SUP ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the SUP mobile application and website (collectively, the "Service"). Please read this policy carefully.

1. Information We Collect

Information You Provide Directly

Account information: Email address, display name, username, and password when you register.
Profile information: Profile photo, bio, city, and other optional details you choose to add.
Listing content: Photos, titles, descriptions, prices, and conditions of items you list for sale.
Messages: Content of messages exchanged with other users through our in-app chat.
Reviews: Ratings and written reviews you submit after transactions.
Authentication credentials: Passcode (stored as a secure hash) for app access.

Information Collected Automatically

Device information: Device type, operating system version (Android), and unique device identifiers.
Usage data: Features used, pages viewed, listing interactions, and session durations.
Location data: City-level location when you choose to include it in listings (we do not collect precise GPS coordinates without explicit permission).
Push notification tokens: Expo push tokens to deliver in-app notifications.
Log data: IP addresses, access times, and error logs for security and debugging purposes.

2. How We Use Your Information

We use the information we collect to:

Create and manage your account and authenticate your identity
Enable you to post listings and communicate with other users
Send transactional emails (OTP verification, password reset) via Resend
Send push notifications about messages, offers, and saved search matches
Display your public profile and listings to potential buyers or sellers
Improve our platform, fix bugs, and develop new features
Detect and prevent fraud, abuse, and violations of our Terms of Service
Comply with legal obligations under applicable Indian laws

3. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

With other users: Your public profile (display name, city, average rating) and active listings are visible to all users. Messages are visible only to participants in that conversation.
Service providers:
- Railway (hosting infrastructure — PostgreSQL database and API server)
- Cloudinary (image storage and optimization for listing photos and avatars)
- Resend (transactional email delivery for OTPs and notifications)
Legal requirements: We may disclose information when required by law, court order, or government authority under Indian law.
Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred with appropriate notice.

4. Data Security

We implement appropriate technical and organizational measures to protect your data:

Passwords are hashed using bcrypt with salt rounds — never stored in plaintext
Authentication tokens use RS256 JWT with short expiry (15 minutes for access tokens)
All data in transit is encrypted via HTTPS/TLS
Sensitive credentials are stored using Android's Secure Enclave via Expo SecureStore
Database access is restricted to our Railway internal network

No method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password and enable biometric authentication within the app.

5. Your Rights and Choices

You have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Update or correct inaccurate information through your profile settings
Deletion: Request deletion of your account and associated data
Portability: Request your data in a machine-readable format
Opt-out of notifications: Manage notification preferences within the app settings

To exercise any of these rights, contact us at hello@sup.app. We will respond within 30 days.

6. Data Retention

We retain your data for as long as your account is active or as necessary to provide the Service. Specifically:

Account data is retained until you delete your account
Deleted listings are soft-deleted and purged after 90 days
Messages are retained for 1 year after a conversation ends
Log data is retained for 90 days
Email verification OTPs expire after 10 minutes

7. Children's Privacy

SUP is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If we discover that a child under 18 has provided us with personal information, we will delete it immediately.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by sending an email to your registered address or displaying a prominent notice in the app. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

9. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA). Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in India.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer at:

Email: hello@sup.app
Subject line: Privacy Policy Inquiry