Privacy Policy

1. Scope and responsibility

Effective: 7 October 2026; feature description updated 19 October 2026. This policy describes data handling in the current Linmee website and mobile-app pilot. Linmee is a product name; the operator and data controller's legal identity, address for legal notices and applicable registration details have not yet been verified and published and must be completed before formal release. Guests can use the public contact form in Legal information.

Registration acceptance means accepting the Terms of Use and acknowledging this policy. It is not unrestricted authorisation for every data purpose, third-party service or marketing. Optional permissions, AI opt-outs and purposes requiring separate consent are handled separately.

2. Account, profile and authentication data

We process email, nickname, language, avatar, account identifier, creation time, verification status, notification preferences, the nearby area you select and save to your account, and the floor and optional Flat you enter. Password sign-in uses salted password hashes, not plaintext passwords. Authentication involves token hashes, expiry, verification-code hashes and temporary OAuth data. Abuse limits use hashes derived from IP addresses or emails; hosting providers may also generate network and security logs.

Google sign-in verifies the provider's identifier, email and available display name. When enabled, Apple sign-in verifies the Apple identifier, email, which may be a relay address, and any name supplied at first authorisation. Linmee does not receive Google or Apple passwords or gain contacts access through sign-in. Registration records the terms version, server-recorded acceptance time and interface language.

3. Listing, interaction and contact data

Listing data includes summaries, titles, descriptions and English versions, photos, categories, brands, quantities, condition, price, nearby area, status and timestamps. Interactions include favourites and lists, saved searches, follows, chat and participants, read and archive states, offers, handover confirmation, reviews, report snapshots, administration records, welcome messages and notifications. Feedback and public contact forms involve submitted contact details, category, content, language, processing state and email receipt identifiers.

Data comes from your submissions, trading participants, reporters, selected sign-in services and necessary device or network information. There is no platform payment or payout service requiring payment cards, bank accounts, payment identity checks or tax identifiers to complete a platform payment. Do not include these details in listings or chats.

4. Who can see your data

Nicknames, avatars, listing photos, titles, descriptions, English versions, prices and public-profile listings and reviews may be visible to guests. Location labels on listings, public profiles and share text use a generic nearby-area label without displaying the selected location name. Account email, floor, Flat and device coordinates are not public. Information you put into photos, descriptions or messages may still be visible to their recipients.

Chat is accessible to participants but is not end-to-end encrypted. Reports create selected-message or content snapshots for authorised administrators; necessary support, security or lawful handling may also involve authorised personnel. Chat text is not sent to the listing-assistance AI. Technical access controls do not mean the operator cannot access stored content.

5. Purposes and lawful bases

Accounts, listings, messages, offers, handovers and requested notifications support performance of the contract for these services. Abuse prevention, security, reporting and support are intended to rely on assessed legitimate interests; actual legal retention or disclosure requirements rely on legal obligations. The operator must still complete and document necessity, balancing and lawful-basis assessments for each purpose. A registration checkbox is not a substitute.

Without required registration information we cannot create an account. If photo or camera permission is refused, other upload options may be available on the device. Signed-in setup requires manually selecting a supported nearby area before continuing. Operating-system location and notification permissions are separate and optional; refusal does not replace or prevent manual area selection. Guests can browse public content. There is currently no marketing sending or subscription service and registration does not subscribe you. Future marketing would require separate notice and applicable choices.

6. Gemini image recognition and translation

Listing assistance is enabled by default without an extra permission dialog. Continue after photos sends the item summary, language and selected item photos to Google Gemini to identify visible features and suggest categories, titles and descriptions. Publishing or editing Chinese listings also sends titles and descriptions to generate English versions. Uploaded photos are compressed and stripped of metadata, but faces, door numbers and document text remain visible content. Do not upload unnecessary private information.

Account email, floor, Flat and chat history are not included as AI inputs. Personal information you put into item text or photos can nevertheless be transmitted with that input. Suggestions are shown for your review and editing; AI does not publish items itself or make transaction decisions with legal effects. Disable processing in Privacy & data to publish manually. Existing opt-outs remain effective; turning it off does not automatically remove already-published English versions. A default is not recorded as affirmative consent.

Google's Gemini API terms and relevant processing arrangements govern inputs, outputs, abuse-detection logs and overseas processing; paid and unpaid arrangements differ. This project's billing status and specific provider arrangements still require verification, so this policy cannot promise no model-improvement use or zero retention. Gemini API terms: https://ai.google.dev/gemini-api/terms . User acceptance does not replace the operator's applicable processing and provider-compliance obligations.

7. Device permissions and local storage

Camera and photo permissions support the item photos or avatar you choose. You manually select a nearby area, which is saved to your Linmee account separately from optional operating-system location access. Granting location permission does not automatically confirm or replace the area choice. Precise coordinates, floor and Flat do not appear in public location labels; precise device coordinates and street addresses are not saved as area information to Linmee's backend. Setup-completion state may be stored per account on this device. Contacts are not read.

When enabled and configured, device push may involve Expo, Apple or Google, device tokens, generic notices and content identifiers. Current push payloads do not include private chat text. Permission alone does not guarantee configured remote push. Sessions, language, search history and some drafts or preferences are stored in the browser or device; sign-out, local-data removal and device settings can manage relevant content.

8. Providers and sharing

Cloudflare Workers, D1 and media storage host the backend, database and uploaded media. Resend sends verification, security and other transactional mail and feedback notices. Gemini processes the listing inputs described above; selected Google or Apple services handle sign-in; configured Expo and Apple/Google services handle push. Feedback text and necessary account identifiers may be emailed to the operator's support inbox. Each provider processes data needed for its role; providers do not all receive full account records.

Trading parties receive necessary public content or messages. Authorised administrators can access reports and required evidence. Relevant information may be disclosed to competent authorities or necessary legal advisers where lawfully required. Current app code has no configured advertising-tracking or usage-analytics SDK and no personal-data sale feature; this does not exclude providers' necessary logs or technical processing on sign-in pages.

9. Processing outside the UK

Cloud, email, sign-in, AI and push services may process data outside the UK; storage solely in the UK or EU is not promised. The operator must verify actual recipients, processing countries, provider contracts and safeguards. Restricted transfers require applicable adequacy arrangements, a UK IDTA, an addendum or another lawful mechanism. This policy does not claim those checks are complete; request information on current arrangements through the public contact form.

10. Retention and account deletion

Data needed for the service is retained while an account is used. Verification codes are usable for 10 minutes and normal refresh sessions for up to 30 days; expiry is not physical deletion. Bounded scheduled jobs clean expired authentication records, eligible unreferenced media and terminal push tasks; queues or failures may delay deletion. Public contact requests are kept for 90 days. Closed account-data requests enter cleanup 90 days after closure. Permission history retains at most the latest 100 changes and enters scheduled cleanup after 180 days.

Account deletion in Settings ends sessions, withdraws listings and clears the account nearby area, floor, Flat, avatar references, favourites, follows, saved searches, notifications, feedback and permission records. Authored message text is replaced with a deletion marker, email and nickname with deleted-account markers, and authored review text is cleared. Media becomes inaccessible pending physical cleanup. Some non-login account identifiers, timestamps, listing text and historical nearby areas, linked conversations, offers, report evidence and administration records may remain.

When Apple sign-in is enabled, refresh tokens are encrypted for authorisation revocation. After deletion they remain in a private revocation queue until successful revocation, with bounded retries for at most 30 days. If automatic revocation fails, stop using Linmee in Apple settings. The device Keychain holds an Apple identifier to check revoked access and clears it on sign-out.

A comprehensive schedule for residual listings, chats, offers, reports, security records, emailed copies and provider backups has not been fully determined. There is no automatic 90-day deletion rule for report evidence. This policy is not permission for indefinite retention or a promise that deletion instantly clears every backup. Request further erasure, restriction or retention information; necessary legal retention must be explained with its scope and reason.

11. Security and automated processing

The service is intended for users aged 18 or over, not children. An age restriction is not a guarantee of completed identity or age verification. Report suspected submissions by children through the public contact form for appropriate restriction and data handling. Personal-data breaches will be assessed and notified to competent regulators and affected users where applicable law requires.

Controls include session verification, access restrictions, password and token hashes, upload validation and rate limits. Apple refresh tokens are stored encrypted. No internet service can guarantee absolute security. Protect your device and email and avoid exposing sensitive information. Category and translation suggestions are reviewed by users and do not determine credit, employment or comparable high-impact eligibility.

12. Your rights and contact

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing, withdraw consent-based choices and object to direct marketing. Legal conditions may limit requests, with reasons explained. Edit profile details or delete the account in Settings; Privacy & data offers data requests and the AI control. Guests or restricted users can use the public contact form.

A receipt confirms recording, not completion. Proportionate verification may be required to protect an account; do not submit unnecessary identity documents or private information. Where applicable you may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or another competent regulator.

13. Policy updates

Changes in features, purposes or providers will update this policy's date and version; material changes will be communicated through appropriate notices or renewed acceptance. Chinese and English aim to describe the same handling. The operator's legal details, complete retention schedule and provider and international-transfer arrangements still need completing. This version does not claim completed formal legal review.