Privacy policy

What we collect

• Account: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email and profile picture from Google.
• Ads: the text, price, location, photos and contact name and phone number you put in an ad. Photos are re-saved without location or camera data.
• Phone numbers: the number in your ad is shown to visitors who tap “Show number”.
• Technical data: your IP address is used to stop abuse. For rate limits and reports we store only a scrambled code made from it (a hash), never the address itself.
• Cookies: see “Cookies” below.

Why we use it

• To run your account and show your ads (the service you asked for).
• To keep the site safe: rate limits, reports, checking ads before they go live, and banning abusive accounts (our legitimate interest).
• To send emails you need: account confirmation, password reset, ad status and expiry reminders.

We do not sell your data and we do not use it for advertising.

How long we keep it

• Account data: until you delete your account.
• Ads: while they are online, and until you delete them or your account. Photos of deleted ads are removed from storage.
• Unfinished ad drafts: deleted after 30 days without changes.
• Login sessions: up to 30 days.
• Rate-limit records: deleted after 2 days.
• Reports and moderation records: kept as long as needed to deal with abuse.

Who processes it for us

We use these service providers. They only process data on our instructions:

• Neon (database hosting)
• Cloudflare R2 (photo storage)
• [hosting provider] (website hosting)
• Resend (sending emails)
• Google (only if you choose “Continue with Google”)

Some of them store data outside Sri Lanka (for example in Singapore or the United States), with safeguards required by law.

Cookies

We only use cookies the site needs: a login cookie that keeps you signed in, a small flag that tells the page you may be signed in, and a cookie that remembers your language when you sign in with Google. We do not use advertising or tracking cookies.

Your rights

You can ask to see the data we hold about you, correct it, or have it deleted, and you can withdraw your consent at any time. You can change your name and phone number in Settings and delete your account there yourself. For anything else, contact us (see below). You may also complain to the Data Protection Authority of Sri Lanka.

Deleting your account

Go to My account → Settings → Delete account. Your ads are taken down, their photos are removed, and your account is deleted. Some records may be kept for a short time where the law requires it or to deal with abuse.

Contact

Questions about your data: email [email protected] or call 011 234 5678.