Privacy policy

The short version

The platform holds the minimum it needs to run a marketplace: who you are, what you have listed, the messages you send, and the payment references you submit. It never holds your money, never asks for card details, and never sells your data.

What we collect

Account details: your name, email address and, if you provide one, your phone number. Your password is stored only as a salted PBKDF2 hash and cannot be read back, by us or anyone else.

What you post and send: listings and their details, business profiles, messages between accounts, bookings and their status, reviews you leave, and items you save.

Payment references: when you confirm a payment you paste the transaction reference from your mBoB or eTeeru receipt. We store that reference and the amount. We do not receive, hold or process the money itself.

Growth purchases: if you buy a promoted listing, a subscription or a service, we record the order, its terms, the amount and your payment reference.

Usage and device data: pages viewed, the referring address, and a small amount of technical information that comes with any web request. This is used to see what is working and to catch abuse.

How we use it

To operate the marketplace: publish your listings, deliver your messages, process bookings and reviews, and show you your own account.

To keep it safe: automatic checks on listings for completeness and implausible prices, detection of duplicate or automated accounts, and investigation of reports.

To work out fees: when a transaction is confirmed, the platform calculates its commission against the seller who received the money.

To run the rollout: aggregate counts such as listings per market, which contain no personal information.

What we never do

We do not hold your funds. Payments move directly from buyer to seller over mBoB, eTeeru or in person.

We do not collect card numbers or bank credentials.

We do not sell, rent or trade your personal information.

We do not use your messages or listings to train third-party systems.

Who can see what

Published listings and business profiles are visible to everyone, including the contact details you choose to publish.

Your email address is not shown publicly. Your phone number is shown only where you have put it on a listing or profile for people to contact you about it.

Messages are visible to the two accounts in the conversation. A report of abuse can be reviewed by the platform operator.

Payment references you submit are visible to the other party and to the platform operator, because both need them to confirm the transaction.

Cookies and local storage

The platform sets one session cookie so you stay signed in, and it is marked HttpOnly and Secure. It carries no advertising identifier.

When we run our own advertising, on Facebook or Instagram, the platform also loads that network's measurement tag. It sets the advertising identifier that network uses, and sends a matching event from our server, so we can tell which advertisement brought somebody here. It is measurement for our own campaigns: it is not used to build a profile of you for anyone else, and no other advertiser sees it.

Your browser may also store the small amount of state needed to make the site installable to a phone home screen. You can clear all of it by signing out and clearing site data.

How long we keep it

Account and listing data is kept while your account is open. Deleting your account removes your listings, messages and saved items.

Records of confirmed transactions and the fees calculated on them are kept after account closure, because they are financial records and disputes can surface later.

Your choices

You can edit your account details and your listings at any time from your account page.

You can delete a listing, or your whole account, yourself. Deleting your account is permanent.

You can ask for a copy of the personal information held about you, or ask for a correction, by contacting the platform operator using the contact details published on this site.

Children

The platform is not intended for use by children under 13, and accounts found to belong to them are removed.

Security

Passwords are stored as salted hashes. Sessions are server-side and expire. Access to the operator's console requires the operator account, and administrative actions are recorded.

No system is perfect. If you believe your account has been compromised, sign out of all devices by changing your password and contact the operator.

Changes

If this policy changes materially, the change is noted here with a new date. Continuing to use the platform after a change means you accept it.