Privacy notice
Last updated 26 August 2026.
The short version: your email address is never shown to another user, and Tokyo Time does not sell anything about you to anybody.
What is collected
| What | Why | Who else sees it |
|---|---|---|
| Your name | Shown on your listings and to people you message, so they know who they are dealing with | Other users |
| Your email address | Signing in, and telling you when an enquiry arrives | Nobody. Never another user, never a seller, never a buyer |
| Your password | Signing in | Nobody — it is stored as a PBKDF2 hash and cannot be read back, including by us |
| Your listings | To publish them | Everyone. That is what a listing is |
| Suburb and state | So local buyers can find you | Everyone. No street address is ever collected or shown |
| Messages | To deliver them | The other party to the conversation |
| Payment | To take the listing fee | Stripe. Tokyo Time never receives your card number |
What is deliberately not collected
- Your street address.
- Your phone number.
- Your card details — those go straight to Stripe.
- Any advertising or cross-site tracking identifier.
Messaging and your email address
When a buyer messages a seller, the seller is emailed the message and the buyer's name. The buyer's email address is not in that email and is not in the database record of the message. The same applies in reverse. Both parties reply through the site.
Search
If you type a sentence into the search box, that sentence is sent to Anthropic's Claude API so it can be turned into filters (brand, decade, budget, state). Only the words you typed are sent — not your name, your account or anything else about you. The parsed result is cached against the query text so a common search is not re-sent. Anthropic does not use API inputs to train its models.
Who else is involved
- Cloudflare — hosting, and the database.
- Stripe — payments.
- Resend — sending email.
- Google — only if you choose to sign in with Google, and then only your name, email address and account id.
- Anthropic — search queries, as above.
How long things are kept
- Listings stay published after they expire or sell, because a record of what a reference was asked for is genuinely useful. You can have one removed.
- Messages are kept while your account exists.
- Sessions expire after 60 days and are deleted.
- Search parses are deleted after 30 days.
Your rights
Under the Privacy Act 1988 (Cth) you may ask for a copy of what is held about you, ask for it to be corrected, or ask for your account and its data to be deleted. Email hello@tokyotime.com.au. Deleting an account removes your listings and your messages.
Cookies
One: a session cookie, set when you sign in, so the site knows it is you. It is HttpOnly and SameSite=Lax. There are no advertising cookies and no third-party trackers, which is why there is no cookie banner.
Complaints
Write to us first. If that does not resolve it, the Office of the Australian Information Commissioner takes complaints at oaic.gov.au.