Privacy Policy

Draft — not yet reviewed by a lawyer. This page describes, as accurately as we can, what data Kivajo actually collects and how it's actually used today. It is not final and should not be relied on as a binding privacy notice until it has had proper legal review before public launch (see docs/LEGAL/README.md).

What we collect

• Account details: your email address, a display name, and a password (stored as a one-way hash — we never see or store your actual password).
• Location: a city or postal-code-level place you choose from a fixed list for your area. Kivajo never reads your device's precise location, and listings never expose a precise address.
• Two-factor authentication: if you turn on TOTP (2FA), the shared secret is encrypted at rest, not stored in plain text.
• Listing and message content: whatever you write in a listing or a message to another user.
• IP address, in two limited cases: when you request an email-verification, password-reset, or email-change link (to help detect abuse of that flow), and when a staff member takes a moderation action (to keep an audit trail of staff actions). We don't log your IP address on every page view or use it for general tracking.

Cookies

Kivajo sets two cookies: a session cookie that keeps you logged in, and a CSRF cookie that protects forms from being submitted from other sites. Both are required for the site to work and neither is used for advertising or tracking. We don't use any third-party analytics or tracking scripts.

Who else sees your data

Kivajo uses Cloudflare Turnstile to help tell humans from bots on some forms; Cloudflare processes the data needed for that check. Account emails (like verification and password-reset links) are sent through a transactional email service — as of this draft, that service isn't yet configured for the live site. We don't sell your data or share it with advertisers.

How long we keep it

We keep your account data for as long as your account exists. If you delete your account, your email, display name, password, and 2FA secret are removed or replaced, all your sessions are ended, and pending security tokens tied to your account are deleted outright. Listings, messages, and ratings you already created stay in the system (attributed to "Deleted user") because other users' transaction and rating history depends on them, but they're no longer tied to any of your personal information.

Your choices

You can review and update your account details, change your password, and delete your account at any time from your profile. You can block another user to stop them from contacting you or seeing your listings.

Children

Kivajo is not directed at, and accounts are not intended for, anyone under 18.

Changes to this policy

We may update this page as the service changes; meaningful changes will be reflected here.

Contact

Questions about this policy can be sent through the contact details on the site once published.