Privacy Policy

Version 1.3 · Effective 24 October 2026

Fleekart is a local exchange app. To run it we need some of your personal data. This policy says what we collect, why, who sees it, how long we keep it, and how you can control it. We have tried to write it in plain language.

1. Who we are

Fleekart ("Fleekart", "we", "us") operates the Fleekart Android app and the website fleekart.com. We are based in Chennai, Tamil Nadu, India. Fleekart is the data fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Legal entity details will be added to this page when incorporation completes.

Questions about this policy: info@fleekart.com. Our Grievance Officer is named in section 13.

2. What we collect

Account and identity

• Email address and password. Passwords are stored only as a salted hash.
• Display name, short bio, locality/area, and your profile photo (avatar) if you choose to add one.
• Date of birth. Used once to confirm you are 18 or older. We record that the check passed and when.
• Mobile number. Verified by a one-time code sent over WhatsApp. One verified number can belong to one account only. Your number is never shown to other users.
• Social sign-in. If you sign in with Google, LinkedIn or Meta (Facebook), we receive your name, email address and the provider's account identifier. We do not receive your password, contacts, posts or friends list, and we do not post on your behalf. Fleekart's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received through Facebook Login or LinkedIn sign-in is used only to authenticate you and create or link your account; it is never sold, shared with data brokers, or used for advertising.

Listings, stories and media

• Everything you put in a listing: title, description, category, brand, condition, photos, optional video, and the Plinks you ask for.
• New Life stories you submit after a transaction: one photo and a caption.
• Photos and videos are stripped of embedded metadata (such as camera location and device details) before they are stored or shown.

Location

• Your phone's precise location, only if you allow it, rounded to about 100 m and used only to find what is near you. Section 5 says exactly how it is kept. You can use the app without it by picking an area or PIN code instead.
• Your pickup address for a listing. We store the exact address, the approximate public area, and the map point separately. Other users see only the area and a distance band.
• The agreed pickup point for a transaction. It is visible only to the two people in that transaction, and is deleted 90 days after the transaction closes unless a dispute is open.

Transactions, Plinks and messages

• Requests, acceptances, pickup schedules, handover codes, confirmations, ratings and disputes.
• Every Plinks movement, recorded in a ledger that cannot be edited afterwards.
• In-app chat messages (text only) between you and the other person in a transaction.
• Masked calls: if you call the other person through the app, the call goes through a temporary proxy number provided by our telephony provider. We record that a call was placed and its duration. We do not record call audio, and neither party sees the other's real number.

Safety, support and abuse prevention

• Reports you make and reports made about you, blocks, moderation decisions and appeals.
• Support tickets and the messages in them.
• Device and network signals: device model, OS version, app version, IP address, a device identifier, and login events. We use these to stop referral abuse, brute-force attempts and duplicate accounts, and to keep sessions secure.
• One-time code (OTP) events: when a code was sent, to which channel, and whether it was used.

Notifications and analytics

• A push notification token from Google Firebase Cloud Messaging, if you allow notifications.
• Usage events such as "listing published" or "exchange confirmed". These events never contain your name, email, phone, message text, listing text or exact location. Location appears only as a distance band or area label. We do not use an advertising identifier and there is no advertising SDK in the app.
• Crash and error reports, with personal data removed.

Launch waitlist (our website)

• Email address and, if you give it, your area. When you use "Get notified" on fleekart.com. We use it only to email you once when the app launches. It is not linked to an app account. To keep the form from being abused we store a one-way, keyed hash of your IP address, never the address itself.

What we deliberately do not collect

• Your contacts or address book. Invitations use your phone's share sheet and a referral code.
• Your microphone, call logs or SMS.
• A history of where you have been. Your location is kept as one rounded position, never as a log, and never while the app is in the background.
• Government ID or KYC documents.
• Payment card details. Plinks cannot be bought in this version of the app.

3. Why we use it

We do not sell personal data. We do not use it for advertising. We do not build profiles for third parties. We do not make decisions about you by automated means that have legal effect, other than the automatic interim safety measures described in the Community Guidelines, which a person then reviews.

4. App permissions

The app asks for a permission only when you first use the feature that needs it, and works without it where it can.

• Location — asked on the home screen, after the app has explained what it is for, because the home screen shows what is near you. Denying it means you pick an area or PIN code instead; the app never blocks on it. It is used only while the app is open, never in the background. See section 5.
• Camera and photos — only when you add photos or a video to a listing, set an avatar, or submit a story. We use the system picker, not broad storage access.
• Notifications — asked once, with an explanation. You can change it in Android settings at any time.
• Not requested: contacts, microphone, phone, call log, SMS.

5. Your location

Fleekart works by showing you what is close by. To do that well the app uses your phone's precise location, but only if you allow it, and only as set out here.

• What we collect. Your phone's precise location, each time you open the app, if you have allowed it. Before your phone shows the permission prompt, the app explains in its own words what it is for. And, if you set a saved place on the map, the spot you chose.
• Why. To show you what is near you, and to tell a seller roughly how far away your request is. We use it for nothing else.
• How we keep it. Rounded to about 100 metres. One position per member, replaced when you open the app (at most once every five minutes). We keep no history of where you have been. A position not refreshed for 30 days is deleted, and it is deleted with your account. Encrypted backups of our database, kept for up to 30 days to recover from a failure, may still hold it until they expire; they are never used for anything else. When you create a listing, the listing is placed at about 1 km of where you are - never your exact spot. A spot you set on the map is kept the same way, rounded to about 100 metres, as part of that saved place, until you move it, remove it, delete the place or delete your account.
• Who sees it. Nobody. Other users see only a distance band, such as "2–5 km", never an exact distance and never your position. The exact place to meet is shared only inside an accepted transaction, by the listing owner, and only with the other person in it.
• How to withdraw. Switch location off for Fleekart in your phone's settings. The app keeps working: you pick an area instead, and "near you" is measured from there. From then on the app sends no position, and the next time you open it the position we hold is deleted.

6. What other users can see

• Public profile: display name, avatar, locality/area, bio, ratings summary, number of completed transactions, impact badge, approved New Life stories, and your published listings.
• On a listing: the area and a distance band from the viewer — never the exact address, map point or your phone number.
• Inside an accepted transaction only: the chat, the agreed pickup point, and the ability to call through a masked number.
• Never public: email, mobile number, date of birth, exact address, your position, Plinks balance, reports, blocks, disputes.

7. Who we share data with

We never sell or rent personal data to anyone. We share only what each provider needs to do its job, under contract, and they may not use it for their own purposes.

Some of these providers process data outside India. Where they do, we choose providers whose safeguards meet the requirements of the DPDP Act and applicable rules.

We will disclose data to police, courts or regulators when the law requires it, and to protect the safety of a user or the public. We will tell you where the law allows us to.

If Fleekart is ever acquired or merges with another business, your data may transfer with it. The new owner will be bound by this policy unless you are told otherwise and given a choice.

8. How long we keep it

In short: your data is kept while your account is active, and afterwards only for as long as Indian law and the fair running of the service require — chiefly for fraud prevention and resolving disputes between users. The table gives the exact periods.

9. Your rights and choices

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and how it has been used.
• Correct or update it — most of it from your profile in the app.
• Erase it by deleting your account (see section 10 for exactly what is erased and what is kept).
• Withdraw consent for optional processing — notifications and analytics — from the app's settings or your phone's settings. Withdrawing consent does not affect what was done before.
• Disconnect a social sign-in at any time from your Google, Meta (Facebook) or LinkedIn account's security settings, where you can also remove Fleekart's access. Your Fleekart account continues with your email and password.
• Nominate another person to exercise these rights for you if you are unable to.
• Complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

To exercise a right we cannot serve in the app, email info@fleekart.com from your registered email address. We may send a one-time code to your verified number to confirm it is you. We respond within 30 days.

10. Deleting your account

You can delete your account from Profile → Delete my account, or by following the steps on our account deletion page. Deletion is refused while you have a transaction in progress or Plinks held for one, so that the other person is not left stranded.

When you delete, we erase your name, email, phone number, avatar, date of birth, saved locations, your stored position, uploaded media, and the text of your chat messages, and we remove your push token. Your remaining Plinks are forfeited.

We keep, attached to an anonymous placeholder shown as "Deleted user": Plinks ledger entries, transaction records, OTP events, disputes, penalties, ratings and audit records, for the periods in section 8. These are records that belong to the other person in each transaction as much as to you, and removing them would falsify the ledger.

If you received the welcome Plinks, we also keep a one-way, keyed code made from your email address and phone number, so the welcome Plinks are not given again if you sign up later. It is not linked to the anonymous placeholder or to anything else, and it cannot be turned back into your email or number.

Deletion is immediate and cannot be undone.

11. Security

• All traffic between the app and our servers uses TLS 1.2 or higher.
• Sign-in tokens are stored in your phone's secure hardware-backed storage, are short-lived, and are rotated. You can log out of every device from the app.
• Media is served through signed, expiring links. Uploads are checked for type, size and safety before publication.
• Sensitive actions are rate-limited. Staff access to personal data is role-based, needs two-factor authentication for administrators, and is logged. Staff can see an agreed pickup point only against a linked report or dispute, and that access is audited.
• Daily backups are encrypted and kept for 30 days.

No system is perfectly secure. If we learn of a breach affecting you, we will inform you and the Data Protection Board as the DPDP Act requires.

12. Age limit

Fleekart is for adults. You must be 18 or older to create an account, and we check your date of birth at signup. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, email info@fleekart.com and we will remove it.

13. Changes and contact

When we change this policy we will update the version and effective date at the top, and tell you in the app before the change takes effect if it is material. Using Fleekart after that date means you accept the updated policy.