MUXTI — Privacy Policy

Plain Language Summary

MUXTI is a classifieds marketplace for Cyprus. We collect the minimum data needed to run the service. We do not sell your data. We do not store your GPS location. Payments are handled by Stripe — we never see your card number. In-app messages between users are stored on our servers; typing indicators are ephemeral and never stored. Draft listings are stored server-side and are only visible to you. You can delete your account and all associated data at any time from the app.

1. Who We Are

Controller: BoogieApps, Cyprus (EU)
App: MUXTI — a peer-to-peer classifieds marketplace for Cyprus
Contact: boogieapps.help@gmail.com
GDPR representative: Same contact — BoogieApps, Cyprus

This policy applies to the MUXTI mobile application and any related services. It describes what personal data we collect, why we collect it, how we protect it, and your rights under the EU General Data Protection Regulation (GDPR — Regulation 2016/679).

↑ Back to top

2. Data We Collect

2.1 Account Data

When you create a MUXTI account we collect:

Email address — used for passwordless OTP authentication and service communications.
Display name — shown publicly on your profile and listings.
Phone number — optional; shown to buyers only if you enable “Allow Call” on a listing.
Profile photo — optional; stored in Supabase Storage (eu-north-1, Stockholm).
Expo push token — stored to deliver in-app notifications. Removed when you sign out.

2.2 Listing Data

When you create or save a listing we collect:

Title, description, price, category, condition, and listing type (For Sale / Trade / Hire / Free).
City name + city-centre coordinates — when you pick a city from the picker, we store the standard centroid latitude and longitude for that city. This is city-level data derived from your explicit selection, not your device’s GPS position.
Up to 10 listing photos, stored in Supabase Storage.
Contact channel preferences (WhatsApp number, Telegram number, allow-call flag).
Listing status, view count, and likes count.
Draft status — if you save a listing as a draft before publishing, the draft content (title, description, images, and all other fields you have filled in) is stored on our servers. Draft Listings are visible only to you under “My Listings” and are not published to the public feed until you choose to publish them.
Bump record — if you use the one-time Bump option to extend a listing’s active period, we record that the bump has been used (a counter and timestamp). This is used solely to enforce the one-bump-per-listing limit.

2.3 Location Data

  Important: what we store vs. what we read

  Stored (on listings): City-centre latitude and longitude derived from the city you chose in the picker. Example: selecting “Limassol” stores lat 34.6851, lng 33.0326 — the city centre, not your home.

  Read but never stored (for proximity search): If you tap “Use my location” in the Search filters, your device’s GPS coordinates are read once, passed as a query parameter to our database RPC, and immediately discarded. They are never written to any database table or log.

2.4 Content Moderation Data

When you publish or edit a listing, the title and description are analysed for prohibited content. Records of moderation decisions (not the full listing text) are retained in a moderation audit log to comply with the EU Digital Services Act (DSA). Draft Listings are not submitted for moderation until you choose to publish them.

2.5 Payment Data

Payments for Boost plans are processed by Stripe. MUXTI never receives, stores, or has access to your card number, CVV, or bank account details. Stripe is the data controller for payment information. See Stripe’s privacy policy at stripe.com/privacy.

2.6 Usage Data

We collect minimal usage data: listing view counts, likes, and session tokens required for authentication. We do not use third-party analytics SDKs (no Firebase Analytics, no Mixpanel, no Meta Pixel).

2.7 Messaging Data

When you use MUXTI’s in-app messaging feature to communicate with other users about listings, we collect and store:

Message content — the text of messages exchanged in a conversation thread, stored on our servers in Supabase (eu-north-1, Stockholm).
Message metadata — sender ID, recipient ID, thread ID, and sent timestamp for each message.
Read receipt timestamps (read_at) — when you open a conversation, a timestamp is recorded on the messages you have read. This enables the sender to see that their message has been read. You may opt out of read receipts at any time in Settings → Privacy & Security. When either party in a conversation has opted out, no read_at timestamps are recorded or displayed for that conversation.
Read receipts preference — your opt-in or opt-out choice for read receipts is stored server-side, linked to your account.

2.8 Real-Time Status Data (Typing Indicators)

  Ephemeral — never stored

  When you are actively composing a message, a real-time typing signal is broadcast to the other participant in the conversation using Supabase Realtime. This signal contains only a sender identifier and a boolean typing flag. It is never written to any database, is automatically discarded when you stop typing, and is not retained or accessible to us or any third party after transmission.

↑ Back to top

3. Legal Basis for Processing (GDPR Article 6)

Legal Basis	Processing Activities Covered
Contract performance (Art. 6(1)(b))	Account creation and authentication; saving, publishing, and displaying listings (including Draft Listings); facilitating in-app messaging between buyers and sellers; delivering push notifications about your listings; processing Boost payments.
Legitimate interests (Art. 6(1)(f))	Content moderation and fraud prevention; maintaining a moderation audit log for DSA compliance; aggregated view/like counts to rank listings; enforcing the one-bump-per-listing limit.
Consent (Art. 6(1)(a))	Accessing device GPS for “Near me” proximity search (requested via the OS permission dialog, read once, never stored). You may withdraw consent at any time in device Settings → Privacy → Location Services.
Legal obligation (Art. 6(1)(c))	Retaining transaction records as required by applicable tax and financial regulations.

↑ Back to top

4. How We Use Your Data

Authenticate your account via one-time email codes.
Save and store Draft Listings on your behalf until you choose to publish or delete them.
Display your published listings to other users and power search and proximity filtering.
Deliver push notifications about activity on your listings.
Facilitate peer-to-peer in-app messaging between buyers and sellers, including delivering messages and, where both parties have opted in, displaying read receipt confirmations.
Process Boost payments through Stripe.
Automatically review listing content for prohibited material (hate speech, weapons, scams, etc.) as required by EU DSA Article 16 — applied at the point of publication, not while a listing is in Draft status.
Enforce the one-time Bump limit per listing.
Prevent fraud and abuse, including listing-velocity anomaly detection.
Respond to your support requests.

We do not use your data for automated decision-making or profiling that produces legal effects (GDPR Article 22).

↑ Back to top

5. Third-Party Processors

We engage the following sub-processors. All are bound by GDPR-compliant Data Processing Agreements.

Processor	Purpose	Location / Standard
Supabase	Database, authentication, file storage (profile photos, listing images, draft listing data), real-time messaging infrastructure	EU North-1 (Stockholm, Sweden) — within EU/EEA
Stripe	Payment processing for Boost plans	EU / USA — Standard Contractual Clauses (SCCs)
OpenAI	Automated listing content moderation (text analysis only; applied at publication, not to drafts)	USA — Standard Contractual Clauses (SCCs)
Expo (Expo Inc.)	Push notification delivery service	USA — Standard Contractual Clauses (SCCs)

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

↑ Back to top

6. Data Retention

Data Type	Retention Period
Account profile (name, email, phone, avatar)	Until you delete your account.
Active listings	Until you delete the listing or it expires (30 days from publication or reactivation, or 30 days after the end of any active Boost period).
Draft listings	Until you publish the draft, delete it manually, or your account is deleted — whichever occurs first. Drafts do not expire automatically.
Bump record (bump_count, bumped_at)	Same as the associated listing. Retained to enforce the one-bump-per-listing limit.
Listing images	Deleted within 30 days after the associated listing is removed.
Push token	Removed immediately on sign-out.
Moderation audit log	Retained for 6 months (DSA Article 17 compliance). Anonymised thereafter.
Payment records	As required by applicable tax law (typically 7 years), held by Stripe.
GPS coordinates from “Near me”	Never stored — used in-memory for the single query, then discarded.
Message content and metadata	Retained until both parties delete the conversation thread, or until either party’s account is deleted, whichever occurs first.
Read receipt timestamps (`read_at`)	Same as message retention. Not recorded when either party has opted out of read receipts.
Read receipts preference (opt-out setting)	Until you change the setting or delete your account.
Typing indicator signals	Not stored — ephemeral broadcast only, discarded immediately after transmission.

↑ Back to top

7. Your Rights Under GDPR

As a resident of the EU/EEA you have the following rights. To exercise any of them, contact us at boogieapps.help@gmail.com. We will respond within 30 days.

Right	What it means
Access (Art. 15)	Request a copy of the personal data we hold about you.
Rectification (Art. 16)	Ask us to correct inaccurate or incomplete data. Most profile data can be edited directly in the app.
Erasure (Art. 17)	Request deletion of your data. In-app: Profile → Privacy & Security → Delete Account removes all data immediately, including any Draft Listings. You can also email us.
Restriction (Art. 18)	Ask us to pause processing your data while a dispute is resolved.
Portability (Art. 20)	Receive your data in a structured, machine-readable format.
Object (Art. 21)	Object to processing based on legitimate interests (e.g. moderation logging). We will assess and respond within 30 days.
Withdraw consent (Art. 7)	Withdraw GPS consent at any time in device Settings → Privacy → Location Services. Withdraw read receipts consent at any time in Settings → Privacy & Security within the app.
Lodge a complaint	You may lodge a complaint with the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or any EU DPA.

↑ Back to top

8. Data Security

All data is transmitted over TLS 1.2 or higher.
Database access is protected by Row Level Security (RLS) policies — users can only read and modify their own data. Draft Listings are accessible only to the Seller who created them. Message threads are accessible only to the two participants in the conversation.
Authentication uses short-lived OTP codes and JWT session tokens; no passwords are stored.
Supabase infrastructure is hosted in Stockholm (eu-north-1), within the EU.
File storage buckets enforce per-user access controls.
No employee has direct access to production data without an auditable reason.

Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at boogieapps.help@gmail.com.

↑ Back to top

9. Children's Privacy

MUXTI is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If we discover that we have inadvertently collected data from a child under 16, we will delete it immediately. If you believe a child has created an account, please contact us.

↑ Back to top

10. Local Storage

The MUXTI app stores the following data locally on your device only (not transmitted to our servers):

Recent search terms — so your search history is available offline.
Filter preferences — so your last-used filters are remembered between sessions.
First-listing tips flag — so we only show onboarding tips once.

This local data does not leave your device and can be cleared by uninstalling the app. Note that Draft Listings are stored server-side (not locally), so they are accessible across all your devices and are not affected by uninstalling the app.

↑ Back to top

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you via a push notification or an in-app banner. The “Effective date” at the top of this document will always reflect the latest version. Continued use of MUXTI after a change constitutes acceptance of the updated policy.

↑ Back to top

12. Contact Us

BoogieApps — Data Controller
Email: boogieapps.help@gmail.com
Subject line: MUXTI Privacy Request
Jurisdiction: Cyprus (European Union)
Supervisory authority: Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy)

↑ Back to top