Privacy

Adda (adda.com.pk) is a marketplace where verified university students buy, sell and hire each other on campus. It is run by a student in Pakistan. This policy explains what we collect, why, who can see it, how long we keep it and how you can delete it. Questions: email ibrahimawab06@gmail.com or message us from Help in the app.

Signing in with Google

You sign in with your university email account, through Microsoft (Outlook) or Google. We ask them only for your basic profile (the openid, email and profile permissions). From them we receive:

• Your email address, to check that it belongs to a university on Adda and to keep one account per student.
• Your name, used only to greet you inside the app. Other students never see it; they see the display name you choose.
• Your account ID from Microsoft or Google, so you can sign in again and so a banned account can't simply sign up again.
• Google also sends a link to your profile picture. We don't use or show it; your Adda photo is one you upload yourself.

We never get your password, and we can't read your email, files, contacts or anything else in your account.

Adda's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to sign you in and run your account. We don't sell it, use it for advertising, or use it to train AI models.

You can also link a second Google account as a backup sign-in. We store its email address for that purpose only.

What you add

• Your profile: display name, bio, photo, school and batch (worked out from your university email).
• Listings: titles, descriptions, prices, photos and meetup spots.
• Chats: messages, photos and offers between you and the other person.
• Deals and reviews: agreed prices, deal status and the reviews you give and get.
• Dues payments: amount, payment method, transaction ID and the receipt screenshot you attach.
• Reports, appeals and support messages you send us.

What we collect automatically

• When you were last active, and how many people viewed your listings.
• If you turn on notifications: a push subscription from your browser so we can notify you.
• Page analytics from Vercel that don't use cookies or identify you.
• Standard server logs (such as IP address and browser type) kept by our hosting providers for security.

How we use it

• To run the marketplace: show listings, deliver messages, record deals, reviews and dues.
• To keep people safe: check that everyone is a real student, hide phone numbers and social handles in chats, catch prohibited items, and handle reports and appeals.
• To send the notifications you've turned on, by push or email.

Who can see what

• Other students see your display name, school, batch, photo, bio, listings, rating and reviews.
• A chat can be read only by the two people in it. Adda staff can open a chat only if it was reported or flagged by our filters, and every time they do is logged.
• Your real name and email are visible only to the Adda owner, only to deal with a serious report, and every look is logged.
• Payment receipts are visible only to you and the Adda staff who check payments.

Automatic checks

Messages and listings are checked for phone numbers, social handles, blocked words and prohibited items. The text of a new listing may be checked by an AI model (through Vercel's AI Gateway) to catch rule breaks. It can hold a listing for a human moderator to look at; it never bans anyone on its own.

Who we share it with

We don't sell your data or show ads. We use a few providers to run Adda, and they process data only for us:

• Supabase: database, file storage and sign-in.
• Vercel: hosting, anonymous analytics and the AI Gateway used for listing checks.
• Resend: notification emails.
• Google: signing in.

We'd share information with authorities only if Pakistani law requires it, or to protect someone from serious harm.

How long we keep it

• Chats close when their deal is done or their listing closes, and are deleted, with their photos, 30 days after closing (longer only while a report about them is open).
• Payment receipts are deleted as soon as the payment is checked. Receipts for payments that couldn't be found are kept 30 days in case you appeal, then deleted.
• Listings stay on your profile until you close them; they expire from the feed after 30 days unless renewed.
• Deal records, dues and reviews are kept while Adda runs, because the other person and the dues record depend on them.
• Strikes expire after 6 months. Records of staff actions are kept for accountability.

Deleting your account

You can delete your account yourself from Account & safety once your dues are cleared and you have no open deals. We then remove your listings, notification settings and saved searches, and replace your name, bio and photo with “Deleted user”. Your real name and backup email are erased. We keep your university email and Google account ID so a deleted or banned account can't be recreated to escape dues or a ban, and past deals and reviews stay, anonymised.

Your choices

• Edit your profile any time, and turn push or email notifications on or off in Account & safety.
• Ask us what we hold about you, or to correct it, from Help or by email.
• You can remove Adda's access at any time from your Microsoft or Google account settings, under connected apps.

Security

Data travels over HTTPS and is stored with Supabase. Access is controlled by strict database rules: you can only read what you're allowed to, and staff actions on sensitive data are logged.

Who Adda is for

Adda is only for students with a university email from a supported university. It isn't meant for children, and we don't knowingly collect data from anyone under 13.

Changes

If we change this policy in a way that matters, we'll update the date above and tell you in the app.