Privacy

What we collect

When you sign in with Google or Facebook, we receive your name, email address and profile photo from them. We do not receive or store your password.

You can add a WhatsApp number and an IC number to your profile. Both are optional, though an IC number may be required before bidding if we have that setting switched on.

Using the site creates records: listings you post, bids you place, the maximum you were willing to pay, items on your watchlist, ratings you leave, and any reports or disputes you raise.

What other people can see

On a public auction page, other users see your initials only — not your full name — along with your profile photo, your rating, how many items you have sold, and the month you joined.

Bid history is public, with bidders shown by initials.

Never shown publicly:

• Your email address, WhatsApp number and IC number
• The maximum you set on a bid — only you can see your own ceiling, which is what makes proxy bidding work
• Your watchlist
• Whether you reported a listing. Sellers are never told who reported them.

When your contact details are shared

When an auction ends successfully, the winner and the seller are shown each other's name, email address and WhatsApp number, so the two of you can arrange the handover. This only happens once there is a completed sale between you, and only between those two people.

If you raise a dispute, the seller you are disputing with can read what you wrote. They have to be able to answer it.

Who else handles your data

We run on services that necessarily process some of it on our behalf:

• Supabase — database and sign-in
• Vercel — hosting
• Cloudinary — listing photographs
• Resend — the emails we send you
• Google and Meta — sign-in, if you use those

We do not sell your data, and we do not share it for advertising.

Emails we send

We email you about things happening to your account: being outbid, an auction you are watching closing soon, winning, and the outcome of any report or dispute. These are part of using the site rather than marketing, and we do not send newsletters.

Getting your data removed

You can delete your account from your profile. Your name, photo, email, WhatsApp number and IC number are erased and you can no longer sign in.

Bids and completed auctions stay on record with no name attached, because other people's auction history depends on them — the full explanation is here.

Asking us about your data

To see what we hold about you, correct it, or have it removed if you cannot sign in, email fahmi.hjrosli@gmail.com from the address on your account.

Changes

If this policy changes in a way that affects you, we will say so on the site rather than quietly editing this page.