Privacy Policy

Last updated: April 26, 2026

24h Commerce ("we", "us", "our") operates a mobile marketplace application. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, username, and optionally your phone number, profile photo, and location (city/region/country).

Transaction Information

When you buy or sell items, we collect shipping addresses, payment method details (processed via Stripe — we do not store full payment credentials), and transaction history.

Content You Create

Photos, item descriptions, chat messages, and reviews you post on the platform.

Device & Usage Data

We collect device identifiers, app version, operating system, and basic usage analytics via Firebase Analytics (Google Analytics for Firebase) to improve our service.

2. How We Use Your Information

• Provide, maintain, and improve our marketplace service
• Process transactions between buyers and sellers
• Send push notifications (order updates, chat messages, marketing — with your consent)
• Prevent fraud and enforce our Terms of Service
• Analyze usage patterns to improve user experience

3. Information Sharing

We share information only in these cases:

• Between buyers and sellers: Shipping addresses and contact info as needed to complete transactions
• Payment processors: Stripe receives transaction details to process payments
• Cloud infrastructure: Supabase (database), Cloudflare (media storage/CDN), Firebase (notifications/analytics)
• Legal requirements: When required by law or to protect rights and safety

We do not sell your personal information to third parties.

4. Data Security

We use industry-standard measures to protect your data:

• All data in transit is encrypted via TLS/HTTPS
• Sensitive data (bank accounts) is encrypted at rest using Fernet symmetric encryption
• Database access is controlled via Row Level Security (RLS) policies
• Authentication tokens are signed with ES256 (asymmetric keys)

5. Data Retention

• Active listings expire automatically after 24 hours
• Archived listing media is retained for 30 days
• Account data is retained until you delete your account
• Transaction records are retained for legal/tax compliance (minimum 7 years)

6. Your Rights

You can:

• Access and update your profile information at any time
• Opt out of marketing notifications in Settings
• Opt out of analytics tracking in Settings > Privacy
• Delete your account (Settings > Delete Account), which removes your personal data
• Request a copy of your data by contacting us

7. Children's Privacy

Our service is not directed to children under 16. We do not knowingly collect information from children under 16.

8. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via in-app notification or email.

9. Contact Us

If you have questions about this Privacy Policy, contact us at:

La Onda Inc. — privacy@laonda.io