This policy explains what the SUP Android app and the SUP website collect, why, who it is shared with, and how long it is kept. It describes what the product actually does today. Where a feature is not built yet, this policy says so rather than reserving a right we are not using.

SUP is a marketplace. Buyers and sellers deal with each other directly, and SUP does not take a commission or handle the money for the items listed on it. That shapes this policy: SUP never sees the payment for an item, so it holds no record of one.

1. What We Collect

1.1 Account Information

Email address — your sign-in identity and the address we use to verify the account and reset a password.
Password — stored only as a bcrypt hash. We cannot read your password, and nobody at SUP can recover it for you.
App passcode — if you set one, it is stored as a hash in the same way.
Email verification codes — a short-lived one-time code sent when you register or reset a password.

If you turn on fingerprint or face unlock, the check is performed by Android on your device. SUP never receives your biometric data, and it is not sent anywhere.

1.2 Profile Information

Display name and username.
Profile photo and bio, if you add them.
Mobile number, if you add one. It is optional. It is not shown on your public profile or in your Ads — chat exists so that you can talk to a buyer or seller without handing over your number.
City and state, so your Ads reach people near you.
Your average rating and review count, which are calculated from reviews other users leave.

1.3 Ads You Post

Photos you upload from your camera or gallery.
Title, description, price, condition and category details.
The city and area you choose for the Ad, and an approximate location for it. SUP stores an approximate position, not your exact address or a precise GPS fix, and only ever shows the area you picked.

1.4 Chat, Offers and Reviews

Messages, images and offers you exchange with another user in chat.
Ratings and written reviews you leave after a deal.
Reports you submit about an Ad or a user, and the accounts you block.

1.5 Device and Technical Information

Device type, Android version and the version of the app you run.
A push notification token from Expo, if you allow notifications, so a message or offer can reach you.
IP address, browser or app user agent, and time, recorded when you register, sign in, sign out or reset a password, together with whether the attempt succeeded. This is a security record: it is how a sign-in from an unfamiliar device becomes visible and how repeated failed attempts against an account are detected.
Server error logs, which may include an IP address.

1.6 Usage Information

Which Ads you have viewed, so an Ad can show its view count.
On the website, the page visited, the page you arrived from, and a random session identifier. This is counted in aggregate to see which pages work. It is not linked to a SUP account and is not sold or shared with an advertising network. SUP runs no third-party advertising or tracking scripts.

1.7 The Waiting List

If you join the waiting list on the website, we store the name, email address, mobile number and city you enter, and whether you said you want to buy, sell or both, so we can tell you when SUP opens in your city. It is used for that and for nothing else.

1.8 Payment Information

SUP charges only for its own optional features, described in the Terms of Service. For those purchases we store a transaction record: the amount, the currency, what was bought, whether it succeeded or failed, the time, and the reference number returned by the payment provider.

SUP does not receive or store your card number, CVV, UPI PIN, bank account details or net banking credentials. Those are entered on the payment provider's own screens and handled entirely by them. See section 4.

2. Why We Collect It

To create your account and keep you signed in securely.
To publish your Ads and show them to people near you.
To let you message a buyer or seller and make or accept offers.
To send you a verification code or a password reset, by email, through our email provider.
To notify you about messages, offers and saved searches, if you have allowed notifications.
To review Ads before they go live and act on reports.
To detect and stop fraud, impersonation, scams, spam and abuse of the platform.
To take payment for SUP's own optional paid features.
To answer you when you contact support.
To keep accounting and tax records for payments SUP receives, and to meet obligations under Indian law.
To fix faults and decide what to build next.

3. Location

Location is optional. You can use SUP without it by choosing your state and city from a list.

If you do allow location access:

The app reads your position once, at the moment you tap the button. It does not track you in the background.
Your position is turned into a city and area name on your device. What is sent to SUP is the city and area, not a continuous stream of coordinates.
An Ad carries an approximate location so it can be ranked by distance. Other users see the area you chose. SUP does not publish your exact location or your address.

You can withdraw location permission at any time in Android Settings. The app will then ask you to pick a city instead.

4. Payments

SUP uses a third-party payment service provider, Razorpay, to take payment for its own paid features. When you buy one:

Your card, UPI or banking details are entered with the payment provider and processed by them under their own terms and privacy policy.
SUP receives back only a result — whether the payment succeeded or failed — and a reference number for it.
SUP keeps that transaction record for accounting, tax, support, refunds, fraud prevention and legal compliance. Records of payments received are kept for as long as Indian tax and accounting law requires, which is longer than the life of your account.

SUP does not process, hold or see the money that passes between a buyer and a seller for an item. That is arranged entirely between them.

5. Who We Share It With

We do not sell your personal information. We do not share it with advertisers or data brokers. It is shared only as set out below.

5.1 With Other Users

Your display name, username, profile photo, bio, city, rating and your live Ads are visible to other users. Your email address and mobile number are not shown. Messages are visible only to the two people in that conversation.

5.2 With Service Providers

These companies process data on our instructions so the product can run:

Railway — hosting for the SUP server and database.
Cloudinary — storage and delivery of Ad photos and profile pictures.
Resend — sending verification and password reset emails.
Expo — delivering push notifications to your device.
Google Firebase — delivering push notifications, and texting the code when you verify your mobile number.
Google Analytics — measuring how visitors use the SUP website: pages viewed, the device and browser, and the approximate area (city level) of the visit. It uses cookies; the last part of your IP address is removed before it is stored. You can turn it off with Google's opt-out browser add-on.
Razorpay — processing payments for SUP's own paid features.
Vercel — hosting the SUP website.

5.3 For Legal Reasons

We may disclose information where the law requires it, in response to a valid order from a court or a competent authority, or where it is necessary to investigate fraud or protect the safety of a person.

5.4 If The Business Changes Hands

If SUP is merged with or acquired by another business, user information may transfer as part of it. We will tell you before that happens.

6. How It Is Protected

Passwords and passcodes are hashed with bcrypt, never stored as text.
Sign-in tokens are signed with RS256 and the token that authorises requests is short-lived.
All traffic between the app, the website and our server uses HTTPS.
On your device, sign-in tokens are held in Android's encrypted keystore rather than in ordinary app storage.
Administrator access to the database is restricted and logged.

No system is perfectly secure. Use a password you do not use anywhere else, and turn on the app passcode or fingerprint unlock.

7. How Long It Is Kept

Account and profile information is kept while your account exists, and then as described in section 8.
Ads you delete are hidden immediately and removed from our systems afterwards.
Messages are kept while the conversation exists so both people can read it.
Sign-in and security records are kept for a limited period.
Verification codes expire within minutes.
Payment records for purchases from SUP are kept for as long as tax and accounting law requires.

8. Deleting Your Account

You can delete your account in the app: Settings → Privacy Settings → Delete Account. You confirm with your password. Without the app, see Delete Your SUP Account.

When you do, and we want to be exact about this:

Your account is closed immediately and you are signed out everywhere.
All sign-in tokens for the account are destroyed.
Your email address is scrambled in our database so it can no longer identify you or be used to sign in, and your stored password is erased.
Your profile and Ads stop being shown anywhere in the app or on the website.
Messages you sent remain visible to the other person in that conversation, because the conversation is theirs as well as yours.
Records we are required to keep — chiefly payment and tax records, and records needed to deal with fraud or a legal claim — are retained for the period the law requires, and are not used for anything else.

If you want the remaining information removed sooner than the above, or want to know exactly what is held about you, write to sellusedproduct@gmail.com and we will deal with it.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

tell you what personal data we hold about you and who we shared it with;
correct anything inaccurate or incomplete;
erase your data, subject to the retention set out above;
withdraw a consent you have given, such as location or notifications;
nominate someone to exercise these rights if you cannot.

Most of this you can do yourself in the app: edit your profile, turn notifications off, revoke location permission, or delete your account. For anything else, write to sellusedproduct@gmail.com from the address on your account. We aim to respond within 30 days.

A data export you can download yourself is not built yet. Until it is, ask us by email and we will send you a copy.

10. Children

SUP is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, tell us and we will remove it.

11. Changes To This Policy

We may update this policy. The date at the top says when it last changed. If a change materially affects how your information is used we will tell you in the app or by email before it takes effect.

12. Contact

For any privacy question, request or complaint, write to sellusedproduct@gmail.com with Privacy in the subject line. Other ways to reach us are on the contact page.