Privacy Policy

SOLED is a peer-to-peer fashion marketplace. This policy covers the SOLED mobile app, the public website, account registration, marketplace transactions, messaging, live selling, support, safety, moderation, and optional item-authentication requests.

SOLED is still in private testing. The legal name and address of the data controller, and a dedicated privacy contact, have not yet been finalized. Those details must be published here before a public launch.

Depending on the features you use, SOLED may handle the following information:

• Account and profile information, such as email address, username, profile name, avatar, biography, location, account role and status.
• Private contact and delivery information, such as phone number and shipping address, when needed for account or order features.
• Marketplace content and activity, including listings, product photos, drafts, favourites, followed sellers, searches, offers, orders and fulfilment details.
• Completed-order ratings and optional written review feedback. A submitted review remains private until both order participants submit; moderation records may be retained for safety and legal handling.
• Messages, reports, support requests, moderation records and notification activity.
• Payment and transaction records, including amounts, currency, status and payment-provider references. SOLED does not store full payment-card details.
• Live-selling information, including session membership, auction actions, bids, comments, live video and audio while a session is running. The current SOLED code does not record or archive live video or audio.
• Item-authentication information if you choose to request a CheckCheck review, including product images, product details, serial information, remarks and the authentication result.
• Technical and security information, such as session identifiers, device or browser details, page URL, user agent, timestamps, limited error context and activity used to operate, secure and troubleshoot the service. On supported physical devices, if you grant permission, SOLED may also process an Expo push token and a device-installation identifier to deliver transactional service notifications.

• Create and protect accounts, restore sessions and provide password recovery.
• Publish listings and profiles, personalize discovery and let buyers and sellers communicate.
• Process offers, payments, shipping, refunds, orders and related records.
• Operate transaction-backed reviews, calculate profile rating summaries and moderate abusive or unlawful review content.
• Operate live sessions, viewer participation, comments, bids and auction outcomes.
• Provide item authentication when a user requests it and the integration is enabled.
• Send service notifications and respond to support, safety and legal requests.
• Detect abuse, investigate reports, enforce marketplace rules and keep reliable audit records.
• Monitor reliability and fix technical problems using limited crash and error reporting in configured staging or production releases. SOLED does not use this for advertising, cross-app tracking or general product analytics.
• Send transactional account, marketplace and security updates by push notification only when the feature is configured and you grant device permission. SOLED does not use this foundation for marketing push notifications.

Where EU or UK data-protection law applies, SOLED expects to rely on:

• Contract: to create your account and provide the marketplace, messaging, live, payment and order features you request.
• Legitimate interests: to secure SOLED, prevent fraud and abuse, improve reliability, moderate content and operate a safe marketplace, balanced against your rights.
• Legal obligations: to keep records or respond when tax, accounting, payment, consumer-protection or other laws require it.
• Consent: where the law requires a choice, for example when you grant device camera, microphone or photo-library permission. You can change device permissions in system settings.

Information is shared only as needed to run the feature, complete a transaction, protect users, comply with law, or when you make content public. Public listing information, listing photos and the public parts of a seller profile can be seen by other users.

The audited code uses Supabase for authentication, database, file storage and realtime features; Stripe for payment processing; LiveKit for live audio, video and data transport; and Vercel/Next.js infrastructure for the website and server endpoints. A configured crash-reporting provider and Expo's push-delivery service may receive limited diagnostic data or a push token when those features are enabled. CheckCheck receives item information only when an authentication request is made and that integration is enabled.

SOLED does not sell personal information and the audited app does not share information for cross-app advertising. Providers may process information under their own terms and data-processing arrangements.

Stripe processes payment details and payment authentication. SOLED sends transaction amounts, currency and identifiers needed to create and reconcile a payment. SOLED stores payment status, amounts and provider references, but not full card numbers or security codes.

The current integration is configured for testing. SOLED must complete payment, retention, refund and legal reviews before accepting real money.

When an order is shipped, SOLED stores the delivery name and address, selected shipping method, courier, tracking number and fulfilment status needed to complete and support the order. The repository does not currently verify an active automated courier or label-generation provider, so no courier company is named here.

Before a courier integration is enabled, SOLED must disclose the provider and send only the information needed to create, deliver and support the shipment.

SOLED asks for camera or photo-library access only when you choose to take or select product images or use live selling. Photo access is used for listing and optional item-authentication images. Camera and microphone access is used for live selling and camera capture.

You can refuse or later remove these permissions in your device settings. The relevant feature may then be unavailable, but unrelated parts of SOLED should continue to work. The audited app does not request device location or cross-app tracking permission.

If you host or join SOLED Live, camera and microphone data is transmitted through LiveKit so participants can see and hear the session. Session membership, comments, bids, auction actions and outcomes may be stored by SOLED.

Camera and microphone access is optional until you use a feature that needs it. You can refuse or later remove permission in your device settings, although the live feature may then be unavailable. No recording or replay feature was found in the audited code.

When available, CheckCheck is an optional third-party item-authentication service. If you request a check, SOLED may send product images, brand, category, style, serial details, your remarks and a service identifier. SOLED stores the request status, result, certificate information and provider response needed to show and support the check.

The integration is currently disabled unless separately enabled. SOLED will not send an item merely because you viewed it.

SOLED stores in-app notifications about marketplace activity. On supported physical devices, if you grant device permission, SOLED may register an Expo push token for the signed-in account so the server can deliver marketplace, account and security updates. A token is not used as authentication, and SOLED attempts to disable its registration when you sign out. This foundation does not enable marketing push notifications.

Configured staging or production releases may use Sentry crash and error reporting to diagnose reliability problems. SOLED configures this reporting to avoid passwords, authentication tokens, payment credentials, private-message content and full addresses. The feature remains inactive when its provider configuration is absent, including ordinary local development. App-store disclosures and provider details must be reviewed before a public production launch.

SOLED keeps information while an account or transaction is active and as needed to provide the service, resolve disputes, prevent fraud, enforce agreements and meet legal obligations. Public content may remain visible until it is hidden or deleted, subject to safety and transaction records that must be retained.

The audited repository does not yet define a complete category-by-category retention schedule. SOLED must approve and implement that schedule before public launch. Backups and provider systems may retain deleted information for a limited recovery period.

SOLED uses authentication, row-level database access rules, server-side payment and provider credentials, transport encryption and restricted administrative functions to protect information. No online service can promise absolute security. Security controls and the deployed database configuration must be reviewed continuously.

SOLED's infrastructure providers may process information outside your country. Before public launch, SOLED must document the actual hosting regions and transfer safeguards used for each provider, such as an adequacy decision or approved contractual protections where required.

Depending on where you live, you may have rights to:

• Access and receive a copy of your personal information.
• Correct inaccurate or incomplete information.
• Request deletion or restriction of certain processing.
• Object to processing based on legitimate interests.
• Receive eligible information in a portable format.
• Withdraw consent where processing relies on consent, without affecting earlier lawful processing.
• Complain to your local data-protection authority.

A signed-in user can request permanent account deletion in the mobile app through Profile → Settings → Delete account. The confirmation screen explains the consequences and requires the user to type DELETE before the server accepts the request. Public instructions are available at the deletion page linked below.

Where no active transaction exists, SOLED removes account access, anonymizes the public profile, hides Listings, removes Listing images and private profile details, and replaces sent-message content with a deletion notice. Favourites, follows and notifications associated only with the active account are removed.

When a deletion request is accepted, SOLED disables associated Expo push-device registrations and cancels pending push deliveries. A notification already submitted to a push provider may still arrive. The device-registration record then follows the account-deletion and retention process.

If an Order, payment, Paid Offer, refund, claim, dispute or Live transaction is still active, the request is recorded and final deletion is delayed until it is safely resolved. The user can continue using the relevant Order and support features while that happens.

Completed transaction, payment, delivery, tax, fraud-prevention, safety, moderation, dispute or legal records may be retained with restricted access where required or justified. Retained records are not used as an active public profile and are deleted or anonymized when the applicable reason ends.

SOLED is not intended for children under 18. Users must meet the minimum age and any additional requirements that apply where they live.

SOLED may update this policy when features, providers or legal requirements change. The updated date will appear at the top. Material changes should be communicated in the app or by another appropriate method.

A verified privacy email and the controller's legal contact details have not yet been published because SOLED is still in private testing. These details are mandatory before public launch.