Privacy policy

We collect what an account and a listing need, and one anonymous measure of how the site is used. We do not sell your data, we do not run advertising trackers, and we do not use cookies to follow you around the internet.

You can download everything we hold, correct it, or delete it — all three from your Settings page, all three taking effect immediately.

Account: your name, email address, and mobile number if you give one. Needed to create the account, sign you in, and contact you about it. The password is handled by our authentication provider and is never stored by us in a readable form.

Listings: everything you type into your shop's listing. This is published deliberately — a directory nobody can find is not a directory.

Messages you send us: the text of a correction, a contact message or a grievance, and the name, email or phone you choose to leave with it. Those are optional except on a grievance, where we need some way to answer you.

Usage: which pages and categories get looked at, how many results a search returned, and which tower pages get opened. This is how we work out what the market actually looks for.

That is the whole list. We do not collect location, device identifiers, contacts, or anything from your browser beyond what is described here.

Two things, separately, and you can change either at any time in Settings.

Running your account — creating it, keeping you signed in, and telling you about things you asked for: replies to your messages, quotes on your requests, and changes to a shop you own. This one is required, because there is no version of an account that does not involve it. Withdrawing it means deleting the account, which you can do yourself.

Email about the platform — occasional news about features and the market. Entirely optional, off unless you turn it on, and refusing it changes nothing else.

We record each decision separately with the date, the exact wording you were shown, and the version of this notice. If we change this notice we ask again rather than assuming the old answer still stands.

We do not set a tracking cookie, and the usage measure itself never stores your IP address. Instead, a one-way hash is computed from your network address, your browser's user-agent string, a secret held on our server, and today's date. That digest is what gets stored.

One correction, because the distinction matters: our hosting provider, Vercel, records your IP address and browser in its own request logs whenever you load a page, in the ordinary course of serving the site. Those are records we control, so it would be wrong for us to tell you your IP address is stored nowhere. It is never joined to your account, and never to the usage measure described above.

Because the date is part of it, the same visitor produces a different value tomorrow. Actions can be joined up within a day — which is what tells us whether people find what they came for — and cannot be joined up across days, by us or by anyone who obtained the data.

Search terms are stored separately and in aggregate, to find gaps in the catalog. They are never attached to a person.

Questions you type into the assistant are kept the same way and for the same length of time, alongside which of our written answers you were given. We read them to find questions nobody has written an answer for, and to fix answers that are landing badly. They are not attached to a person or to your account.

The Act treats every service we use as a transfer, and makes us — not them — responsible for it. So here is the full list, what each one gets, and where it is.

Neon — our database and file storage. Holds your account and everything you list. The database is in Singapore (ap-southeast-1); the company is in the United States. We handle sign-in in our own server code.

Supabase — our old database and file storage. A copy of account and listing details from before the move remains there until it is removed. The data is in Mumbai (ap-south-1); the company is in the United States.

Vercel — hosting. Runs the site's code and serves the pages. Our functions run in Singapore; the company is in the United States and its content network is worldwide.

Resend — email. Gets your address and the text of a message only when we actually send you one. United States.

Razorpay — payments. Gets what a payment needs when you buy a plan, and nothing otherwise. India.

Sentry — error reports, so a crash can be fixed. Receives technical detail about a failure. Routed through our own domain rather than to them directly, so your browser never talks to them. United States.

That is the complete list. There is no advertising network, no analytics product, no tag manager and no third-party script on this site. Typefaces are served from our own domain, not from Google.

Anyone at all sees the parts of a shop listing that are published — that is the point of a listing. And law enforcement, if we are legally required to hand something over.

We do not sell or rent personal data to anybody, for any purpose.

One cookie, for keeping you signed in. It is set only after you sign in, it is not readable by scripts, and it is not used for analytics or advertising.

Because we run no tracking cookies, there is no consent banner to click past.

Account and listing data: while the account is open. If you delete your account, seven days more so you can undo it, and then it is erased — by a job that runs daily, not by us remembering.

Usage measurements: 180 days, then deleted automatically. The daily hash stops being linkable the day after it is written in any case.

Search terms: 365 days. They are not attached to a person at any point.

Messages, corrections and grievances: three years after the matter is closed, so we can show what was asked and what we did about it.

Consent records: for as long as the account exists and then as evidence that we asked — they are the proof that processing was lawful, and deleting them would destroy the record that protects you.

Anything we are required by law to keep, such as records tied to a payment, is kept for the period that law requires and is not used for anything else.

You can see, correct, or ask us to delete the personal data we hold about you, and you can withdraw consent.

None of those need us at all. Signed in, Settings has “Download my data”, which gives you a file containing your profile, your shops, the requests you posted, the quotes you were sent and the reviews you wrote; “Your details”, where you correct your name and mobile number yourself; “What we may use it for”, where you give or withdraw consent in one click; and “Delete this account”.

Deleting signs you out at once and takes any shop you own off the directory. The seven days after that are yours to change your mind in — sign in again during them and everything comes back exactly as it was. Nobody can restore it afterwards, us included. If you would rather not wait, the same form has a box that erases everything immediately.

Your email address is the one thing you cannot change yourself: it is how you sign in, and the new one has to be confirmed before the old one stops working. Ask us and we will do it.

If your shop is listed and the details are wrong, the correction form fixes it faster than anything else — you do not need an account to use it.

The Act gives you something most privacy laws do not: the right to name someone else to exercise these rights on your behalf if you die or become unable to.

The Government's rules for how this works are still to be published. Until they are, write to our Grievance Officer with the person's name and how to reach them, and we will record it against your account. When the rules arrive we will build whatever they specify and honour what we have already recorded.

A nominee proves who they are before we act on anything — we will ask for identification and for evidence of the circumstances.

This site is for people who buy and sell IT hardware, and it is not intended for anyone under 18. The terms of use say so, and creating an account is a statement that you are 18 or over.

We do not knowingly collect data from a child. If we learn that an account belongs to someone under 18, we delete it and everything on it rather than asking for a parent's consent, because there is nothing here a child needs.

We do not profile anyone or serve behavioural advertising, so none of the tracking the Act specifically forbids for children happens to anyone on this site, whatever their age.

If you believe a child has given us data, tell our Grievance Officer and we will remove it.

Our Grievance Officer under the Digital Personal Data Protection Act 2023 is Ishaan Walia. Write to waliaishaan17@gmail.com, or use the grievance form on this site — both reach the same person.

We log every grievance with the date it arrived and answer within 30 days.

If our answer does not satisfy you, you may take the matter to the Data Protection Board of India.

If personal data here is exposed or taken, we will tell the Data Protection Board and the people affected. Our own target is 72 hours from confirming it, which is the international norm — the Act's own deadline is still to be set in the rules.

What we tell you will say what was exposed, what it means for you, and what we are doing about it. We would rather say it early and incompletely than wait until we have a tidy story.

Data is encrypted in transit. Our database is not reachable from a browser: the public data API is switched off and every table denies access by default, with authorisation checked on our server for every request. Private messages are encrypted before they are stored, with a key the database does not hold.

No system is perfectly secure. If you find a vulnerability, tell us through the contact page before telling anyone else, and we will not come after you for it.