Privacy Policy

1. Your rights

You have the right to (a) access the personal data we hold about you, (b) request correction of inaccurate data, (c) request deletion of your account and associated data, (d) object to or restrict certain processing, and (e) receive a copy of your data in a portable format. To exercise any of these rights, email support@zaymyanmar.com. We will respond within 30 days.

2. Purposes we process data for

• Providing the marketplace (accounts, listings, messaging, search).
• Verifying that a user controls the phone number they registered with.
• Preventing fraud, spam, and misuse of the messaging inbox.
• Product analytics — understanding which features are used and how well the site performs.
• Serving relevant advertising through third-party ad networks (see Section 5).
• Complying with applicable law and responding to lawful requests from authorities.

3. Categories of data collected

• Account data: phone number, email address, display name, password hash, OTP verification timestamps.
• Listing content: everything you post — title, description, price, photos, category attributes, location.
• Messages: messages you send to other users through the in-site inbox.
• Device data: IP address, browser user-agent, screen size, referrer URL.
• Usage data: pages visited, searches run, listings viewed, timestamps.
• Security telemetry: when we refuse a request — a failed sign-in, a rate limit, a browser blocking a script — we record what was refused, when, the approximate country and city, and the browser and operating system. The IP address is stored both as a one-way keyed code and as a shortened network address, so repeated abuse can be recognised without identifying you; see Section 4 for how long each is kept.
• Cookies and similar technologies: see Section 6.

4. How long we keep data

• Active accounts: for as long as the account exists.
• Deleted accounts: personal identifiers are removed within 30 days; anonymised aggregate usage data may be retained indefinitely.
• Expired or removed listings: kept in an archive for up to 12 months for fraud investigation, then deleted.
• Messages: kept for as long as both parties keep their accounts, then removed with the account.
• Server logs (IP, request paths): 90 days.
• Security telemetry (records of requests we refused — a failed sign-in, a rate limit, a blocked script): your IP address is dropped after 30 days; the remaining record, which identifies no one, after 90. It is kept to detect and stop abuse.

5. Sharing with third parties

We do not sell personal data. We share it only with the following categories of processors and partners, all of whom are bound by data-processing agreements:

• Hosting: Vercel Inc. (application hosting), Neon (managed PostgreSQL), Cloudflare R2 (image storage), Cloudflare (CDN and DDoS protection).
• Authentication: our SMS gateway provider for delivering one-time codes to your phone.
• Advertising: Google AdSense and its ad-technology partners may set cookies and process your IP address to serve and measure ads. See Google's advertising disclosure and Google Privacy Policy. You can opt out of personalised advertising at adssettings.google.com.
• Analytics: aggregate, non-identifying usage statistics only.
• Legal: where required by law, court order, or a lawful request from Myanmar authorities.

6. Cookies and similar technologies

We use cookies for three purposes:

• Strictly necessary — session cookies to keep you signed in and to remember your preferences (language, region). These cannot be disabled.
• Analytics — first-party cookies used to count unique visitors and measure page performance.
• Advertising — third-party cookies set by Google AdSense and its partners to serve and measure ads. These can be disabled via Google Ads Settings or in your browser.

7. Security

Passwords are stored as salted hashes. Traffic between your device and our servers is protected with TLS. Access to production data is restricted to authorised personnel and logged. We also keep a short-lived record of requests we refuse, so that abuse can be detected and stopped; Sections 3 and 4 describe what that contains and how long it lasts. No system is perfectly secure — if you become aware of a security issue, please report it to support@zaymyanmar.com.

8. Children's privacy

zaymyanmar is not directed at users under 18 and we do not knowingly collect personal data from children. If you believe a child has provided us with data, contact support@zaymyanmar.com and we will delete it.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced on the site at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent change.

10. Contact

Questions about this policy or how we handle your data can be sent to support@zaymyanmar.com. See also the contact page for other channels.