Privacy Policy

Last updated: 28 September 2026

ReFuy ("we") is a Lost & Found and Sales app for students of the Army Institute of Technology, Pune. This policy explains what we collect, why, and the choices you have. Questions: refuy.app@gmail.com.

What we collect

• Account: your name, your college email (@aitpune.edu.in) and a password (stored only as a secure hash by our login provider). Optionally a phone number, a profile photo and an invite code.
• What you post: titles, descriptions, category, location on campus, price (for sales) and one photo per post. Photos are compressed on your phone before upload. Descriptions and photo details are turned into search data so posts can be found by meaning and by photo.
• Chats: text messages you send to other users, and whether you pinned, muted or blocked a chat.
• Alerts and reports: the descriptions you save as alerts, reports you make about posts, and issue reports you send us (optionally with your app version and phone model).
• Devices: a notification token, phone model, Android version and app version for each phone you sign in on (shown to you under Linked Devices).
• Usage and crashes: anonymous app events and crash reports through Google Firebase Analytics and Crashlytics. They are tied to a random account id, never to your name, email, phone or messages.

Who can see what

• Other signed-in students see your posts, your name and your profile photo.
• Your phone number is shown only on posts published while "Show my phone number" is on. Your email is never shown on posts.
• Chat messages are visible only to the two people in the chat.
• We do not sell your data or show ads.

Services we use

• Supabase stores accounts, posts, photos and chats, and sends sign-in codes by email.
• Google Firebase delivers notifications and collects crash reports and anonymous usage.
• AI providers (Groq, Google Gemini or OpenRouter) receive post photos only to describe the item (colour, brand, type) for search; they don't receive your name or account.
• Cloudflare hosts this website.

How long we keep it

• Open posts expire after 60 days (sales: 45) unless you renew them; you get reminders first. Expired posts are deleted 14 days later.
• Photos of handed-over or sold posts are deleted 30 days after closing, and the posts after 90 days.
• Drafts are deleted after 30 days. Alerts end after 30 days.
• Everything else stays until you delete it or your account.

Your choices

• Edit your name, phone and photo, and turn "Show my phone number" off, in the app.
• Delete posts, alerts and chats at any time.
• Log out other phones under Settings → Linked Devices.
• Delete your account in the app (Profile → Delete Account), or ask us by email: see Delete your account.

Security

Data travels over HTTPS. Access rules in the database let each person read and change only what they are allowed to. Photos are stored privately and shown through short-lived links.

Children

ReFuy is for college students aged 18 and over.

Changes

If this policy changes, we'll update this page and the date above, and tell you in the app for important changes.