Privacy Policy

Version 2026-10-10-v1 · Controller: [Operating entity — to be confirmed by owner] · Contact: business@omfix.store

Data we collect: email, display name, private first/last/legal names, username, service area, verification-code hashes (10-min, single-use), session token hashes (30-day), your posts/listings/messages/reports, uploaded media, financing application details, and private verification documents (role-based access only). Only your display name (and username if set) is public; email, private names and documents are never in public views.

Purposes: sign-in, abuse prevention, marketplace operation, moderation/appeals, notifications. No sale of personal data. No advertising, analytics, or session-replay scripts are currently loaded; fonts are system fonts.

Consent: account Terms acceptance is recorded against your account with version + timestamp. Marketing and nonessential tracking are separate, optional, unchecked by default, and withdrawable in Settings/Preferences; guest cookie choices are stored on-device only.

Retention: sessions 30 days (logout revokes immediately); codes 10 minutes; content kept while your account is active. Deletion requests: profile and stored objects removed per schedule; backups purge on rotation; audit/moderation records retained where required by law. We do not promise immediate universal deletion.

Your rights: signed-in users can request access, correction, export (Settings → Export) and deletion (Settings → Deletion request); outcomes are tracked. Identity checks are proportionate; abuse reports do not expose complainant documents.

Storage & transfers: primary operation targets Uganda. Hosting country: to be confirmed by owner (see deployment docs). Cross-border transfers only with appropriate safeguards.

This page mitigates risk; it does not certify legal compliance. Missing details (entity registration, DPO registration, licences) are marked as requiring owner action.