This Privacy Policy explains what information the Kheli mobile application (the "App") collects, how that information is used and shared, the choices you have, and how to contact us or delete your data. By using the App you agree to the practices described here.
The categories below match the structure of the Google Play Data Safety form.
| Data type | Why collected | Shared with | Required / optional |
|---|---|---|---|
| Phone number | To create your account, send a one-time SMS verification code, identify you to the system, and let other users contact you about requests you post. | Twilio (to deliver the SMS); Supabase (storage); other users of the App (shown on requests you post). | Required |
| Name (display name) | Shown next to requests you post so other users can identify you. | Supabase (storage); other users of the App. | Required |
| Profile photo | Optional avatar shown next to your requests. | Supabase (storage); other users of the App. | Optional |
| Request content (text, price, category, attached photos) | The content of requests you choose to publish in the App. | Supabase (storage); OpenAI (only if you tap "auto-generate illustration", the request text is sent to OpenAI's image model); other users of the App. | You control what to publish |
| Precise location (GPS coordinates) | Read once, only when you tap "use my location", to pre-fill the map pin on a request you are composing. We do not track your location in the background. | Supabase (stored as the coordinates of the request you publish); other users of the App (so they can find nearby requests). | Optional — you can drag the map pin manually instead. |
| Photos & media (from your device library or camera) | Only the specific image(s) you pick when attaching photos to a request or setting your profile photo. We do not scan or upload other media. | Supabase (storage); other users of the App. | Optional |
| Authentication state on device | After you sign in, your account identifier is stored locally in encrypted AsyncStorage so you do not have to log in every time. | Stays on your device. Cleared on log out or app uninstall. | Automatic |
We do not collect: email address, contacts list, calendar, SMS messages, call logs, browser history, financial information, health data, device identifiers for advertising, or any analytics events. The App contains no advertising SDKs.
| Permission | Why we ask for it |
|---|---|
ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION | Only when you tap "use my location" while composing a request, to read your current coordinates once and pre-fill the map pin. Never used in the background. |
READ_MEDIA_IMAGES / photo picker | Only when you attach a photo to a request or pick a profile photo. We only read the specific image you pick. |
CAMERA | Only when you choose to take a new photo for a request or profile picture instead of picking from the gallery. |
INTERNET | To call our backend over HTTPS so requests can be sent and received. |
The App is a public marketplace of requests. When you publish a request, the data fields described above (name, profile photo if any, phone number, request text and photos, and pinned location) are shown to other users of the App. They may save, screenshot, or contact you using this information. Do not post information you do not want to be public.
| Provider | Purpose | Data shared | Region | Policy |
|---|---|---|---|---|
| Twilio, Inc. | Delivers the one-time SMS verification code. | Your phone number. | United States | twilio.com/legal/privacy |
| Supabase, Inc. | Database that stores accounts, requests, and uploaded images. | All account and request data described in Section 1. | United States / EU | supabase.com/privacy |
| Vercel Inc. | Hosts our backend API. | API request/response data in transit; standard server logs (IP address, timestamps) retained briefly for security and debugging. | United States / global edge | vercel.com/legal/privacy-policy |
| OpenAI, L.L.C. | Only if you tap "auto-generate illustration": generates an image based on your request text. | The request text you submit for illustration. | United States | openai.com/policies/privacy-policy |
| OpenFreeMap / MapLibre | Serves map tiles when the map is displayed. | Standard map-tile requests (no account data). | Global CDN | openfreemap.org |
We do not sell or rent personal information to third parties, and we do not share data for advertising, profiling, cross-context behavioural advertising, or analytics purposes.
We may disclose data if required by valid legal process (court order, subpoena) from a competent authority, or to protect the rights, property, or safety of the App, our users, or the public.
Because our sub-processors (Twilio, Supabase, Vercel, OpenAI) are based primarily in the United States, your information will be transferred to and processed in countries outside your country of residence, including the United States, which may have data-protection laws different from those in your jurisdiction. By using the App you consent to this transfer.
You have the right to:
To exercise any of these rights, email sabachiburashka7@gmail.com from the phone number on your account, or include enough information for us to verify your identity. We respond within 30 days.
You can request full deletion of your account and all associated data (profile, posted requests, uploaded images) at any time. A dedicated, public deletion-request page is available at:
https://helpme-jade-tau.vercel.app/delete-account
Deletion is processed within 30 days. Once complete, your account record and any requests you have posted are permanently removed from our database. Some short-lived operational logs that incidentally reference your phone number may persist for up to 30 additional days before being purged. SMS-delivery records held by Twilio are retained per Twilio's own policy.
All traffic between the App and our backend is encrypted in transit using HTTPS. Data at rest is stored by Supabase, which provides encryption at rest. Authentication is based on phone-number ownership verified via one-time SMS codes; we do not store passwords. We use the principle of least privilege internally and review third-party sub-processors periodically.
No method of transmission or storage is 100% secure. If a data incident affects you, we will notify you within the timeframe required by applicable law.
The App is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction — for example 16 in parts of the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
If we make material changes to this policy, we will update the "Effective date" above and, where appropriate, notify you in the App on the next launch. Continued use of the App after a change indicates acceptance of the revised policy.
Questions, requests, or complaints about this policy or our data practices:
sabachiburashka
Email: sabachiburashka7@gmail.com