Privacy Policy

1. Data We Collect

We only collect the personal data necessary to provide our service.

• Account data: name, email, phone (optional), district, school (optional), bio.
• Listing data: photos, descriptions, categories of items you post.
• Interaction data: messages, offers, reviews, reports.
• Technical data: session cookie, browser type, login IP (for security).

2. Purpose and Legal Basis

The purposes and legal basis for data collection:

• Provide account and platform functionality (contractual necessity).
• Match buyers and sellers, display and recommend items (core service).
• Send notifications: offers, messages, reviews (you can disable in settings).
• Maintain platform security, prevent fraud and abuse (legitimate interest).

3. Third-Party Data Processors

We engage the following third parties to process data. SKLOOPS does not sell your personal data.

• Google OAuth: handles third-party login, governed by Google's privacy policy.
• Google Analytics / Tag Manager: web traffic and usage analysis; when enabled, sets analytics cookies (_ga family) in your browser to distinguish visitors and measure usage. Data is handled by Google under its privacy policy.
• Cloudflare: content delivery network (CDN) and cookieless web analytics; collects aggregated page-view data only, without identifying individuals.
• Cloudflare R2: production image storage, data stored in HK/Asia regions.
• ZSend: sends transactional email notifications (e.g., password resets, offer and message alerts), transmitting only the content necessary for the service.
• Zeabur: platform hosting service provider, hosting the application and databases.
• Solid Cable / Solid Queue: internal database for real-time messaging and background jobs.

4. Cookies and Sessions

SKLOOPS uses a single session cookie to keep you logged in. If web analytics is enabled, Google Analytics additionally sets analytics cookies (_ga family) to distinguish visitors and measure usage; we do not use advertising tracking cookies. Theme preference (light/dark) is stored in your browser's localStorage.

5. Data Retention

Your data is retained until your account is deleted. Within 90 days of account deletion, we will permanently remove your personal data. Records required for legal or security purposes (e.g., fraud complaints) may be retained longer.

6. Your Rights (PDPO)

Under the Personal Data (Privacy) Ordinance, you have the following rights:

• Access: request access to your personal data.
• Correction: request correction of inaccurate data.
• Withdraw consent: withdraw consent for data use (may affect account features).
• Object to direct marketing: opt out of direct marketing use.
• How to exercise: edit via your account page, or email [email protected] to make a data access request.

7. Children's Privacy

SKLOOPS is designed for parents. Please do not submit personal data of minors. If you discover we have inadvertently collected a minor's data, please notify us immediately for deletion.

8. Policy Updates and Contact

This policy may be updated. Material changes will be announced on the Platform. Contact: [email protected].