Privacy Policy

This Privacy Policy explains what personal data the Mallow Market mobile application ("Mallow", "the App", "we", "us") collects, why we collect it, who we share it with, and the rights you have over it. This policy applies to all users, and gives EU/EEA users the rights they are entitled to under the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

Mallow Market is operated by SingleGrey GmbH, contactable at info@singlegrey.de. For any privacy question, access/deletion request, or complaint, this is the address to use.

2. What we collect and why

3. Legal basis for processing (GDPR)

For users in the EU/EEA, we process your data under the following legal bases: performance of a contract (creating your account, showing your listings, enabling chat, processing a subscription); legitimate interest (keeping the App secure, preventing abuse of the invite system); and consent (the optional Voice-Fill feature and push notifications, both of which require you to take an affirmative action — recording audio, or granting notification permission — before any data is sent).

4. Third parties we share data with

We do not sell your personal data. We share data only with the service providers needed to operate the App, each acting as our data processor and each responsible for their own handling of the data we send them, as described in their own privacy policy linked below:

• Authentication — a specialized identity provider handles account login and stores your authentication credentials on our behalf. See Auth0's Privacy Policy.
• Hosting and storage — a cloud infrastructure provider hosts our application and stores your listing photos, profile photo, and account data. See Amazon Web Services' Privacy Notice.
• Voice-to-text processing — if you use the optional Voice-Fill feature, your voice recording is sent to a third-party AI provider to transcribe it and extract listing details. This only happens when you actively use the microphone button; it is never used for any other purpose. See OpenAI's Privacy Policy.
• Push notification delivery — a notification delivery service sends notifications to your device using a device push token; it does not receive the content of your messages. See Expo's Privacy Policy.
• Subscription and payment processing — if you subscribe to a paid seller plan, a subscription management provider and the platform's payment processor handle your purchase and report your subscription status back to us so we can apply the correct listing limit to your account. We never receive your card number. See RevenueCat's Privacy Policy and Apple's Privacy Policy.

5. Data retention

We retain your account data for as long as your account is active. Listings you delete are marked as removed and are no longer shown to other users, but retained in our database to preserve the integrity of related conversations and reviews. If you request account deletion (see Section 7), we will delete or anonymize your personal data except where we are required to retain it by law or for the legitimate resolution of disputes.

6. Data security

Data in transit is encrypted (HTTPS/TLS). Our database is encrypted at rest. Access to production systems is restricted to the individuals operating the service. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your rights

Depending on your location, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data (most profile fields can be edited directly in the App);
• Request deletion of your data;
• Object to or restrict certain processing, and (for EU/EEA users) request data portability;
• Withdraw consent at any time for anything based on consent (e.g. push notifications, Voice-Fill), without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at info@singlegrey.de.

7a. Deleting your account

You can delete your account directly in the App: go to Profile, then Settings, then "Delete Account", confirm with your password, and the account is deleted immediately. This is irreversible — there is no recovery period, and we cannot restore a deleted account afterwards.

When you delete your account, we immediately remove or anonymize:

• Your email address, display name, profile photo, bio, and language setting;
• Your active listings (they are taken down and no longer shown to other users);
• Your push notification tokens, in-app notification feed, saved listings, blocked-user list, and any reports you had filed;
• Your login credentials with our authentication provider (Auth0).

We retain, in a form that no longer identifies you by name:

• Reviews you wrote about other sellers, and reviews others wrote about you — removing them would unfairly change another user's public rating or erase a record of a transaction that involved someone else;
• Messages and conversations — deleting your side of a shared conversation would delete the other participant's copy of it too, which we do not do without their consent;
• Listings you had already marked as sold, since a review may reference them;
• Records of subscription/billing events, with your account no longer linked to them, for as long as we are required to keep financial records;
• A record that your account was deleted and when, for internal support purposes, for a limited period afterward.

Because our database is backed up automatically, a copy of your data as it existed immediately before deletion may persist in encrypted backups for a short period afterward (approximately 7 days) before it is fully rotated out, even though it is already removed from the live app the moment you delete your account.

You can also create a new account with the same email address afterward — this is treated as a brand-new account with no connection to the deleted one.

8. Children's privacy

Mallow is not directed at children and is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16.

9. International data transfers

Some of our service providers (including OpenAI and AWS) may process data outside of the European Economic Area. Where this occurs, we rely on the provider's standard contractual clauses or other lawful transfer mechanisms recognized under GDPR.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the App.