Provisions Index

Once Ledger hands your order to the shipping carrier, the risk of the package being lost, stolen, or damaged transfers to you as the buyer. If something happens to your device in transit, Ledger may not be liable....

Why it matters: This clause means that if your Ledger hardware wallet goes missing or is damaged during delivery, you may have no direct financial recourse against Ledger — you would need to pursue the carrier or your own insurance....

Ledger excludes liability for any losses involving cryptocurrencies or digital assets — including losses resulting from user error, device malfunction, or third-party software — that occur in connection with use of its hardware wallet....

Why it matters: Given that Ledger devices are specifically purchased to secure potentially very high-value cryptocurrency holdings, this exclusion means that if your crypto assets are lost or compromised due to a product defect or failure, you cannot recover those losses from Ledger....

Ledger collects and processes your personal data — including name, shipping address, email, and payment details — to process and fulfill your hardware wallet order, and this data may be shared with third-party logistics and payment providers....

Why it matters: Your personal data including home address is shared with shipping and payment partners when you buy a Ledger device, and given Ledger's history of a significant customer data breach in 2020, understanding how your data is handled remains a material privacy consideration....

Microsoft can combine data it collects from different products you use — like Bing searches, Cortana voice queries, and Copilot conversations — to improve its AI systems and personalise your experience across its entire product range....

Why it matters: This means data you generate in one Microsoft product can be used to train AI models or inform decisions in completely separate products, creating a comprehensive profile you may not be aware of....

Children under 13 need a parent or guardian to give permission before Microsoft collects their data; Microsoft also provides parental controls through Microsoft Family Safety to manage what data is collected about children....

Why it matters: If a child in your household uses Xbox, Minecraft, or a family Microsoft account, their gaming behaviour, location, voice chat, and usage data may be collected, and parents need to actively manage family safety settings to limit this collection....

When you use voice commands or type queries to Microsoft's AI products like Copilot, Microsoft collects and retains those inputs and uses them to improve its AI models, not just to respond to your immediate request....

Why it matters: Sensitive or personal information shared with Copilot or spoken to Cortana may be retained by Microsoft and used for AI model training, creating privacy risks if confidential or sensitive content is inadvertently included in queries....

Microsoft collects health-related data through products like Microsoft Health, fitness tracking, and health-related search queries, and processes this data under both this Privacy Statement and a separate Consumer Health Data Privacy Policy....

Why it matters: Health data is among the most sensitive categories of personal information, and its collection by a technology company through non-medical products creates risks around re-identification, secondary use, and exposure to law enforcement requests that may not be present with traditional healthcare prov...

Reddit's policy states that content you post on Reddit — including text, images, and other media — may be used to train artificial intelligence and machine learning models. This applies to publicly posted content and potentially to other data Reddit holds about you....

Why it matters: This provision means your creative posts, comments, and contributions to Reddit communities could be used to build commercial AI products without your explicit consent or compensation....

Reddit shares your personal information — including browsing behavior, interests, device data, and demographic inferences — with third-party advertising partners to serve you targeted advertisements both on and off Reddit. This may constitute a 'sale' or 'sharing' of personal data under California l...

Why it matters: Your behavioral data and inferred personal characteristics are being shared with external companies you have no direct relationship with, enabling those companies to build profiles about you for advertising purposes....

Reddit states that its services are not directed to children under the age of 13 and that it does not knowingly collect personal information from children under 13 without parental consent. Users must be at least 13 years old to use Reddit, with higher age requirements in some jurisdictions....

Why it matters: Despite Reddit's age restrictions, the platform hosts a vast range of content communities and has historically faced criticism regarding minor access, meaning parents and guardians should be aware that COPPA protections are only as strong as Reddit's age-verification mechanisms....

If you are a US user and have a dispute with Figma, you must resolve it through binding individual arbitration rather than going to court, and you cannot join or participate in a class action lawsuit against Figma....

Why it matters: This provision removes your right to sue Figma in court and prevents you from joining with other affected users to bring a collective legal claim, which is often the only economically viable way to challenge a large company over small or mid-sized harms....

When you upload designs, files, or other content to Figma, you grant Figma a worldwide, royalty-free license to use, copy, modify, and display that content — including to improve Figma's products and services, which includes AI and machine learning features....

Why it matters: Your design files, which may contain proprietary creative work, client assets, or personal data, could be used by Figma to train or improve its AI systems without additional payment or specific consent beyond agreeing to the ToS....

Figma's maximum financial liability to you for any claim — including data loss, service outages, or misuse of your content — is capped at the total fees you paid in the 12 months before the claim, or $100, whichever is greater....

Why it matters: Even if Figma causes significant harm to your business or creative work — such as permanent data loss of years of design files — you can only recover a very small amount of money, which may bear no relationship to your actual losses....

TaskRabbit shares your personal information with third-party companies for advertising purposes, and acknowledges this may qualify as a 'sale' under California law....

Why it matters: Your personal data — including contact information, device identifiers, and browsing behavior — is shared with advertisers, and US users outside California have no explicit opt-in right before this occurs....

TaskRabbit reserves the right to share your personal information with third parties at its sole discretion if it believes there has been 'possible interference with the rights of users' — even without a court order or law enforcement request....

Why it matters: This clause gives TaskRabbit broad, self-determined authority to disclose your personal data to outside parties without your knowledge or consent, going significantly beyond standard legal obligation carve-outs....

TaskRabbit collects background check results for Taskers, which may include criminal violation records, and uses this to determine platform eligibility....

Why it matters: Criminal background data is among the most sensitive categories of personal information, and its collection, retention, and potential disclosure to third parties creates significant risks for Taskers if mishandled....

TaskRabbit collects government-issued ID documents such as passports, driver's licenses, and local IDs, as well as social security numbers, tax IDs, and date of birth from users — particularly Taskers....

Why it matters: Collecting government-issued identity documents and social security numbers represents some of the highest-value data for identity theft; a breach involving this data would have severe consequences for affected users....

Square collects personal and transactional data from consumers who pay at businesses using Square's payment systems, even if those consumers have never created a Square account or directly agreed to Square's terms....

Why it matters: This means your name, payment card details, and purchase history can end up in Square's systems simply by swiping your card at a café or retail store that uses Square — without your direct knowledge or consent....

Square may use data collected across its various products — including payment processing, Cash App, and other financial tools — to build consumer profiles and deliver targeted marketing and product recommendations....

Why it matters: Your transaction history, account activity, and behavioral data across Square's ecosystem can be combined and used for profiling purposes, which goes beyond what most consumers expect when they simply use a payment terminal....

Square collects government-issued identification documents and, in some cases, biometric data as part of identity verification processes for account opening and financial compliance purposes....

Why it matters: Providing a government ID or biometric data to Square creates a sensitive data record that is subject to strict legal protections, and any breach or misuse of this data carries significant identity theft risk....

Square collects precise and approximate location data from devices used to access its services, including through mobile apps and merchant hardware, for purposes including fraud detection, service personalization, and compliance....

Why it matters: Precise location data is one of the most sensitive categories of personal information — it can reveal where you live, work, worship, and receive medical care, and its collection by a payment processor extends well beyond what many consumers would expect....

If you have a dispute with Poshmark, you must resolve it through individual arbitration — not in court, and not as part of a class action lawsuit with other users....

Why it matters: This clause strips users of the right to sue Poshmark in court and prevents them from joining together with other harmed users in a class action, which is often the only practical way to pursue small or systemic claims....

Poshmark automatically deducts a fee from every sale: $2.95 for sales under $15, or 20% of the sale price for sales of $15 or more — and sellers receive the remainder....

Why it matters: This fee structure directly reduces seller earnings on every transaction and is non-negotiable, making it critical for sellers to factor this cost into their pricing strategy....

When you post photos, descriptions, or other content on Poshmark, you give Poshmark a permanent, worldwide, royalty-free license to use, copy, modify, and display that content for any purpose — even after you delete your account....

Why it matters: This means Poshmark can continue to use your listing photos and descriptions commercially indefinitely, and you cannot revoke this permission even if you close your account or delete the content....

Poshmark limits its total financial liability to you to the amount you paid in fees in the 12 months before your claim, and disclaims liability for lost profits, data loss, or indirect damages....

Why it matters: Even if Poshmark causes significant financial harm — such as a data breach exposing your payment information or a platform error causing you to lose sales — your legal recovery is capped at the fees you paid, which could be a very small amount....

Patreon shares your personal data — including behavioral and usage data — with third-party advertising networks and analytics companies, which may use this information to serve you targeted advertisements on and off the Patreon platform....

Why it matters: Your activity on Patreon may follow you across the internet through ad targeting, and your data is passed to companies whose privacy practices are outside Patreon's direct control....

Patreon uses cookies, pixel tags, and similar tracking technologies to monitor your activity on the platform and across third-party websites, enabling behavioral advertising and analytics....

Why it matters: Tracking technologies follow your activity beyond the Patreon website itself, building a behavioral profile that is shared with advertising partners and used to target you with ads on other platforms....

Patreon transfers personal data from the EU and other regions to the United States and other countries, relying on legal mechanisms such as Standard Contractual Clauses to authorize those transfers....

Why it matters: When your data is transferred to the US, it may be subject to US surveillance laws and different privacy protections than those in your home country, and the legal mechanisms used to authorize these transfers are subject to ongoing legal challenge....

This page contains no actual contract terms — no arbitration clause, no privacy disclosures, no cancellation policy, no liability limitations. All substantive terms are in separate documents accessible only by clicking through to a regional link....

Why it matters: Users who land on this page and do not click through to their regional document have no information about the rules governing their subscription, meaning they are effectively agreeing blind to terms they cannot see on this page....

T-Mobile collects your precise GPS location and network-derived location data and may share it with third-party advertising partners, analytics companies, and affiliated businesses. This happens through your use of their network and apps, not just when you explicitly share your location....

Why it matters: Your location data is among the most sensitive personal information you generate — it can reveal your home, workplace, medical appointments, religious practices, and daily routines, and once shared with third parties it is difficult to control....

T-Mobile uses your Customer Proprietary Network Information — which includes records of calls you make, who you called, when, for how long, and from where — to market additional services to you unless you opt out. Federal law gives you the right to restrict this use....

Why it matters: CPNI is highly sensitive telecommunications data that reveals your communication patterns and personal relationships; federal law (47 U.S.C. § 222) specifically restricts how carriers may use this data and requires them to obtain your approval before using it for marketing beyond your existing servi...

T-Mobile shares your personal data — including device identifiers, browsing behavior, app usage, and demographic inferences — with advertising networks and marketing partners to serve you targeted ads both on and off T-Mobile's own platforms. This constitutes a 'sale' or 'sharing' of personal data u...

Why it matters: Sharing your data with advertising networks means your behavioral and demographic profile is distributed to companies you have no relationship with, and this data can be combined with other sources to create detailed commercial profiles used to influence your purchasing decisions and potentially aff...

T-Mobile states that it uses reasonable security measures to protect your personal data but does not guarantee the security of your data and acknowledges that no security system is perfect. T-Mobile has experienced multiple major data breaches affecting tens of millions of customers....

Why it matters: T-Mobile has suffered some of the largest consumer data breaches in US history — including a 2021 breach affecting 76 million customers and a 2023 breach affecting 37 million — meaning the promise of 'reasonable security measures' in this notice has historically not been sufficient to protect custom...

T-Mobile collects sensitive categories of personal information including precise geolocation, financial account details, government-issued ID numbers (Social Security numbers), and potentially biometric identifiers, and uses this data for service provision, fraud prevention, and in some cases for ma...

Why it matters: Sensitive personal information such as Social Security numbers, precise location, and financial data represents your highest-risk data — exposure or misuse of this data can enable identity theft, financial fraud, stalking, or discrimination, and US law provides specific protections for these categor...

If you have a dispute with Square, you must resolve it through private arbitration rather than going to court, and you cannot join or lead a class action lawsuit against Square. There is a 30-day window to opt out of this requirement after creating your account....

Why it matters: This provision removes your right to sue Square in court or participate in group lawsuits, which are often the only practical remedy for small-dollar claims or widespread consumer harm....

Square can suspend, restrict, or terminate your account at any time at its sole discretion, and may hold funds in your account for an extended period — potentially 90 to 180 days — if it suspects fraud, policy violations, or elevated financial risk....

Why it matters: For merchants who process daily payments through Square, an unexpected account suspension combined with a fund hold can cause immediate, severe cash flow disruption and potentially threaten business viability....

Square limits its total liability to you in most cases to the amount of fees you paid to Square in the 12 months before the event that caused your harm, and excludes liability for indirect, consequential, or lost profit damages entirely....

Why it matters: If Square's service failure, security breach, or wrongful account suspension causes your business significant financial loss, you can only recover a small fraction of that loss — capped at your prior year's fees — regardless of how much damage actually occurred....

By using Square's services, you authorize Square to collect transaction data, device information, location data, and other usage information, and to use it to operate, improve, and market Square's services, including sharing with third-party partners....

Why it matters: Square collects a wide range of data about you, your customers, and your business transactions, and uses it for purposes beyond processing payments — including marketing and sharing with partners — which has direct privacy implications....

Cash App collects facial scans and biometric information extracted from photographs you submit for identity verification purposes. This data is categorized as 'Additional Identification Information' alongside your Social Security number and government-issued ID....

Why it matters: Biometric data is among the most sensitive personal information — it cannot be changed if compromised — and collection without explicit statutory consent violates laws like Illinois BIPA, which provides for significant per-violation damages....

Cash App explicitly states that your personal data is used to train artificial intelligence and machine learning models as part of 'improving, personalizing and facilitating your use of our Services.' There is no opt-out mechanism specifically described for this use in the main policy....

Why it matters: Using customer financial and behavioral data to train AI systems without a clear opt-out is an emerging area of regulatory concern and may constitute secondary processing beyond what users reasonably expect when signing up for a payments app....

Cash App purchases data about you from third-party advertisers, data brokers, and advertising platforms to build or enhance behavioral profiles, including your inferred interests, preferences, advertising segments, and characteristics — even if you never provided this information directly to Cash Ap...

Why it matters: Data broker sourcing means Cash App may know things about you beyond what you shared, and this enriched profile is used for targeted advertising and personalization — a practice with significant CCPA/CPRA implications and limited consumer visibility....

Cash App explicitly states it uses your personal information to develop a 'credit risk profile' about you and to draw inferences to create a behavioral profile reflecting your credit risk, preferences, shopping habits, and other characteristics. This profiling is used to enhance services and maintai...

Why it matters: Automated credit risk profiling using behavioral and third-party data — particularly where it influences financial decisions like loan eligibility or account standing — is subject to FCRA adverse action notice requirements and CFPB supervisory oversight....

Cash App's policy states that 'by continuing to interact with our Services, you are consenting to the practices described in this Privacy Notice' — meaning simply using the app is treated as consent to all data collection and use practices described, including biometric collection and AI training....

Why it matters: Implied consent through continued service use is increasingly challenged by regulators as insufficient for sensitive data processing, particularly for biometric data, AI model training, and targeted advertising — which typically require explicit, affirmative opt-in consent....

If MetaMask or Consensys causes you harm — through a bug, outage, or any other failure — the most they will ever pay you is $100 total, regardless of how much cryptocurrency you actually lost....

Why it matters: For a platform where users may store or transact thousands or millions of dollars in crypto assets, a $100 liability ceiling means users bear virtually all financial risk of platform failures....

Instead of suing MetaMask in court, you must resolve most disputes through private binding arbitration, and you give up your right to join a class action lawsuit with other affected users....

Why it matters: Mandatory arbitration removes your ability to access public courts and join with other harmed users in collective legal action, which significantly reduces your practical ability to seek redress for smaller losses....

MetaMask does not store or have access to your Secret Recovery Phrase or private keys, so if you lose them, neither MetaMask nor Consensys can restore access to your wallet or recover your funds under any circumstances....

Why it matters: This is the defining security risk of self-custody wallets — if your Secret Recovery Phrase is lost, stolen, or destroyed, your crypto assets are permanently inaccessible with no recourse....

By using MetaMask, you personally confirm that you are not on any government sanctions list and that your use of the wallet complies with all applicable sanctions laws — MetaMask is not taking responsibility for screening you....

Why it matters: Placing sanctions compliance obligations on individual users is highly unusual and creates personal legal risk — violating OFAC sanctions can result in civil penalties of up to $1 million per transaction and criminal prosecution....

MetaMask explicitly states that it is not a financial advisor, broker, or fiduciary and that nothing in the app or website constitutes investment advice — all investment decisions are entirely your own responsibility....

Why it matters: This means MetaMask bears no legal responsibility if you make financial decisions based on information or features in the app, including staking yields, RWA token trading, or prediction market displays....

Uber collects your precise GPS location continuously while you use the driver app, including when the app is running in the background on your phone. This means Uber knows where you are even when you are not actively on a trip....

Why it matters: Continuous background location tracking is one of the most privacy-invasive data practices possible, creating a detailed record of a driver's movements, home address, and daily patterns beyond work activity....

Uber collects selfie photos and images of government-issued ID documents from drivers and delivery people for identity verification purposes. This facial imagery is processed to confirm your identity before and during your use of the platform....

Why it matters: Facial imagery is biometric data under Illinois BIPA and similar laws, and its collection without explicit written consent and a published retention/destruction policy creates significant litigation exposure — BIPA allows statutory damages of $1,000 to $5,000 per violation with class action potentia...