1. Who we are
fnder ("fnder", "we", "us") is a hyperlocal classifieds application for Android. It is an independent project, currently in development, operated by its developer. For anything in this policy, including requests about your data, write to avirajsfdc@gmail.com.
This policy covers the fnder mobile app, the shared-ad pages served from fnder-share.fnder.workers.dev, and this website.
2. What we collect
Everything below is collected because a feature needs it. There is no category of data we gather "just in case".
Account
- If you sign up with email: your email address and a password. The password is never stored in a readable form — authentication is handled by Supabase Auth, which stores a hash.
- If you sign in with Google: the email address, display name and profile picture URL that Google returns to the app. We do not receive your Google password and we do not get access to anything else in your Google account.
Profile
- A display name, which other users see on your ads and messages.
- A profile picture, if you add one.
- A place label — a short name such as a locality or city, derived from your device's location. It is set by the app, not typed in.
- The date your account was created.
Location
- Your device's latitude and longitude, stored once per account and refreshed when you open or resume the app. See section 4.
- The latitude and longitude each of your ads was posted from, stored on the ad itself.
Content you create
- Ads: title, description, category, price and price type, status, and the photos you attach (up to six).
- Unpublished drafts of ads, saved so you can come back to them.
- Comments and replies on ads, and the likes you give comments.
- Chat messages, including any photos you send in a chat, and whether a message has been read.
- The ads you mark as interested, and the ads you save.
Safety and moderation
- Reports you file against an ad or a person, including which ad or account you reported and when.
- The list of accounts you have blocked.
- A count, held against an account, of how many reports it has received.
Device and technical
- A push notification token for the device, and the platform it is on, so a notification can be routed to your phone. This is a device address, not a name — it is readable only by your own account.
- Ordinary server logs kept by our hosting providers, which include IP addresses and request times. We do not build profiles from them.
Stored only on your phone
Your chosen search radius, your theme and language preference, and your signed-in session token are stored on the device itself — the token in the platform's encrypted storage. None of these are sent to us as analytics.
3. Why we collect it
| Data | What it is for |
|---|---|
| Email, password | Creating your account and signing you back in. |
| Display name, picture | So the person on the other end of an ad or a message knows who they are dealing with. |
| Location | Sorting ads by distance, filtering them to your chosen radius, and pinning your own ad where you posted it. |
| Ads and photos | Publishing what you have posted to people nearby. |
| Comments, interest, saves | The public conversation on an ad, and your own shortlist. |
| Chat messages | Delivering the conversation to the other person, and showing it to you both later. |
| Reports and blocks | Acting on abuse, and keeping two people apart once one of them has asked for it. |
| Push token | Sending a notification to the right device. |
Under India's Digital Personal Data Protection Act, 2023, we process this data on the basis of the consent you give when you create an account, grant the location permission and post content — and, for safety and moderation records, our legitimate need to keep the service usable. Where another country's law applies to you, you may have further rights; see section 10.
4. Location, specifically
Location is the feature. It is also the most sensitive thing the app touches, so here is exactly what happens.
- The app asks for the location permission and explains why before it does. If you refuse, the app tells you what will not work; it does not try to derive your position some other way.
- When granted, the app reads your position and stores one latitude and longitude for your account, replacing the previous one. It is refreshed when you open or resume the app — there is no background tracking and no location history. We keep your current position, not where you have been.
- Your coordinates are never shown to another user. Other people see a distance ("1.1 km") and a place label, both computed on the server. The row holding your coordinates can only be read by your own account.
- An ad records the position it was posted from. That is what makes its distance stable: if you move across town, your old ads stay where you posted them rather than following you around.
- To show a readable place name, the app asks your device's own geocoding service to turn coordinates into a locality. On Android this is a system service, and the request leaves the app for the operating system's provider.
5. What other people can see
Visible to other users of the app:
- Your display name and profile picture.
- Your ads, with their photos, price, description, place label and how far away they are from the person looking.
- Your comments and replies.
- How many people are interested in an ad, and how many have messaged about it.
Visible only to you:
- Your exact coordinates.
- Your saved ads and your drafts.
- Which ads you have marked as interested — others see the count, not the names.
- Your blocked list, and the reports you have filed.
Visible only to you and the other person:
- Your chat messages.
6. Photos and files
Profile pictures, ad photos and photos sent in chat are stored in cloud file storage. These files are served to anyone who has the file's URL, without a sign-in. Access to a chat is restricted to its two participants, but the image file behind a message is not protected in the same way.
In practice: treat a photo you send as something that could be seen outside the conversation, and do not photograph documents, cards or anything else you would not put in a public ad.
7. Who else handles it
We do not sell your data and we do not share it with advertisers. The companies below process it on our behalf, because the app runs on their infrastructure.
| Who | What they handle |
|---|---|
| Supabase | The database, sign-in, file storage and real-time messaging. Effectively all app data is stored here. |
| Google — Firebase Cloud Messaging | Delivering push notifications. Receives the device token and the content of the notification. |
| Google — Sign-In | Only if you choose to sign in with Google. Google confirms who you are and returns your email, name and picture. |
| Android system services | Turning coordinates into a place name, through the device's own geocoding provider. |
| Cloudflare | Serving the public page for a shared ad, and this website. |
These providers operate internationally, so your data may be stored or processed outside the country you are in. We may also disclose data where we are legally required to.
8. Tracking and advertising
The app contains no analytics SDK, no advertising SDK, no attribution or A/B-testing library, and no third-party tracker. We do not profile you, we do not build an advertising identifier, and there is no ad inventory in the app to sell.
This website sets no cookies and loads nothing from a third party — its fonts are served from its own domain. See the cookie policy.
9. How long we keep it
| Data | Kept |
|---|---|
| Account and profile | Until you ask us to delete the account. |
| Your location | One current position per account, overwritten each time the app reads it. Removed with the account. |
| Ads and photos | Until you delete the ad or the account. |
| Chat messages | Until the account is deleted. Deleting a conversation removes it from your inbox; the other person keeps their copy. |
| Comments | Until you delete them or the ad is removed. |
| Reports | Kept permanently, including after the reported ad is deleted — otherwise deleting an ad would erase the complaint about it. |
| Server logs | For the period our hosting providers retain them. |
10. Your rights
You can ask us to:
- tell you what data we hold about you,
- give you a copy of it,
- correct anything that is wrong,
- delete your account and the data attached to it,
- withdraw a consent you previously gave — for example by revoking the location permission.
Write to avirajsfdc@gmail.com from the email address on the account. We will respond within 30 days. If you are not satisfied with the response, you may complain to the Data Protection Board of India or to the regulator in your own country.
11. Deleting your account
The app does not yet have a button that deletes your account. Until it does, email avirajsfdc@gmail.com from the address you signed up with and we will delete the account, your profile, your stored location, your ads and their photos, your drafts, your saved ads, your comments and your messages.
Two things survive: reports filed about you, which are kept as moderation records, and anything another user has independently saved or copied. Full detail is on the account and data deletion page.
12. Security
- All traffic between the app and our servers is encrypted in transit (HTTPS).
- Access to data is enforced in the database itself with row-level security rules, so a row you are not entitled to is not returned even if the app asks for it.
- Passwords are stored as hashes by our authentication provider, never in readable form.
- Your session token is kept in the device's encrypted storage.
- The one deliberate exception is image files, which are served by URL without a sign-in.
No service can promise perfect security. If we become aware of a breach affecting your data, we will tell you and the relevant authority as required by law.
13. Children
fnder is not intended for children. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if you believe a child has an account, write to us and we will remove it.
14. Changes to this policy
If this policy changes, the date at the top of the page changes with it, and material changes will be announced in the app. Continuing to use fnder after a change means you accept the updated policy.
15. Contact
Privacy questions, data requests and complaints: avirajsfdc@gmail.com. Other ways to reach us are on the contact page.
Last updated 13 October 2026 · effective 13 October 2026.