Privacy policy — draft for owner review

Version 1 · Updated 2026-10-01

This is an unpublished draft. The owner must confirm the operator, contact, processors, cross-border handling and retention before launch in the six supported countries.

The application stores account details, password hashes, token hashes, private messages, listing photos, precise postal strings privately, coarse public locations, saved searches, size profiles, reports and support tickets. Queued bearer links are encrypted. Photographs are re-encoded to strip metadata.

An essential session cookie supports sign-in and request security. An essential country preference cookie remembers an explicit selection. Country URLs are never rewritten by that preference.

Google Analytics property G-WK7Q2DRTWH is configured for production public pages only. Account, reset, inbox and admin pages are excluded. The app supplies no email, user ID, message body, search query or token to Analytics; page URLs are stripped of query strings. Google’s processing, cookie settings and any applicable consent requirements must be confirmed before launch. Google Signals and advertising personalisation are disabled in this integration.

Hostinger, Cloudflare, Google Analytics and the selected SMTP provider may process service data once configured. The final policy must identify actual arrangements and international transfers. Search digests require separate opt-in and can be unsubscribed without stopping account security mail.

Use support to request access, correction or account deletion. Deletion requests immediately hide listings. Necessary report/security evidence and messages needed by other participants may be retained under the final policy; backups are not erased instantly.