Privacy Policy
This policy explains what personal data BikeZap collects when you use the BikeZap app, why we collect it, who we share it with, how long we keep it, and the choices you have. It is written in plain language on purpose.
- We collect what is needed to run a marketplace: your account details, your listings and photos, your messages, and your location when you ask for nearby search — so people near you can find your listings.
- We do not and never will sell your personal data. We do not rent it, trade it, or share it for anyone else's marketing.
- Other users can see what you put on a listing, because that is how a marketplace works. Anything you would not want a stranger to see, do not type in.
- You can ask us to delete your account and your data at any time, and we will do it — see Account & Data Deletion.
- We do not collect your contacts, SMS, call logs, microphone, background location, or your card and bank details. We never ask for your OTP, PIN or password.
- If something goes wrong — fraud, spam, illegal content — we may share relevant data with law enforcement. We will not do this casually.
1. Who we are and what this policy covers
BikeZap is an Android mobile app operated by Abhay Soni, an individual developer based in Lucknow, Uttar Pradesh, India ("BikeZap", "we", "us", "our"). This is our data controller and this is our privacy policy for the app.
It covers the BikeZap Android app and this website. It also covers the fact that other users can see information you choose to publish when you create a listing — because you are not the only person who can look at it.
We comply with the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000 and its rules, and the Consumer Protection Act, 2019. Our named grievance officer and contact details are in section 12.
2. Information we collect
2.1 Information you give us
| What | Why we need it | Who can see it |
|---|---|---|
| Account details — the name you enter, your email address, and the profile photo you upload | To create your account, sign you in, let you reset a forgotten password, and let other people know who they are dealing with | Your email is private. Your name and photo appear on your listings and profile |
| Contact details — your phone number, WhatsApp number, city and address | So buyers, renters, landlords, employers and service providers can actually reach you. Without a working contact number a marketplace does not function. | Your phone and WhatsApp numbers are shown to other users on your listings and profile |
| Profile content — a short bio, and a verified-seller badge if you have completed verification | To give other users context about who they are dealing with | Public |
| Your bike rental and sale listings — title, description, price, brand, model, year, fuel type, kilometres, condition, city, and multiple photographs | To publish your listing and show it to interested buyers | Public. Anyone using the app can see it |
| Your marketplace listings — title, description, price, category, sub-category, condition, city, and multiple photographs, across all categories including vehicles, property, electronics, furniture, fashion, services and jobs | To publish your listing and show it to interested buyers | Public. Anyone using or browsing the app can see it |
| The location of a listing — the city you choose, and the map coordinates recorded for that listing | To show listings on the map, sort by distance, and let buyers filter by area | Your city is public. A listing's map pin is visible to users browsing that area, and appears as an approximate area rather than an exact address |
| Sales enquiries and offers you receive — a buyer's name, phone number, the price they are offering, and the message they send you | So you can decide whether to respond, and so we keep a record of what was offered if there is a dispute | The seller or listing owner being enquired about. Not shown to other users |
| Your chat messages, and any images you send in chat | So you and the other person can communicate, and so we have a record if a complaint or dispute arises | The person you are chatting with, and our team if we investigate a complaint |
| Bookings, handovers and rental requests, including the dates of a rental, the hand-over confirmation code, and any condition photographs or notes you add | To run the booking you requested, and to keep a record of what was agreed and of the state of the item at hand-over | The other party to the booking, and our team |
| Ratings and reviews you write or receive | To help other people decide who to deal with. Reviews can only be left after a real chat, which is how we reduce fake reviews | Public, attached to your profile |
| Reports you file, and any evidence you attach to them | To investigate and act on abuse, fraud or illegal content | Our moderation team, and the reported person where it is fair to tell them |
| Verification records — if you request a free verified-seller badge, the identity details you choose to share and the outcome of our review | To verify that you are a real person, prevent impersonation, and keep an internal record of the decision | Our operator and admin team only |
| Support messages and the information you include in them | To help you, and to keep a record of the request and its outcome | Our support team |
2.2 Information collected automatically
- Push notification token — a device-specific token used to send you notifications about your own listings, bookings, messages and account. It is associated with your account.
- Approximate location derived from your IP address, and the city that goes with it, used to suggest listings near you when you have not shared a precise location. This is derived on your device from a third-party service and the city result is sent to us.
- Device and app information — device model, manufacturer, Android version, app version, screen size and language, and the IP address a request came from. Used for compatibility, security, fraud detection and debugging.
- Last-seen status, so other users know whether a seller is currently active. You can see, and be seen by, the other party in a conversation.
- Advertising identifier — the Android Advertising ID, made available to Google AdMob by the operating system, used by the advertising SDK.
- Local diagnostic information — the app records the most recent error on your own device so that the support team can see it when you report a problem. This stays on your device unless you send it to us.
To be explicit about what we do not have: BikeZap does not use Google Analytics, does not use Firebase Crashlytics, and does not run any third-party behavioural profiling or advertising profile. We operate no tracking pixel, no fingerprinting, and no cross-app or cross-site advertising identifier.
2.3 Device permissions we request
| Permission | When we ask | What we do with it | If you decline |
|---|---|---|---|
| Camera | Only when you tap to take a photo for a listing, your profile photo, or a hand-over record | Reads the photo you just took and uploads it | You can still post by choosing an existing photo, or post without photos |
| Photos and media | Only when you pick an existing photo to attach | Uploads only the photos you select. We do not scan, index, read or retain the rest of your library | You can still post without photos |
| Location — precise and approximate | When you use "nearby", search by distance, or open the map. It is read only while the app is open and only while the feature you started is active. It is never read in the background. | Sorts listings by distance, shows your position on a map, and helps you set a listing's area. Your live GPS position is not shown to other users — only the location attached to a listing is | The app works normally; you just cannot use distance search or the map |
| Notifications | When you open the app, if you allow them | Sends you messages, booking updates, and alerts about your own listings | You will not receive alerts |
| Storage / media (older Android versions) | When you pick a file to upload, save an image, or share content from the app | Reads the single file you chose, and caches images you have already viewed so listings load faster | You can still browse the app |
| Internet, vibration, and boot completed | Automatically, as part of installing the app | Required to load the marketplace, vibrate on a new message, and re-schedule notifications after a restart | The app cannot function |
We do not request, and the app does not declare, permission for your contacts, call logs, SMS or MMS, microphone, phone state, calendar, health data, or biometrics. BikeZap has no background-location permission.
2.4 The emergency / SOS feature
For your safety the app includes an emergency feature that uses the emergency contacts you enter yourself, which are stored only on your device. When you trigger it, the app opens your phone's own messaging app with a pre-filled message and your current coordinates, and, if you choose, dials a helpline. BikeZap does not read your contacts, does not send the message for you, and does not receive the message you send. Nothing about the SOS reaches our servers unless you choose to contact us separately.
2.5 What we deliberately do not collect
- Your password. Authentication is handled by Google Firebase Authentication, which secures credentials on Google's infrastructure. We do not see, receive or store your password.
- Your full card numbers, CVV, net-banking credentials, or UPI PIN. We never ask for these and never will. Anyone who asks for them in a BikeZap chat is attempting fraud — report them.
- A copy of your Aadhaar, PAN or bank statement, unless you voluntarily send it as part of a specific transaction or a verification we have asked you about.
- The contents of your contacts, SMS, or call history.
- Your microphone recording.
- Your location in the background, or after you close the app.
- Your health, biometric, religious or political opinions, unless you choose to write them into a listing yourself.
- Your browsing activity outside BikeZap.
3. How we use your information, and why we are allowed to
Under Indian law we rely on one of four bases: your consent, the performance of a contract with you, a legal obligation, or our legitimate uses in operating a safe marketplace. The table below covers every purpose we have.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account, sign you in, and send a password-reset email | Name, email address, password (held only by Firebase Authentication), profile photo | Performance of a contract |
| Publish and display your listings, and let other users search, filter and contact you | Listing content, photographs, price, category, city, contact details | Performance of a contract. What you publish is your choice |
| Location-based search, distance sorting, and the map | Device location while you use the feature, listing coordinates, IP-derived city | Consent, given through the app's location prompt and withdrawable in Android Settings |
| Messaging, sales enquiries, bookings, handovers and rental coordination | Chat content, enquiry details, booking and hand-over records | Performance of a contract |
| Push notifications about your own activity | Device token, your account and listing identifiers | Consent, which you can switch off at any time |
| Fraud prevention, abuse detection, and keeping the marketplace trustworthy | Account and contact details, device and IP data, listing and chat content, account flags | Legitimate interests, and legal obligation where we must cooperate with authorities |
| Reviewing reported listings, chats and accounts, and enforcing our Community Guidelines | The reported content, the account's history, and supporting evidence | Legitimate interests; legal obligation |
| Reviewing a free verified-seller request, granting or removing the verified badge, and keeping an internal record of that decision | Name, email, account, identity documents you choose to share, and the decision | Performance of a contract; legitimate interests in keeping the marketplace safe |
| Serving and measuring advertising, if and when advertising is switched on | Advertising ID, device and app information, in-app activity | Consent. In the EEA, the UK and Switzerland we use only non-personalised ads unless you consent to personalised ads |
| Understanding which features are used so we can prioritise fixes | Feature usage within the app, error state stored on your device | Legitimate interests |
| Complying with a lawful order from a court, police or regulator | Whatever is lawfully required, limited to that | Legal obligation |
| Selling your data | Never. This never happens. | Not applicable |
Where we rely on consent — location, notifications, camera, photos, and optional advertising personalisation — you may withdraw it at any time through your device's Settings, or by emailing us, and we will stop the corresponding processing.
4. Advertising
BikeZap is designed to be supported by free advertising, delivered through the Google AdMob SDK.
Current status: at the date of this policy, ad serving is switched off in the release build and the advertising SDK is configured with Google's official test ad units, so no live advertising is delivered and no revenue is generated from your activity. If advertising is switched on in a future release, we will update this section and, where the law requires it, ask for your consent first.
For completeness, if advertising is enabled, the AdMob SDK is designed to process:
- your Android Advertising ID, which you can reset or delete from your device's privacy settings;
- your device model, manufacturer, Android version and app version;
- your activity within the app, such as which listings you view and which screens you open;
- your IP address and coarse location, which may be derived by the ad network.
AdMob's own handling of data is described in the Google advertising policies, and you can review and change your settings at myadsettings.google.com. Advertisements are selected by third parties and are not endorsements by BikeZap; we are not responsible for the content of a third-party advertisement.
We never sell advertising space based on your personal data, and we do not allow advertisers to receive your name, email address, phone number or listing content.
5. How we share your information
We do not sell your personal data. We do not rent it. We do not trade it. There is no "data broker" business here.
We share it only in these situations:
- With other BikeZap users, as the marketplace requires. Anyone browsing the app can see your public listings, together with the name, photo, city, contact details and ratings you have on your profile. Your live GPS position is never shared. This is the product working as intended — but it is your choice to publish, so do not put anything on a listing that you would not want a stranger to read.
- With the person you are transacting with — the other party to a sale, rental, booking, service or job, who sees the details relevant to that transaction. If you make an offer on someone's listing, that seller sees your name, phone number, offered price and message.
- With service providers who host, store, secure or support the service for us, under contract and only as far as needed: Google Firebase, Google AdMob, Supabase, Cloudinary, ipapi.co, and map and tile services. These providers are not permitted to use your data for their own purposes. Section 7 lists each one.
- With professional advisers — our accountant, lawyer or auditor — under a duty of confidentiality.
- With law enforcement, courts, or regulators, where we are legally required to, or where there is a credible risk of serious harm, fraud, trafficking, child safety or other illegal activity. We share only what is necessary and lawful, and we will tell you unless we are prohibited from doing so.
- With a buyer, acquirer or successor if BikeZap is reorganised, merged, or sold. We will require them to honour this policy and will tell you before your data is transferred.
- At your direction — for example, if you ask us to share something with a support agent or another party.
We do not disclose your data to data brokers or advertisers for their own marketing, and we do not permit a third party to contact you directly for their own purposes.
6. Where your data is stored and how it is protected
- Account records, listings, messages, bookings, ratings, reports and notifications are stored in Google Firebase — Firestore for structured records, Cloud Messaging for notifications — protected by Google's security controls, and reachable only through access rules that limit reads to you and to authorised operator accounts. An ordinary user cannot read another user's records by guessing an identifier.
- Photographs you upload — for your profile, your listings, and any identity document you choose to share for free seller verification — are stored in a Supabase storage bucket and served over encrypted HTTPS. They are reachable by anyone who already has the link, which is what makes them display in the app. We do not reuse your images for advertising or for any other purpose, and we do not run facial recognition or image analysis on them.
- Banners and notice images published by the operator are hosted on Cloudinary. No user personal data is placed there.
- All data in transit is protected with HTTPS/TLS encryption, and the app enforces HTTPS.
- Access to personal data is limited to what each authorised operator account needs, and administrative actions — approving verifications, banning users, removing listings, issuing broadcast notices — are written to an internal audit log.
- We keep backups so we can recover from incidents. See section 8 for how long they live.
Our service providers may process data outside India, including in the United States and the European Economic Area. Where your data leaves India, we rely on appropriate safeguards such as standard contractual clauses, as required by the Digital Personal Data Protection Act, 2023.
No method of transmission or storage is completely secure. If a breach affects your personal data and is likely to cause you harm, we will notify you and the relevant authority as required by law.
7. Third-party services and SDKs
The app uses the following services. Each has its own privacy policy, which we encourage you to read.
| Service | Purpose | Data involved | Policy |
|---|---|---|---|
| Google Firebase — Authentication, Firestore, Cloud Messaging, Cloud Storage | Sign-up and sign-in, database, push notifications, file storage | Name, email address, credentials (held by Firebase Authentication), listing records, chat content, device token, IP address | Google Privacy Policy |
| Google AdMob (present but currently not serving ads) | Advertising | Advertising ID, device and app information, in-app activity, IP address | Google Ads policies |
| Supabase — object storage | Storing photographs you upload for listings, your profile, and payment evidence | The images you upload, file name, upload time | Supabase Privacy Policy |
| Cloudinary — operator content only | Hosting banners and notice images published by the operator | No user personal data | Cloudinary Privacy Policy |
| OpenStreetMap tile servers | Drawing the maps used for listing location and nearby search | Tile requests your app makes, including your IP address and the area being viewed | OpenStreetMap Privacy Policy |
| ipapi.co | Estimating your city from your IP address, so we can suggest nearby listings before you share a precise location | Your IP address; the city result is used in the app | ipapi.co Privacy Policy |
8. How long we keep your information
| Data | Retention period |
|---|---|
| Account details, profile, listings, photographs, sales enquiries, messages, bookings, reviews, ratings and reports | For as long as your account is active, then deleted within 30 days of your deletion request |
| Chat message content shown to you by another user | Automatically expires from the recipient's view after 14 days, as a privacy safeguard. The sender's copy remains until the conversation is deleted |
| Records that we are legally required to keep, such as fraud-prevention flags on banned accounts and audit logs of moderator actions | Retained for as long as the applicable law requires, even after your account is deleted. BikeZap charges no fees, so there are no financial receipts to retain |
| Data of accounts suspended or banned for fraud or serious abuse | Retained for as long as needed to stop the person returning under a new account, and to support any investigation or legal proceeding |
| Data attached to a complaint or a report of illegal content | Retained until the complaint is resolved and any resulting action is complete, and for any period a law requires |
| Internal audit records of operator actions | Up to 24 months |
| Backups | Rolling, retained for up to 90 days, then overwritten |
| Aggregated or de-identified usage statistics | May be kept indefinitely, because they cannot be traced back to you |
9. Your rights and controls
Under the Digital Personal Data Protection Act, 2023 and related law, you have the right to:
- See what personal data we hold about you, and get a copy of it.
- Correct inaccurate or incomplete data — you can edit your name, photo, city, phone number and address yourself in the app's profile and edit-profile screens.
- Update data that has changed.
- Erase your account and data, and have future processing stop — see Account & Data Deletion.
- Withdraw consent at any time, for location, notifications, camera, photos or advertising, by changing your device's settings or by emailing us.
- Nominate someone to exercise your rights on your behalf in the event of death or incapacity, by emailing us.
- Raise a grievance and receive a response within the time limits set by law — see section 12.
- Seek redress from the Data Protection Board of India if you are not satisfied with our response.
To exercise any of these rights, email microuserme@gmail.com from the email address registered to your account. We will verify your identity before acting, we will respond within 30 days, and we will not charge you for it. If we cannot fulfil a request, we will explain why.
10. Deleting your account
You can ask us to delete your BikeZap account and your personal data at any time, without giving a reason, and we will not ask you to change your mind or pay a fee. The full process — including exactly what is deleted, what we are legally required to keep, and how long each step takes — is set out on the Account & Data Deletion page.
To be transparent about one point: BikeZap does not yet have a "delete my account" button inside the app. The route is the web request on that page, and we treat it as a genuine deletion request, not a support ticket we can close without action.
11. How we protect you from other users
A marketplace is only as safe as its weakest participant, so we take these steps:
- Listings are reviewed, and listings that break the rules are removed — by our moderation team, and automatically when they are reported.
- You can report a listing, a message, or a user from inside the app, attach evidence, and block a user from messaging you.
- We act on substantiated reports by removing content, removing features such as the verified badge, and permanently banning repeat offenders.
- We keep an internal audit record of every moderation and administrative action we take.
- We preserve evidence and cooperate with law enforcement on cases involving fraud, stolen goods, weapons, drugs, counterfeits, trafficking, or child safety.
- We publish safety guidance about the marketplace scams that most often target buyers and sellers.
The full standards are in our Community Guidelines.
12. Grievance officer and contact
Under Indian law we have a named grievance officer responsible for receiving and resolving privacy complaints.
Email: microuserme@gmail.com · Subject line: "Privacy Grievance"
Phone / WhatsApp: +91 78978 97500
Address: Lucknow, Uttar Pradesh, India
Response time: acknowledged within 48 hours, resolved within 30 days
Support hours: Monday–Saturday, 10:00–19:00 IST
If we do not resolve your complaint within 30 days, or if you are otherwise dissatisfied, you may approach the Data Protection Board of India. You can also use the National Consumer Helpline on 1915, or the National Consumer Disputes Redressal Commission at ncdrc.nic.in.
Security researchers: if you believe you have found a vulnerability, please report it rather than exploiting or disclosing it publicly. We will acknowledge your report, keep you updated while we fix it, and we will not take legal action against good-faith research that avoids privacy violations, avoids degrading the service, and gives us reasonable time to remediate. Please do not access other users' data, and please do not include other people's personal data in a proof-of-concept.
13. Children's privacy
BikeZap is not directed at anyone under 18, and we do not knowingly collect personal data from children. Several categories — property, employment, vehicles and rental agreements — are legally restricted to adults, which is why you must be at least 18 to hold an account.
If you believe a child under 18 has created an account or posted personal information, email microuserme@gmail.com immediately. We will investigate and delete the account and its content. If you are a parent or guardian, you can ask us to confirm what was collected and to delete it.
14. Changes to this policy
We update this policy from time to time, for example when we add a feature, add a new service provider, enable advertising, or need to reflect a change in law. The "Effective date" at the top of this page shows when the current version took effect. If a change materially affects your rights, we will tell you in the app or by email before it takes effect. Continuing to use BikeZap after the change means you accept the updated policy. Previous versions are available on request.