Privacy Policy

01What we collect

Data you give us

Your bank or UPI details are not in that list, on purpose. When you withdraw from your wallet, we ask our payout provider (RazorpayX) to generate a secure payout link and we send you to it; you enter your bank account or UPI id on the provider’s own page. That destination goes to the provider, never to us — there is no field for it in the app and no column for it in our database. See clause 12.

Data generated by your use of the app

• Transaction records — orders, the delivery address as it stood at checkout, prices and fees, payment and refund reference numbers from our gateway, courier tracking numbers and the courier’s scan history, returns, disputes, wallet entries, withdrawals (as payout-link references and status, not bank numbers), coupons and referrals.
• Activity on the marketplace — what you have listed, favourited, viewed, followed, offered on and boosted, and your seller rating and sales count.
• Blocked messages. When a message is blocked for containing contact details or an off-platform payment proposal, we keep the message text as a record of the attempt. See clause 10.
• Analytics events — which screens you open and which actions you take, tied to your account id or, before you sign in, to a random local identifier. See clause 9.
• Technical and diagnostic data — your platform, app version and locale; and, when something goes wrong on our servers, an error report containing your account id, the request route and the technical error. Those reports are filtered to strip out authorisation headers, tokens, passwords, email addresses, phone numbers, PIN codes, addresses, bank fields, request bodies and IP addresses before they leave our systems.
• Your IP address, used transiently to rate-limit abusive traffic. We do not store it. The durable rate-limit records hold a one-way hash of an email address or an account id, never an IP address.
• Your session token, held on your device. It contains your account id and an expiry, and nothing else.

Data from Google, if you choose to sign in with Google

If you sign in with Google, Google gives us your Google account identifier, your email address, your name and a link to your profile picture. That is all we receive; we do not get your contacts, your calendar or anything you post on Google’s services. Note that a Google profile picture stays hosted by Google, so when another user views your profile, their device loads that image from Google.

02What we do not collect

So there is no ambiguity, the app does not collect and we hold no record of:

• your date of birth, age, gender, caste, religion, political views, health, biometrics or any other special category of data;
• your PAN, Aadhaar, or any other government identifier;
• your bank account number, IFSC or UPI id — you enter these on our payout provider’s own page, and they never reach us;
• your card number, CVV, expiry, UPI PIN, net-banking credentials or one-time passwords — you enter those into the payment gateway’s own interface, and they never reach us;
• your device location, at any level of precision;
• your device’s advertising identifier (IDFA, IDFV or Android Advertising ID);
• your contacts, photo library beyond the images you deliberately pick, microphone audio, SMS or call history;
• a persistent device identifier or fingerprint.

03Why we use it

Under the Digital Personal Data Protection Act, 2023, we process your personal data either with your consent or for a legitimate use the Act permits. In practice:

We do not use your personal data to make any decision that has a legal effect on you without a person involved. Returns and disputes are decided by our team, not automatically.

04Who we share it with

We share personal data only with the service providers we need in order to run the marketplace, and only the data each one needs. These are the third parties Recloset actually uses today. Each one is bound to use the data only for the service it provides to us.

We may also share data with our professional advisers — auditors, accountants and lawyers — under a duty of confidentiality, where they need it to advise us.

Recloset sends no marketing email or SMS. We do not use an email or SMS provider to market to you, so no marketing messaging vendor holds your contact details. Notices reach you inside the app.

05Where your data goes

Our application, database and image storage run on Amazon Web Services in ap-south-1.

Some of the providers above process data outside India:

• PostHog receives analytics events at its ingest endpoint in the United States. If you turn analytics off, nothing is sent.
• OpenAI processes the message text or listing attributes it is given in the United States.
• Google processes a Google sign-in on its own global infrastructure.
• Sentry may process a stripped error report outside India.

Razorpay, RazorpayX and XpressBees operate in India. Where personal data is transferred outside India, we do so on contractual terms that require the provider to protect it, and only to countries not restricted by the Central Government under section 16 of the Digital Personal Data Protection Act, 2023.

06Other disclosures

• When the law requires it. We may disclose personal data to a court, regulator, tax authority or law enforcement agency where we are legally obliged to, or where disclosure is necessary to investigate or prevent fraud or a crime, to enforce our Terms Buyer Protection, or to protect the rights, property or safety of our users, the public or us.
• To the other side of your transaction. Your name, phone number and delivery or pickup address are given to the courier and appear on the parcel label, which means the other party to the order can see them. That is unavoidable in a marketplace where people ship to each other.
• If our business changes hands. If we are reorganised, merged or acquired, or if we sell part of our business, personal data may transfer to the acquirer as part of it. We will tell you if that happens, and the acquirer will remain bound to handle your data under a policy no less protective than this one.

07What other users can see

Your profile is public inside the app: your name, your profile photo, your bio, the city you typed, your rating, your sales count, your active listings and who you follow. Ratings and comments you leave on an order appear on the other party’s profile and cannot be edited or deleted by you afterwards.

Your email address is never shown to another user. Your phone number and address are shared only with the party on the other side of a paid order, and only through the parcel and the courier — they are not displayed on your profile.

Anything you write in a chat is visible to the person you are writing to, and, where we need to review a dispute or an abuse report, to our support team.

08Cookies and tracking

The Recloset app uses no cookies, no web beacons and no tracking pixels. You stay signed in through a token stored on your own device, not a cookie. Our image delivery network is configured to ignore cookies entirely.

We do not read your device’s advertising identifier, and the app contains no advertising, attribution or remarketing software. Because we do not track you across other companies’ apps or websites, the app shows no App Tracking Transparency prompt on iOS — there is nothing to ask you for. There is nothing here that a Do-Not-Track signal would change.

09Analytics, and how to turn it off

We record a limited set of product events — a screen opened, a listing published, a checkout started — so we can see which parts of the app work and which do not. Events carry your account id, the event name and a few technical properties: platform, app version, locale and a session identifier.

They deliberately do not carry your name, email, phone number, address, the content of your listings or messages, any amount of money, or any device identifier. Your IP address is sent as empty and location lookup is disabled at the provider, so analytics cannot place you.

You can switch analytics off. Go to your profile, then Settings, and turn off analytics. Nothing further is sent from that point. Events already collected can be erased on request — see clause 15.

10Automated screening and AI features

Chat screening. Every message sent through Recloset is checked before it is delivered, to block phone numbers, email addresses, links to other platforms and proposals to pay outside Recloset. The check runs first as a set of pattern rules on our own servers. Where a message is ambiguous about off-platform payment, its text is sent to OpenAI to be classified. Blocked attempts, including the original text and the classification result, are recorded so we can act on repeated attempts and review appeals. Screening is a safety measure applied to everyone; it is not a profile of you, and it is not used to make any decision about you other than whether that message sends.

Listing descriptions. If you ask the app to draft a description, the listing attributes you entered are sent to OpenAI to produce the draft. The draft is a suggestion you can edit or discard, and you remain responsible for what you publish.

We do not use your personal data to train any AI model of our own, and we do not permit our providers to train their models on data we send them.

11Device permissions

The app asks for one permission, and only when you first need it:

• Photos. So you can choose images from your library for a listing, a profile photo or return evidence. We receive only the images you pick. We do not scan your library, and we do not keep the location or other metadata embedded in an image file.

The app requests no location, contacts, microphone, calendar, SMS or notification permission. You can review or revoke any permission in your device settings; revoking photo access means you will not be able to add images.

12Security

We take reasonable security safeguards as required under the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Among them:

• traffic between the app and our servers is encrypted in transit over TLS;
• passwords are stored only as bcrypt hashes, never in a form we or anyone else can read;
• our storage buckets block all public access, and stored objects and queues are encrypted at rest;
• listing images are uploaded through short-lived, single-purpose upload permissions that expire in 10 minutes;
• our error reports and money-movement logs are built on allow-lists, so bank details, email addresses, phone numbers and addresses cannot structurally appear in them;
• abusive traffic is rate limited, and rate-limit records hold a one-way hash rather than your email address.

One thing worth being plain about your bank details: Recloset does not hold them. A withdrawal is paid by a RazorpayX payout link, and you enter your bank account or UPI id on RazorpayX’s own page. That destination never passes through the app and is never stored in our database — there is no field for an account number or IFSC anywhere in it. What we keep against a withdrawal is the amount, the provider’s payout-link reference and its status, so that we can reconcile a failed transfer.

No system is perfectly secure, and no transmission over the internet can be guaranteed against interception. Please use a strong, unique password and tell us at once at support@recloset.in if you think your account has been compromised. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected user as the law requires.

13How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires us to.

14Deleting your account

You can delete your account from Manage account inside the app. You will be asked to type DELETE to confirm, because deletion is immediate, permanent and cannot be undone. There is no grace period and no way to recover the account afterwards.

We will not let you delete while any of these is true, because each one is money or an obligation in flight:

• your wallet holds a positive balance — withdraw it first;
• your wallet is in debt to us;
• a withdrawal is still being processed;
• you have an order that is not finished;
• you have a return that is not finished.

What deletion does:

• your name is replaced with “Deleted user”, and your email address, password, phone number, address, PIN code, bio, city, Google link, referral code and pickup registration are erased;
• your profile photo is deleted from our image storage — the file itself, both the resized copy and any original, not merely the link to it. If your picture came from Google because you signed in with Google, we only ever held the address of Google’s copy, so we remove that address; the copy is Google’s and not ours to delete;
• your drafts, favourites, the accounts you followed, your browsing history and your notifications are deleted outright;
• your active listings are hidden from the marketplace, and your open offers expire.

What survives deletion, and why:

• Completed orders, including the delivery address as it was recorded at the time, because the other party to each sale needs their own record of it, and because we are required to keep transaction records;
• wallet and payout entries, which are append-only accounting records — these hold amounts and payout-link references, never a bank number;
• chat messages, ratings, support tickets, return evidence and records of blocked messages, so a counterparty’s history and an abuse record are not erased by the person who created them. This includes any photograph you attached to a support ticket or a return request — both the resized copy and the original file as you uploaded it. A dispute record that loses its evidence stops being a record, and the other party to the dispute is entitled to theirs. For that reason, please do not attach a photograph of an identity document, or of anything else you would not want kept, to a support ticket or a return;
• a minimal record that the account was deleted — the account id, the time, and a few counts. It cannot be altered or removed, including by us.

Two things we cannot reach on your behalf: a session token already on a device stays valid until it expires, and a profile picture hosted by Google is Google’s to delete, not ours. If you also want your analytics events erased, ask us — that is a separate step and we will do it on request.

If you only want to step away, you can deactivate instead. Deactivation hides your profile and listings and is reversible by signing back in.

15Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• know what we hold — a summary of your personal data and of the processing we do, and the identities of the parties we have shared it with;
• have it corrected — correction of inaccurate or misleading data, and completion or updating of incomplete data. Most of it you can edit yourself in the app;
• have it erased — deletion of personal data we no longer need, subject to what we must keep by law, as set out in clause 14;
• withdraw your consent — including turning analytics off, or closing your account. Withdrawing consent does not undo processing already lawfully done;
• nominate someone to exercise these rights on your behalf if you die or become incapable of exercising them yourself;
• a readily available means of grievance redressal, and to escalate to the Data Protection Board of India if we do not resolve your grievance.

How to exercise them. Most changes you can make yourself: edit your profile and address in the app, toggle analytics in Settings, deactivate or delete your account under Manage account. For anything else — a copy of your data, an erasure request that goes beyond account deletion, a nomination, or a question about this policy — write to support@recloset.in from the email address on your account, or use Request my data under Manage account, which opens the same request for you.

We will verify that the request comes from you, respond within 30 days, and tell you if we cannot do something and why. We do not charge for this. Please do not send us more information than the request needs.

You are also obliged, under the Act, not to make a false or frivolous request and not to impersonate anyone in providing your data.

16Children

Recloset is for adults. Our Terms require you to be at least 18. We do not knowingly collect personal data from anyone under 18, we do not collect date of birth, and we do not direct any part of the Service at children or profile or advertise to them.

If you believe a child has created an account or given us personal data, tell us at support@recloset.in and we will close the account and delete the data.

17Changes to this policy

We may update this policy. When we do, we will change the revision date at the top of this page, and where a change materially affects how we use your personal data we will notify you in the app before it takes effect. If a change requires your consent, we will ask for it. Continuing to use the Service after a change takes effect means you accept the updated policy; if you do not, you can stop using the Service and delete your account.

Data we collected before a change is used in accordance with the policy in force when it was collected, unless you consent otherwise.

18Contact and grievances

Questions about this policy, or a request about your data, go to support@recloset.in, or through Need help in the app.