyone under 18. If you believe a child has an account, tell us and we will remove it.
11. Changes to this policy
When we change this policy we update the date at the top. If a change matters to you, for example a new provider that receives your data, we will also say so on the site.
12. Contact
Privacy questions and requests: [email protected].
General questions: [email protected].
Bahamas Market LLC, a Florida limited liability company.