Privacy policy
How information is used in Secondhand Lanka.
Draft for launch review · Updated 3 October 2026This is a draft for the upcoming launch. The operating details and policies will be finalised before public release.
01Information you provide
When you create an account, Firebase Authentication processes your email address and password. Your marketplace profile can include your name, bio, district, and profile photo. Listings include item photos, descriptions, condition, town, district, and price. We also store your saved favourites and messages exchanged through the app.
02How information is used
Information is used to create and maintain your account, display profiles and listings, help people search for items, save favourites, and deliver buyer–seller conversations. Technical information may be processed to operate the service and prevent abuse.
03What other people can see
Your marketplace profile and published listing details are visible to people browsing the app. Your account email is not included in public profile records. Conversations are available to their participants. If a participant reports a conversation, its 10 most recent messages are copied into a private report for authorised moderators to review. Only include information you are comfortable sharing with recipients and, when reported, the moderation team.
04Service providers
The app uses Google Firebase Authentication, Cloud Firestore, Cloud Storage, and Cloud Functions to operate accounts, store content, and run marketplace features. These services may process technical information, including IP addresses, and may process information outside Sri Lanka. See Firebase’s privacy information for details about these services.
Firebase privacy information05Photos and local storage
The app asks for access to selected photos so you can add listing and profile images. Listings support up to three compressed photos. The app stores account state, cached marketplace data, favourites, and supported pending actions on your device to support browsing and synchronisation.
06Retention and your choices
Account information and marketplace content are stored while your account is active. You can update your profile and listing details in the app. To permanently delete your account, open Your profile → Profile options → Delete account, confirm your current password, and type DELETE. Deletion removes your sign-in account, profile, listings, uploaded listing and profile photos, favourites, blocks, and reports submitted by you or about your account. All conversations involving you, including both participants’ messages, are removed for both participants. The app clears its account-specific local data on the device where deletion is requested. Other devices may retain previously cached data until local app data is cleared; copies saved by other people cannot be recalled.
07Deletion processing and external requests
Once an in-app deletion request is accepted, marketplace access is restricted and you are signed out. Cleanup runs in the background and automatically retries if interrupted. A minimal operational record containing your account identifier, deletion status, timestamps, and any cleanup error code is retained for 30 days after completion, then removed by daily maintenance. Provider-managed logs and backups follow the provider’s retention settings and are not erased by this cleanup. You can also request deletion without installing the app through our Account deletion page. Support verifies ownership before initiating deletion. Never send your password or verification codes. Contact support if you need help or confirmation that cleanup has completed.
Request account deletion08Safety reports and blocked members
We store the community-rules version you accept and its acceptance time. A block record includes the blocked account identifier, display name at the time of blocking, and timestamp; it is private to you. Blocking prevents both accounts from starting or sending messages to each other, and hides the blocked member’s listings on your device. Reports contain the reporter and reported account identifiers, the reason and optional details, and a copy of the reported listing, profile, or the conversation’s 10 most recent messages. Authorised moderators can access reports and record review decisions. Reports are removed by daily maintenance after 90 days from submission, or sooner when the reporting or reported account is deleted. Suspension records are retained while the restriction remains in effect; contact support to appeal.
09Website privacy
This website does not include analytics, advertising trackers, account registration, or a server-submitted contact form. Contact links open your email application. When you email us, we receive the information you choose to include. The website hosting provider may process ordinary request logs.
10Updates and contact
This policy will be updated when the app or its data practices change. For privacy questions, contact the support address on our Contact us page.