Privacy Policy

Version 1.0 · Effective 2 September 2026

Fleekart is a local exchange app. To run it we need some of your personal data. This policy says what we collect, why, who sees it, how long we keep it, and how you can control it. We have tried to write it in plain language.

1. Who we are

Fleekart ("Fleekart", "we", "us") operates the Fleekart Android app and the website fleekart.com. We are based in Chennai, Tamil Nadu, India. Fleekart is the data fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Legal entity details will be added to this page when incorporation completes.

Questions about this policy: info@fleekart.com. Our Grievance Officer is named in section 12.

2. What we collect

Account and identity

• Email address and password. Passwords are stored only as a salted hash.
• Display name, avatar photo, short bio, locality/area.
• Date of birth. Used once to confirm you are 18 or older. We record that the check passed and when.
• Mobile number. Verified by a one-time code sent over WhatsApp. One verified number can belong to one account only. Your number is never shown to other users.
• Social sign-in. If you sign in with Google, LinkedIn or Meta (Facebook), we receive your name, email address and the provider's account identifier. We do not receive your password, contacts, posts or friends list, and we do not post on your behalf.

Listings, stories and media

• Everything you put in a listing: title, description, category, brand, condition, photos, optional video, and the Plinks you ask for.
• New Life stories you submit after an exchange: one photo and a caption.
• Photos and videos are stripped of embedded metadata (such as camera location and device details) before they are stored or shown.

Location

• Your device location (GPS) only if you choose it for nearby search. You can use the app without it by picking an area or PIN code instead.
• Your pickup address for a listing. We store the exact address, the approximate public area, and the map point separately. Other users see only the area and a distance band.
• The agreed pickup point for an exchange. It is visible only to the two people in that exchange, and is deleted 90 days after the exchange closes unless a dispute is open.

Exchanges, Plinks and messages

• Requests, acceptances, pickup schedules, handover codes, confirmations, ratings and disputes.
• Every Plinks movement, recorded in a ledger that cannot be edited afterwards.
• In-app chat messages (text only) between you and the other person in an exchange.
• Masked calls: if you call the other person through the app, the call goes through a temporary proxy number provided by our telephony provider. We record that a call was placed and its duration. We do not record call audio, and neither party sees the other's real number.

Safety, support and abuse prevention

• Reports you make and reports made about you, blocks, moderation decisions and appeals.
• Support tickets and the messages in them.
• Device and network signals: device model, OS version, app version, IP address, a device identifier, and login events. We use these to stop referral abuse, brute-force attempts and duplicate accounts, and to keep sessions secure.
• One-time code (OTP) events: when a code was sent, to which channel, and whether it was used.

Notifications and analytics

• A push notification token from Google Firebase Cloud Messaging, if you allow notifications.
• Usage events such as "listing published" or "exchange confirmed". These events never contain your name, email, phone, message text, listing text or exact location. Location appears only as a distance band or area label. We do not use an advertising identifier and there is no advertising SDK in the app.
• Crash and error reports, with personal data removed.

What we deliberately do not collect

• Your contacts or address book. Invitations use your phone's share sheet and a referral code.
• Your microphone, call logs or SMS.
• Government ID or KYC documents.
• Payment card details. Plinks cannot be bought in this version of the app.

3. Why we use it

We do not sell personal data. We do not use it for advertising. We do not build profiles for third parties. We do not make decisions about you by automated means that have legal effect, other than the automatic interim safety measures described in the Community Guidelines, which a person then reviews.

4. App permissions

The app asks for a permission only when you first use the feature that needs it, and works without it where it can.

• Location — only when you choose "near me" search or GPS location. Denying it means you pick an area or PIN code instead.
• Camera and photos — only when you add photos or a video to a listing, set an avatar, or submit a story. We use the system picker, not broad storage access.
• Notifications — asked once, with an explanation. You can change it in Android settings at any time.
• Not requested: contacts, microphone, phone, call log, SMS.

5. What other users can see

• Public profile: display name, avatar, locality/area, bio, ratings summary, number of completed exchanges, impact badge, approved New Life stories, and your published listings.
• On a listing: the area and a distance band from the viewer — never the exact address, map point or your phone number.
• Inside an accepted exchange only: the chat, the agreed pickup point, and the ability to call through a masked number.
• Never public: email, mobile number, date of birth, exact address, Plinks balance, reports, blocks, disputes.

6. Who we share data with

We share only what each provider needs to do its job, under contract, and they may not use it for their own purposes.

Some of these providers process data outside India. Where they do, we choose providers whose safeguards meet the requirements of the DPDP Act and applicable rules.

We will disclose data to police, courts or regulators when the law requires it, and to protect the safety of a user or the public. We will tell you where the law allows us to.

If Fleekart is ever acquired or merges with another business, your data may transfer with it. The new owner will be bound by this policy unless you are told otherwise and given a choice.

7. How long we keep it

8. Your rights and choices

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and how it has been used.
• Correct or update it — most of it from your profile in the app.
• Erase it by deleting your account (see section 9 for exactly what is erased and what is kept).
• Withdraw consent for optional processing — notifications and analytics — from the app's settings or your phone's settings. Withdrawing consent does not affect what was done before.
• Nominate another person to exercise these rights for you if you are unable to.
• Complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

To exercise a right we cannot serve in the app, email info@fleekart.com from your registered email address. We may send a one-time code to your verified number to confirm it is you. We respond within 30 days.

9. Deleting your account

You can delete your account from Profile → Delete my account, or by following the steps on our account deletion page. Deletion is refused while you have an exchange in progress or Plinks held for one, so that the other person is not left stranded.

When you delete, we erase your name, email, phone number, avatar, date of birth, saved locations, uploaded media, and the text of your chat messages, and we remove your push token. Your remaining Plinks are forfeited.

We keep, attached to an anonymous placeholder shown as "Deleted user": Plinks ledger entries, exchange records, OTP events, disputes, penalties, ratings and audit records, for the periods in section 7. These are records that belong to the other person in each exchange as much as to you, and removing them would falsify the ledger.

Deletion is immediate and cannot be undone.

10. Security

• All traffic between the app and our servers uses TLS 1.2 or higher.
• Sign-in tokens are stored in your phone's secure hardware-backed storage, are short-lived, and are rotated. You can log out of every device from the app.
• Media is served through signed, expiring links. Uploads are checked for type, size and safety before publication.
• Sensitive actions are rate-limited. Staff access to personal data is role-based, needs two-factor authentication for administrators, and is logged. Staff can see an agreed pickup point only against a linked report or dispute, and that access is audited.
• Daily backups are encrypted and kept for 30 days.

No system is perfectly secure. If we learn of a breach affecting you, we will inform you and the Data Protection Board as the DPDP Act requires.

11. Age limit

Fleekart is for adults. You must be 18 or older to create an account, and we check your date of birth at signup. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, email info@fleekart.com and we will remove it.

12. Changes and contact

When we change this policy we will update the version and effective date at the top, and tell you in the app before the change takes effect if it is material. Using Fleekart after that date means you accept the updated policy.