Last updated 2026-09-01 • Have these reviewed by a lawyer before public launch.
Account: name, email, phone, username, university/campus, department/level. Listings, images, messages, reviews, reports, verification submissions (matric/ID), payment references (amount/status via Flutterwave — never card numbers), technical data (device, logs).
Operate the marketplace, verify students, enable chat, moderate content, process boosts, prevent fraud, improve the service.
Public: listings, store pages, usernames. Private: messages (participants only), verification documents (admins only, signed URLs), reports (reporter + admins).
Supabase Postgres + Storage with row-level security. Verification and report evidence live in private buckets, never public URLs.
Active data while your account lives. On deletion we anonymize your profile and deactivate the account; transaction, moderation, and safety records are retained as required for fraud prevention and legal compliance.
View, correct, and request deletion of your data via the app or support. Deletion anonymizes rather than instantly destroying retained safety records.
