Privacy Policy
This Privacy Policy explains how Askitab, a local marketplace to buy and sell second-hand books near you, collects, uses, stores and protects your information when you use our mobile application and services.
Last Updated: January 1, 2026
By using Askitab, you agree to the practices described in this Privacy Policy.
📋 Table of Contents
Our Commitment
Askitab is a local marketplace to buy and sell second-hand books in India, operated by its founding team, and is committed to protecting your privacy and being transparent about our data practices.
We do not: Sell, rent, or trade your personal data. We do not run advertisements at this time.
We do: Use your data to operate the app, connect you with nearby readers, provide encrypted communication, and improve our services based on usage analytics.
Important: We may integrate advertising services (like AdMob) in the future. If we do, this policy will be updated with details about ad personalization and opt-out options.
Information We Collect
📱 Account Information
Data: Username, email address, profile photo (optional)
Purpose: Account creation, authentication, and profile display
Storage: Firebase Firestore (Mumbai region, India)
Retention: Retained until account deletion, then permanently removed immediately
Note: We do not collect phone numbers, physical addresses, or other personal identifiers.
📚 Book Listings & Content
Data: Book title, author, price, single image per listing
Posts: User posts, comments, likes, Aura tokens earned through activity
Anonymous Posts: When you post anonymously, we generate a random username (without @ prefix) and avatar. Anonymous usernames are not clickable and do not link to profiles. However, we maintain internal logs linking anonymous posts to accounts for moderation and legal compliance purposes.
Username Identification: Real user accounts have @ prefix in usernames and clickable profiles. Anonymous posts do not have @ prefix and are not clickable.
Purpose: Display listings, enable community interaction, calculate rewards
Retention: Book listings remain until you remove them. Posts remain until manually deleted or account deletion
Visibility: Posts and book listings are public by default and visible to nearby users
Note: Aura tokens are earned through app activity, are not transferable, and have no monetary value.
💬 Encrypted Communications
Data: Direct messages, group chats (encrypted using CryptoJS client-side encryption)
Purpose: Enable secure real-time communication
Storage: Encrypted messages stored in Firebase Realtime Database (USA-south region)
Auto-deletion: Messages automatically deleted 24 hours after being delivered, or 7 days if unread
Pinned Messages: Remain until you unpin them
Important: We use client-side encryption for messages. No unencrypted chat content is stored on our servers.
📍 Location Information
Data: Location coordinates (fetched once when you initiate it)
Purpose: Help you discover nearby people and book listings
Collection: Location is NOT tracked continuously. We fetch it only when you request it
Storage: Firebase Realtime Database (USA-south region)
Your Control:
- • Show exact location (default)
- • Show approximate location (blurred to ~200m radius)
- • Turn off location visibility completely
Location data is deleted when you delete your account.
📸 Media Files
Data: Single image per book listing, profile photos, post images
Processing: Images are optimized and compressed via ImageKit (third-party service) for performance
Storage: Firebase Cloud Storage and ImageKit CDN
Retention: Images deleted when you remove associated content or delete your account
Note: We do not support videos or multiple images per listing.
🔧 Technical & Usage Data
Data: Device type, OS version, app version, IP address, crash logs, performance metrics, notification tokens (FCM)
Purpose: Bug identification, performance optimization, send push notifications, analyze app usage
Collection: Via Firebase Analytics, Firebase Crashlytics, and Firebase Cloud Messaging
Retention: Anonymized crash logs may persist for up to 90 days due to Firebase platform limitations
Note: Some anonymized diagnostic data may continue to exist even after account deletion due to third-party platform constraints.
🍪 Cookies, Local Storage & Search Data
Data: Authentication tokens, app preferences, cached data in localStorage and IndexedDB
Purpose: Maintain login sessions, enable offline functionality, improve app performance
Search: Public content (book titles, usernames, public posts) is indexed via Meilisearch for fast search
Types: Essential cookies only. No tracking or advertising cookies at this time
Third-Party Service Providers
We work with trusted service providers to deliver and improve our services. These partners process data on our behalf under strict contractual agreements.
🔥 Firebase (Google Cloud)
Services: Database hosting, user authentication, real-time messaging, analytics, crash reporting, push notifications
Data Shared: Account info, messages (encrypted), location, usage data, device info, notification tokens
Regions: Firestore (Mumbai, India), Realtime Database (USA-south), Cloud Storage (Firebase default region)
Privacy: Firebase Privacy Policy
🖼️ ImageKit
Services: Image optimization, compression, and content delivery (CDN)
Data Shared: Uploaded images only (book photos, profile pictures, post images)
Purpose: Faster image loading and reduced bandwidth usage
Retention: Images deleted when removed from Askitab, subject to CDN cache clearing (typically 24-48 hours)
Privacy: ImageKit Privacy Policy
🔍 Meilisearch
Services: Fast search functionality across books, users, and posts
Data Indexed: Public content only (book titles, authors, usernames, public posts)
Hosting: Self-hosted on Render (free tier with ephemeral filesystem)
Maintenance: Automatic index rebuilding every 10 minutes via GitHub Actions to handle server sleep
Note: Private messages and personal data are never indexed
🗺️ OpenStreetMap & Leaflet.js
Services: Map display and location visualization
Data Shared: Location coordinates when you use map features
Purpose: Display interactive maps showing nearby users and book listings
Privacy: OpenStreetMap is open-source. OSM Privacy Policy
📢 Future: AdMob (Google Ads)
Status: Not currently implemented
If Added: We will update this policy to explain data used for ads, personalization settings, and opt-out options
Commitment: You will be notified 30 days before any advertising integration
Your Protection: All service providers are bound by data processing agreements. We do not share your chat content, precise location, or personal data with any third party except as described above. We will never sell your data.
Data Security & Retention
🔐 Encryption & Security
Messages: Client-side encryption using CryptoJS before transmission
Data in Transit: TLS/HTTPS encryption for all communications
Database: Firebase security rules restrict unauthorized access
Authentication: Secure Firebase Authentication with email/password
Note: No system can guarantee absolute security, but we implement industry-standard measures to protect your information.
🗑️ Data Retention Policy
Messages: Automatically deleted 24 hours after delivery, or 7 days if unread
Pinned Messages: Remain until you unpin them
Book Listings: Remain until you remove them
Posts & Comments: Remain until you delete them or delete your account
Location Data: Remains until you delete your account
Crash Logs: Anonymized logs may persist for up to 90 days in Firebase systems
Account Deletion: All personal data permanently deleted immediately upon account deletion. No backup period or recovery window.
🚨 Security Breach Notification
Commitment: We will notify affected users within 72 hours of discovering any security breach
Method: Email notification and in-app alert
Information: Details about the breach, affected data, and steps you should take
Your Rights and Controls
✅ Right to Access
Description: Request a copy of all personal data we hold about you
How to Exercise: Email [email protected] with subject "Data Access Request"
Timeline: We will respond within 30 days
Format: Data provided in JSON or PDF format
✏️ Right to Rectification
Description: Correct or update inaccurate personal information
How to Exercise: Edit directly in app settings (Profile → Edit Profile)
Processing: Changes applied immediately
🗑️ Right to Erasure (Delete Account)
Description: Delete your entire account and all associated data
How to Exercise: Settings → Account → Delete Account, or email [email protected]
Timeline: Immediate permanent deletion. No recovery possible.
What's Deleted: Profile, posts, messages, listings, location, tokens, activity logs
Exception: Anonymized crash logs in Firebase may persist up to 90 days
🔒 Privacy Controls in App
Location Visibility: Choose exact, approximate (~200m), or hidden
Profile Visibility: Control who can see your profile and activity
Notifications: Customize all notification types in Settings
Block/Report: Block users or report inappropriate content anytime
📧 Communication Preferences
Push Notifications: Manage in app Settings → Notifications
Email Updates: Opt out by contacting [email protected]
Marketing: We do not send marketing emails at this time
🚚 Right to Data Portability
Description: Export your data in machine-readable format
How to Request: Email [email protected] with subject "Data Export Request"
Content: All posts, listings, profile data (messages excluded due to encryption)
Format: JSON or CSV
🚫 Right to Object
Description: Object to certain data processing activities
How to Exercise: Email [email protected] with your specific objection
Note: Some processing is necessary for app functionality and cannot be objected to
Children's Privacy (COPPA Compliance)
Age Requirement: Askitab is intended for users aged 13 years and above.
13-17 Year Olds: Users between 13-18 may use the app without parental consent under applicable laws.
Under 13: We do not knowingly collect information from children under 13. If we discover we have collected data from a child under 13, we will delete it immediately.
Age Verification: We do not verify age. Users must self-certify they are 13 or older during registration.
Parents: If you believe your child under 13 has created an account, contact us at [email protected] and we will delete it immediately.
International Users & GDPR
Primary Region: Askitab is primarily intended for users in India.
Global Access: The app may be accessed from anywhere, but we do not specifically target or advertise to users outside India.
Data Storage: Your data is stored in India (Firebase Firestore - Mumbai) and USA (Firebase Realtime Database - USA-south).
For EU Users: While we do not specifically target EU users, we commit to honoring GDPR-aligned rights including:
- • Right to access your personal data
- • Right to rectification (correction)
- • Right to erasure ("right to be forgotten")
- • Right to data portability
- • Right to object to processing
- • Right to lodge a complaint with your local data protection authority
Legal Basis for Processing: We process your data based on:
- • Consent: For optional features like location sharing
- • Contractual Necessity: To provide the app services you signed up for
- • Legitimate Interest: For app improvement, security, and analytics
Legal Compliance & Governing Law
Governing Law: This Privacy Policy is governed by the laws of India.
GDPR Awareness: We honor GDPR-aligned rights for all users, regardless of location.
CCPA (California): We do not sell personal information. California residents have the right to request disclosure of data collected and deletion.
COPPA (USA): We comply with Children's Online Privacy Protection Act by not knowingly collecting data from children under 13.
Legal Requests: We may disclose information if required by law, court order, or to protect user safety and prevent illegal activity.
Do Not Sell: We do not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration.
How We Use Your Information
We use your information to:
- • Provide and maintain the Askitab app and services
- • Create and manage your account
- • Connect you with nearby users and book listings based on location
- • Enable encrypted chat communication
- • Send push notifications about messages, activity, and app updates
- • Calculate and award Aura tokens for your activity
- • Improve app performance and fix bugs
- • Analyze usage patterns to plan new features
- • Maintain security and prevent misuse or fraud
- • Respond to your support requests
- • Comply with legal obligations
We do NOT: Sell your data, use it for advertising (at this time), or share your private messages or precise location with third parties.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification Method: If we make significant changes, we will notify you via:
- • In-app notification
- • Email to your registered email address
- • Updated "Last Updated" date at the top of this policy
Advance Notice: For major changes, we will provide at least 30 days notice before the changes take effect.
Your Acceptance: Continued use of the app after changes means you accept the updated policy. If you don't agree, please delete your account before the changes take effect.
Minor Updates: Small clarifications and formatting changes may happen without notification.
Contact Us
If you have questions about this privacy policy, wish to exercise your data rights, or have concerns about how we handle your information, please contact us.
Email: [email protected]
We respond to all privacy inquiries within 30 days.