Privacy policy
Updated 29 September 2026
This is a summary in English. The binding policy is the Icelandic text at thriftapp.is/personuverndarstefna/, and where the two differ, the Icelandic applies. The policy takes effect when the app comes out. Until then, Þrift collects no personal data about users. A final version, reviewed by a lawyer, will be published at that address before then.
Controller
Salva ehf. operates Þrift and is the controller of the personal data described here. Processing follows the Icelandic Data Protection Act, No. 90/2018. Privacy questions go to thrift@thriftapp.is. The company’s address is at the foot of this page.
What personal data is collected
- Sign-up: name or display name, email address, and a photo if the user adds one.
- Seller verification: kennitala and name, from electronic ID.
- Listings: photos, descriptions, sizes, condition and price.
- Orders: what was bought and from whom, the delivery method, and confirmation of payment.
- Messages: messages between buyer and seller, and messages sent to Þrift.
- Technical data: error logs and basic information about the device.
Why it is used, and on what basis
The data is used to run the marketplace. That means creating accounts, showing listings, getting orders delivered, paying sellers and answering requests. The legal basis is the contract with the user. Bookkeeping and tax records rest on a legal obligation, and processing for security and to prevent misuse rests on legitimate interests. Notifications that are not about an order are sent with consent, which can be withdrawn at any time.
Who it is shared with
Buyer and seller see what they need about each other to complete a sale. Beyond that, data is shared with the service providers that work for Þrift, for identity verification, payments, delivery and hosting. Each receives only what its task requires. Data is never sold. Where a provider operates outside the European Economic Area, the European Commission’s standard contractual clauses apply.
Kennitala
A seller’s kennitala is not stored in readable form. It is kept as a one-way hash with its last four digits, and the name is stored encrypted. The kennitala is never shown to other users or written to logs.
Payment details
Þrift stores no card numbers. Payment is by Apple Pay, Google Pay or card, through a payment provider that alone handles card details. Þrift receives confirmation that a payment was made.
How long it is kept
Account data is kept while the account is active. Accounting records are kept for seven years, as the Icelandic Bookkeeping Act requires. Order and message data is kept while a problem can still be reported or a dispute is open.
Deleting your account
You can ask for your account to be deleted in the app’s settings. It is deleted once any open orders are complete, and your personal data is erased then. Records the law requires Þrift to keep stay in its accounts.
Your rights
You have the right to see the data held about you and to have it corrected or erased. You can also ask for its processing to be restricted, object to the processing, and have your data moved to another service. Requests go to thrift@thriftapp.is. If you believe the processing breaks the law, you can complain to Persónuvernd, the Icelandic Data Protection Authority.
Cookies
The thriftapp.is website uses no cookies and no analytics. Nothing is loaded from third parties.
Changes
The policy takes effect when the app comes out. It carries a version number and can be read in the app’s settings. If it changes materially, you will be asked to accept it again.
Terms
The terms of service are on a separate page.