Privacy Policy

Who is responsible

The controller for personal data processed through the Service is Ogua ("we", "us", "our"). Privacy and data requests: privacy@ogua.cc. Legal and listing notices: legal@ogua.cc.

What we collect

We keep the Service focused. We collect only what we need to run the marketplace, stop abuse, and understand traffic.

• Account data. When you sign in with Google or email, we store your email, display name, and (for Google) profile photo from that provider. You may also add a profile name, photo, about text, and contact phone so buyers can reach you.
• Visitor identifier. A random ID stored in your browser (local storage) so we can count online visitors and lifetime unique visitors. It is not your name.
• Listing data. The title, category, price, condition, location, description, photos, and other details you submit for a listing.
• Marketplace messages. The text and photos buyers and sellers share in conversations about listings.
• No payment data. Ogua does not collect payment. We do not receive, store, or process card numbers, bank details, or any transaction you arrange with another person on the Service.
• Listing activity. When you open or save a listing, we may record the listing and a time to show counts and reduce abuse. You may also report a listing as unavailable.
• Technical data. Standard request data such as user agent, referrer, and IP address may be processed by our host and analytics tools to operate and secure the Service.
• Messages you send us. If you email a notice, a correction, or a privacy request, we keep that correspondence as needed to respond and to keep a legal record.

Sign-in with Google

Ogua lets you sign in with Google so you can create an account, publish listings, and manage your profile. This section describes how we handle Google user data, as required for apps that use Google OAuth.

Google user data we access. When you choose "Continue with Google", we request the openid, email, and profile scopes. From Google we receive your Google account ID, email address, display name, and profile photo URL. We do not request access to your Google contacts, calendar, Drive files, Gmail, or other Google services.

How we use Google user data. We use this information only to create and maintain your Ogua account, keep you signed in, show your name and avatar in the product, attribute listings and messages to the correct account, and provide customer support. We do not use Google user data for advertising, retargeting, scoring, selling to data brokers, or building unrelated marketing profiles.

Sharing Google user data. We do not sell Google user data. We share it only with service providers that help us run the Service (for example hosting and database providers) and only so they can process data on our behalf. We may also disclose data if required by law or to protect the Service. We do not transfer Google user data to third parties for their own advertising or unrelated purposes.

Storage and security. Account data is stored in our Cloudflare D1 database on secured infrastructure. Listing and chat photos are stored in Cloudflare R2. Session tokens are issued over HTTPS. Access to production systems is restricted. We use industry-standard measures to protect personal data against unauthorized access, loss, or misuse.

Retention and deletion. We keep Google account data while your Ogua account is active. If you delete your account or ask us to delete your data, we remove personal account data within 30 days, except where we must keep limited records for legal, fraud, or dispute reasons. Email privacy@ogua.cc to request deletion or export.

AI and machine learning. We do not use Google user data to train generalized machine-learning or artificial-intelligence models. Google Workspace APIs are not used to develop, improve, or train non-personalized AI or ML models.

Changes. If we change how Ogua accesses, uses, or shares Google user data, we will update this policy and the effective date above.

Email sign-in

If you sign in with email, we send a one-time code to that address. We store a hashed form of the code and related attempt limits long enough to complete sign-in and stop abuse, then discard them. We use an email delivery provider to send those messages.

Cookies and local storage

Session cookies keep you signed in on the API domain. We may store a locale preference in your browser so the site opens in your language. The visitor ID for online counts lives in local storage. We do not use advertising cookies. PostHog may run for product analytics according to your browser settings and our configuration.

Why we use this data

• Contract. To create or update a listing, deliver messages, and provide the Service you asked for.
• Legitimate interests. To keep the board fair, display public listing details, measure visits, debug outages, prevent abuse, and defend legal claims. You may object to processing based on legitimate interests as described below.
• Legal obligation. To keep complaint and similar records where the law requires it.

Public listings

Titles, photos, descriptions, prices, locations, and seller profile details shown on a listing are public. Anyone can see them, including search engines. Do not post information you do not want shown publicly.

Marketplace messages stay between the people in that conversation unless a person copies or shares them elsewhere, or we must review them for safety, abuse, or legal reasons.

Who we share data with

• Hosting and storage providers (including Cloudflare for the web app, API, D1 database, and R2 photo storage) so the site can run.
• Email delivery (Resend) to send sign-in codes and related account messages.
• PostHog for product analytics, if enabled.
• Sentry for error monitoring, if enabled.
• Google for sign-in only, when you choose that provider.
• Professional advisers, authorities, or a buyer of the Service if we must share data to comply with law, enforce the Terms, or transfer the project.

We do not sell your personal data. Some processors may be outside your country or the European Economic Area. Where we rely on them, we use appropriate safeguards such as standard contractual clauses or an equivalent mechanism they provide.

How long we keep it

• Account data lasts while you have an account, then is deleted within 30 days.
• Public listing entries stay while the listing is on the board and may remain in backups or activity history for a limited time after removal.
• Marketplace messages and their photos are automatically deleted after 90 days.
• Visitor IDs and click or save records are kept only as long as useful for counts, rate limiting, and abuse prevention.

Your rights

If the GDPR or similar law applies to you, you may ask us to access, correct, delete, or export personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing was based on consent. You may also lodge a complaint with a supervisory authority in your country of residence.

Email privacy@ogua.cc. We may need enough information to find your data. Public listing content is not made private just by appearing on the board; you can ask us to remove the listing.

Children

The Service is for adults. We do not knowingly collect personal data from children. If you believe a child has used the Service, contact us and we will delete the data we can identify.

Changes

We may update this policy when the Service or the law changes. The date at the top of this page is the current version. If a change is material, we will post the updated policy here.