PairUp privacy policy

Last updated October 20, 2026

PairUp pairs people who need something with people who have it or can do it, for things and small jobs, through a voice-enabled web app and MCP tools. The web app simulates an Alexa+ experience. It is an independent project built for the Amazon Developer Hackathon 2026.

What we store

• Account: your Login with Amazon user id and first name, or your demo display name, internal user id and hashed demo passcode.
• Listings: items you sell, including the asking price and the private minimum price you set.
• Buy requests: what you're looking for, including the private maximum price you set, and the words of your request.
• Scheduling and deals: stated availability, requested work times, time zones, agreed prices, confirmation status and meet-up area.
• Activity log: a record of marketplace actions, used to run and debug the service.

Private price limits

The server uses your limits to decide whether a deal is possible. Your minimum selling price does not set the agreed price and is not shown to the buyer. A buying budget at or above the asking price stays private from the seller. A lower budget becomes your offer, so the seller sees that amount as the proposed price. Your own agent and signed-in client can see the limits you give them.

Sign-in tokens

When you sign in, the web app (or Alexa, when you link your account) receives tokens that let it act on the marketplace for you. We store only one-way hashes of these tokens. The web app keeps its tokens in your browser's storage until you sign out.

Processing

When Bedrock mode is enabled, text of listings, requests and assistant conversations is processed by Amazon Web Services (Amazon Bedrock) to understand requests and find matches. Offline demo mode uses local parsing and embeddings. Voice is turned into text by your browser's speech service before it reaches us. We don't sell your data or use it for advertising.

Retention and deletion

Listings, requests and deals are kept while the service runs, and backups for seven days. Take down your own posts any time in the app ("My posts"). Ask your agent to delete your data and explicitly confirm. The delete_my_data tool takes down live posts, releases holds, erases your account, tokens, history and learning data, and keeps past deals for the other person under Former member. Backups expire after seven days.

Contact

Questions: open an issue at the project's GitHub repository.

Context and devices

Only snippets naming a need and place names are retained from context signals, for up to 30 days. Suggestions use your own request history and wait for your explicit yes before posting. Dismiss a device suggestion to remove its text; Forget stops a learned routine. Device tokens are hashed, shown once, and revocable in Devices. Voice conversation history is kept in memory for ten minutes. Delete my data also removes device tokens, context and routine feedback.

PairUp Points and Ring

At a PairUp Point, a Ring doorbell or camera confirms that someone arrived. PairUp reads only the type and time of a doorbell press or person event from the point's own device and keeps it for 24 hours. It requests no video, snapshots or audio and identifies nobody. Your check-in (the deal, the time, and whether Ring confirmed it) is kept for 30 days and removed by Delete my data.