# PRIVACY POLICY ## "E'lonchi" Mobile Application **Effective Date:** December 13, 2025 **Last Updated:** December 13, 2025 **Version:** 1.0 --- ## 1. INTRODUCTION "E'lonchi" (hereinafter referred to as "Platform", "App", "We", "Us", or "Our") takes your privacy seriously and is committed to protecting your personal information. This Privacy Policy explains: - What personal information we collect - How this information is used - Your rights and choices - How we protect your data By using our App, you consent to the practices described in this Privacy Policy. --- ## 2. WHO WE ARE **Controller Information:** - **App Name:** E'lonchi - **Domain:** elonchiuz.uz - **Email:** elonchiuz25@gmail.com - **Address:** Tashkent, Republic of Uzbekistan - **Country:** Republic of Uzbekistan --- ## 3. WHAT INFORMATION DO WE COLLECT? ### 3.1. Information You Provide to Us #### 3.1.1. Registration Information When you register for our App, we collect: - **Phone Number** - for authentication and account verification (Uzbekistan format: +998 xx xxx xx xx) - **Full Name** - for profile information and identification - **SMS Verification Code** - temporary, only for phone number verification (deleted after confirmation) #### 3.1.2. Google Sign-In Registration If you register via your Google account, we receive: - Google User ID - Full Name (from your Google profile) - Email Address (from your Google profile) - Profile Picture (optional, from your Google profile) **Note:** We do NOT have access to your Google password or other sensitive credentials. #### 3.1.3. Profile Information When you complete or update your profile: - **Profile Picture** - image you upload (optional) - **Full Name** - updated profile information - **Phone Number** - updated contact information #### 3.1.4. Listing/Ad Information When you post a listing, we store: - **Listing Text:** title and description - **Price Information:** price, currency (UZS, y.e.), price type (fixed, negotiable, exchange, free) - **Category:** selected product/service category - **Location:** region and district (manually entered) - **Images:** listing photos (maximum 10) - **Additional Attributes:** category-specific attributes (e.g., color, size, condition) - **Contact Information:** name and phone number #### 3.1.5. Chat Messages Through our chat service: - Sent and received message text - Sent images and files - Message timestamp - Message read status (read/unread) #### 3.1.6. Complaints When you report listings: - Complaint reason and category - Additional details (optional) - Complaint submission date ### 3.2. Automatically Collected Information #### 3.2.1. Device Information When you use the App, we automatically collect: - **Device Type:** Android or iOS - **Operating System Version:** e.g., Android 13, iOS 17 - **App Version:** installed E'lonchi version - **Device Model:** phone model name - **Language Settings:** selected language (Uzbek/Russian) #### 3.2.2. Usage Information Regarding your use of the Platform: - **Viewed Listings:** which listings you viewed and when - **Saved Listings:** favorite listings list - **Search History:** search queries and selected filters - **Taps and Actions:** button taps, page scrolling (for analytics) - **Session Information:** app usage time and duration #### 3.2.3. Location Information **IMPORTANT:** We do NOT collect GPS coordinates or your precise location. We only store information you manually select: - Region and district selection (for posting listings and searching) - Favorite location (to improve user experience) #### 3.2.4. Push Notifications For sending notifications: - **FCM Token** (Firebase Cloud Messaging token) - to send notifications to your device - Notification settings (enabled/disabled) #### 3.2.5. Local Storage Information stored locally on your device: - **Hive Database:** draft listings, cached data - **FlutterSecureStorage:** authentication tokens (JWT) - **SharedPreferences:** language choice, settings **Note:** This data is only stored on your device and not sent to the server (except tokens). ### 3.3. Information from Third-Party Services #### 3.3.1. Google Sign-In When you sign in via Google: - Google User ID - Email, name, profile picture (from Google) #### 3.3.2. Firebase Services We use Google Firebase services: - **Firebase Authentication:** user authentication - **Firebase Cloud Messaging (FCM):** push notifications - **Firebase Crashlytics** (future): error tracking --- ## 4. HOW DO WE USE YOUR INFORMATION? ### 4.1. Primary Purposes We use collected information for the following purposes: #### 4.1.1. Providing Services - Creating and managing accounts - Authentication and security - Posting and displaying listings - Providing chat service - Search and filtering results - Sending push notifications #### 4.1.2. Improving User Experience - Displaying personalized content - Saving language preferences - Location preferences (region/district) - Showing viewed and saved listings - Recommended listings (future) #### 4.1.3. Security and Anti-Fraud - Detecting fraudulent and spam accounts - Monitoring rule violations - Reviewing complaints - Protecting platform integrity - SMS code resend rate limiting #### 4.1.4. Service Improvement - Analyzing app performance - Fixing bugs and issues - Studying user behavior (aggregated) - Developing new features #### 4.1.5. Legal Obligations - Providing information as required by law - Court orders and law enforcement requests - Protecting our rights ### 4.2. Marketing and Advertising **We currently do NOT use data for marketing purposes.** If marketing services are added in the future, separate consent will be requested. --- ## 5. WHO DO WE SHARE YOUR INFORMATION WITH? We do NOT sell your personal information or distribute it to third parties. However, information may be shared in the following cases: ### 5.1. With Other Users The following information is visible to other Platform users: **In Your Listings:** - Full Name (as listing owner) - Phone Number (shown in listings) - Profile Picture (if uploaded) - Listing Details (title, description, images, price, location) **In Chat:** - Full Name - Profile Picture - Your sent messages (only to conversation participant) ### 5.2. Service Provider Partners We use the following third-party services: #### 5.2.1. Google Firebase - **Purpose:** Backend infrastructure, authentication, notifications - **Shared Data:** User ID, FCM token, authentication data - **Location:** Google Cloud servers (EEA/USA) - **Privacy Policy:** https://privacy.elonchiuz.uz #### 5.2.2. API Hosting (Backend Server) - **Purpose:** Database and API services - **Shared Data:** All user data - **Location:** Uzbekistan or international servers - **Security:** HTTPS encryption, secure authentication #### 5.2.3. SMS Service (for OTP) - **Purpose:** Sending SMS verification codes - **Shared Data:** Phone number (temporary) - **Retention:** Deleted after SMS is sent **Guarantee:** All service providers are bound by privacy agreements and must only use data for specified purposes. ### 5.3. Legal Requirements We may disclose information in the following cases: - As required by law (court order, prosecutor's request) - At the request of law enforcement agencies - Under anti-terrorism laws - To protect the Platform's rights - To ensure user safety ### 5.4. Business Transfers If "E'lonchi" is sold, merged, or reorganized: - User data may be transferred to the new owner - You will be notified in advance - You have the right to delete your account --- ## 6. HOW LONG DO WE KEEP YOUR INFORMATION? We retain your data for as long as necessary: ### 6.1. Active Accounts **While Account is Active:** - **Profile Information:** as long as account exists - **Listing Information:** while listing is active or until deleted - **Chat Messages:** until conversation is deleted or account is deleted - **Activity Information:** 12 months from last activity - **Draft Listings:** 90 days from creation (automatically deleted) ### 6.2. When Account is Deleted If you delete your account: - **Immediately Deleted:** authentication tokens, session data - **Deleted Within 30 Days:** - Profile information - Personal listings - Chat messages (your side) - Viewed and saved listings list - **Archived (90 Days):** - Activity logs (for security purposes) - **Permanently Retained:** - Information required by legal obligations (e.g., for court orders) - Aggregated statistical data (no personal identification) ### 6.3. Inactive Accounts If you don't use your account for 12 months: - You will be notified - If no response within 30 days, account will be automatically deleted - All data will be deleted according to the above process --- ## 7. HOW DO WE PROTECT YOUR INFORMATION? We apply modern security measures to protect your data: ### 7.1. Technical Security Measures #### 7.1.1. Encryption - **HTTPS/TLS Encryption:** all data transmitted is encrypted - **FlutterSecureStorage:** for sensitive data on device (e.g., JWT tokens) - **Database Encryption:** sensitive information is encrypted in the database #### 7.1.2. Authentication and Authorization - **JWT (JSON Web Token):** secure session management - **SMS Verification:** phone number authentication - **Google Sign-In:** trusted OAuth 2.0 protocol - **Token Expiration:** session tokens automatically expire #### 7.1.3. Backend Security - **API Rate Limiting:** protection against spam and DDoS attacks - **Input Validation:** protection against SQL injection, XSS attacks - **CORS Settings:** access only from official app - **Firewall and DDoS Protection:** server security #### 7.1.4. Database Security - Access only for necessary staff (Role-Based Access Control) - Database log monitoring - Regular backups and disaster recovery plan ### 7.2. Organizational Measures - Staff undergo privacy training - Data access rights granted on minimum necessity basis - Security policies and procedures regularly reviewed - Third-party auditors engaged (future) ### 7.3. What You Can Do **To protect yourself:** - **Keep password confidential** (if password authentication is added in the future) - **Log out of your account** (if using a shared device) - **Report suspicious activity** (e.g., someone sending messages in your name) - **Share personal information carefully** (in chat, listings) - **Be cautious when switching to Telegram or other platforms** (scammers use this method) ### 7.4. Data Breaches If a data breach or loss occurs: 1. We immediately take security measures 2. We notify law enforcement agencies where necessary 3. We notify affected users within 72 hours 4. We provide assistance and guidance --- ## 8. YOUR RIGHTS Under Uzbekistan legislation and international standards, you have the following rights: ### 8.1. Right of Access - View your personal information - Know what information has been collected - Obtain a copy of your data (upon request) **How to Exercise:** Go to your Profile and view "My Personal Information" section or write to elonchiuz25@gmail.com. ### 8.2. Right to Rectification - Correct inaccurate information - Complete incomplete information **How to Exercise:** Go to Profile Settings and edit your information. ### 8.3. Right to Erasure ("Right to be Forgotten") - Completely delete your account - Delete your personal information **How to Exercise:** 1. Go to Profile 2. Go to "Settings" section 3. Tap "Delete Account" button 4. Confirm deletion **Note:** Deleted data cannot be recovered. Listings and chats will also be deleted. ### 8.4. Right to Restrict Processing - Request to stop processing certain data - Except for services requiring authentication **How to Exercise:** Send a request to elonchiuz25@gmail.com. ### 8.5. Right to Data Portability - Receive your data in machine-readable format (JSON, CSV) - Transfer to another service **How to Exercise:** Send a request to elonchiuz25@gmail.com. We will provide within 30 days. ### 8.6. Right to Object - Object to use for marketing purposes - Object to automated decision-making **How to Exercise:** Write to elonchiuz25@gmail.com. ### 8.7. Right to Complain If you believe your privacy has been violated: 1. **First Step:** Contact us - elonchiuz25@gmail.com 2. **Second Step:** Contact Uzbekistan data protection authorities 3. **Third Step:** File a complaint through court **Response Time:** We will respond to your request within 30 days. --- ## 9. CHILDREN AND MINORS ### 9.1. Age Restriction "E'lonchi" is not intended for children under 18. - You must be at least 18 years old to use the Platform - We do not knowingly collect information from those under 18 - If you are under 18, please do not use the app ### 9.2. Parental Control If you are under 18 and using with parental permission: - Your parent or legal guardian is responsible for managing your information - Your parent has the right to delete the account ### 9.3. If We Find Children's Data If we identify data from users under 18: 1. We immediately suspend the account 2. We delete all personal information 3. We notify parents (if contact information is available) **If you are a parent of a child under 18 and find their account, please contact us immediately:** elonchiuz25@gmail.com --- ## 10. INTERNATIONAL DATA TRANSFERS ### 10.1. Where is Your Data Stored? Your data may be stored in the following locations: - **Main Server:** Uzbekistan or nearby regions - **Firebase Servers:** Google Cloud (EEA, USA) - **Backup Servers:** International data centers ### 10.2. International Transfers If your data is transferred outside Uzbekistan: - Only to trusted and secure service providers - Through Standard Contractual Clauses - With legal guarantees ### 10.3. Your Rights Regardless of international transfers, all your rights are preserved. --- ## 11. COOKIES AND TRACKING TECHNOLOGIES ### 11.1. We Don't Use Web Cookies Since E'lonchi is a mobile app, we don't use web cookies. ### 11.2. Local Storage However, we do store the following information on your device: #### 11.2.1. Hive Database - **Purpose:** Draft listings, cache, offline mode - **Stored Data:** Draft listings, categories, location data - **Location:** Your device - **Control:** Deleted when you uninstall app or clear cache #### 11.2.2. FlutterSecureStorage - **Purpose:** Secure data (tokens) - **Stored Data:** JWT access and refresh tokens - **Security:** Device-level encryption - **Control:** Deleted when you log out #### 11.2.3. SharedPreferences - **Purpose:** Settings and preferences - **Stored Data:** Language choice, notification settings - **Location:** Your device - **Control:** Can be cleared from app settings ### 11.3. Analytics (Future) In the future, we may use analytics services: - **Purpose:** Improving user experience - **Services:** Firebase Analytics or similar - **Opt-out:** Can be disabled in settings **If added, you will be notified.** --- ## 12. THIRD-PARTY SERVICES ### 12.1. Google Firebase **Firebase Services Used:** #### 12.1.1. Firebase Authentication - **Purpose:** User authentication - **Data:** User ID, phone number, Google account data - **Privacy Policy:** https://firebase.google.com/support/privacy #### 12.1.2. Firebase Cloud Messaging (FCM) - **Purpose:** Push notifications - **Data:** FCM token, device information - **Privacy Policy:** https://firebase.google.com/support/privacy **Control:** You can disable notifications in device settings. ### 12.2. Google Sign-In - **Purpose:** Registration via Google account - **Data:** Google User ID, email, name, profile picture - **Privacy Policy:** https://policies.google.com/privacy **Control:** You can disconnect E'lonchi in your Google account settings. ### 12.3. SMS Service - **Purpose:** OTP verification codes - **Data:** Phone number (temporary) - **Retention:** Deleted after SMS is sent ### 12.4. We Are Not Responsible These third-party services have their own privacy policies. We are not responsible for their data practices. Please read their privacy policies. --- ## 13. CALIFORNIA AND GDPR RIGHTS (International Users) If you reside in California (CCPA) or Europe (GDPR), you have additional rights: ### 13.1. GDPR (European Union) - **Data Minimization:** We only collect necessary data - **Consent-Based:** We request explicit consent - **Right to be Forgotten:** Full deletion right - **Portability:** Take your data with you - **Complaint:** To EEA data protection authorities ### 13.2. CCPA (California) - **Right to Know:** What data has been collected - **Right to Delete:** Delete your data - **Right to Opt-Out of Sale:** We do NOT sell your data - **Non-Discrimination:** No discrimination for exercising rights **International User Contact:** elonchiuz25@gmail.com --- ## 14. NOTIFICATIONS AND MARKETING ### 14.1. Push Notifications We may send you the following push notifications: #### 14.1.1. Transactional Notifications (necessary) - New chat messages - Responses to your listing - Account security alerts - Service updates **These notifications cannot be disabled** (core part of service). #### 14.1.2. Marketing Notifications (optional) - New feature announcements - Offers and promotions (future) - Blog posts and news **Control:** - You can disable marketing notifications in Profile Settings - You can disable all notifications in device settings ### 14.2. Email and SMS Marketing **We currently do NOT send email or SMS marketing.** If we do in the future: - We will request prior consent - Opt-out link will be included - You can unsubscribe anytime --- ## 15. CHANGES TO THIS PRIVACY POLICY ### 15.1. Updates We may update this Privacy Policy from time to time. Reasons: - When new features are added - When laws change - When improving security practices - Based on user feedback ### 15.2. How We Notify You **Minor Changes:** - "Last Updated" date changes on Privacy Policy page - In-app notification displayed **Major Changes:** - Push notification sent - Email sent (if email address available) - Dialog box shown when you open the app ### 15.3. Your Choice If you do not agree with the new Privacy Policy: - You can delete your account - You can disable certain services in app settings - You can contact us with questions **Continuing to use the app after the new version is announced indicates acceptance of the new terms.** --- ## 16. CONTACT US For privacy-related questions, concerns, or requests: ### 16.1. Email **General:** elonchiuz25@gmail.com **Privacy Issues:** privacy@elonchiuz.uz ### 16.2. Postal Address E'lonchi Data Protection Department Tashkent, Uzbekistan ### 16.3. Phone +998 94 640 09 93 (Business hours: 9:00-18:00, Monday-Friday) ### 16.4. In-App Profile → Settings → Help & Support → Privacy Issues ### 16.5. Response Time We will try to respond to your request within 30 days. Complex requests may take up to 60 days (we will notify you). --- ## 17. DATA PROTECTION OFFICER For privacy or data protection inquiries: **Data Protection Officer:** - Email: elonchiuz25@gmail.com - Title: Data Protection Officer - Responsibility: Overseeing privacy policy and legal compliance --- ## 18. SECURITY BEST PRACTICES (Tips) To protect yourself, follow these tips: ### 18.1. Account Security - ✅ Log out regularly (on shared devices) - ✅ Keep your phone number confidential - ✅ Report suspicious activity immediately ### 18.2. Listing Security - ✅ Post accurate information - ✅ Don't post excessive personal information (passport, address) - ✅ Remove geolocation metadata from images ### 18.3. Chat Security - ✅ Only communicate with trusted buyers - ✅ Be cautious when switching to Telegram or other platforms - ✅ Never share account credentials (password, SMS code) ### 18.4. Anti-Fraud - ⚠️ Be wary of "too good to be true" offers - ⚠️ Be cautious of advance payments - ⚠️ Be wary of "support" via Telegram, WhatsApp - ⚠️ Don't trust messages claiming to be from "Admin" (we never ask for passwords via chat) ### 18.5. If You've Been Scammed 1. **Report Immediately:** elonchiuz25@gmail.com 2. **Save Chat:** Take screenshots 3. **Contact Police:** Fraud is a crime 4. **Report Listing:** Tap "Report" button in app --- ## 19. SPECIAL SITUATIONS ### 19.1. If Account is Compromised If your account has been hacked: 1. **Contact us immediately:** elonchiuz25@gmail.com 2. **Verify your phone number:** We'll send SMS for verification 3. **Account Recovery:** We'll help you recover your account 4. **Security Check:** Determine how compromise occurred ### 19.2. Fraud or Abuse If you identify fraud or abuse: 1. **Report:** Tap report button on listing or user 2. **Notify:** Write to elonchiuz25@gmail.com with details 3. **Police:** Contact law enforcement in serious cases We take all complaints seriously and take appropriate action (account blocking, providing data to police). ### 19.3. Data Loss or Breach If data is lost or breached due to technical failure or cyberattack: 1. **We notify you within 72 hours** 2. **We explain which data was affected** 3. **We inform you of actions taken** 4. **We provide recommendations:** change password, monitor account --- ## 20. GLOSSARY **Personal Information** - Any information that can identify you (name, phone, email, etc.) **Processing** - Collecting, storing, using, modifying, deleting data **Third Party** - Any company or person other than E'lonchi **Cookie** - Small file stored in browser by websites (not used in mobile apps) **JWT (JSON Web Token)** - Secure token for authentication **FCM (Firebase Cloud Messaging)** - Push notification service **Encryption** - Encoding data, can only be read with special key **HTTPS** - Secure internet protocol (data encrypted) **Opt-out** - Unsubscribe from service **GDPR** - European data protection regulation **CCPA** - California data protection law --- ## 21. FINAL PROVISIONS ### 21.1. Validity of Privacy Policy This Privacy Policy is accepted by using the "E'lonchi" app and remains in effect for as long as your account exists. ### 21.2. Relationship with Terms of Service This Privacy Policy should be read together with the Terms of Service. In case of conflict, this Privacy Policy prevails on privacy matters. ### 21.3. Severability If any part of this Privacy Policy is found to be invalid or unenforceable, it does not affect the validity of the remaining provisions. ### 21.4. Languages This Privacy Policy is available in Uzbek, Russian, and English. In case of conflict, the Uzbek version prevails. ### 21.5. Legal Basis This Privacy Policy is established in accordance with: - Constitution of the Republic of Uzbekistan - Civil Code of the Republic of Uzbekistan - Laws of Uzbekistan on "Personal Data" - GDPR (for international users) - CCPA (for California users) --- ## 22. ACKNOWLEDGMENT By downloading, installing, and using the E'lonchi app, you: ✅ Confirm that you have read this Privacy Policy in full ✅ Understand its terms ✅ Consent to the collection and use of your data as described If you have questions or believe your privacy has been violated, please contact us: 📧 **Email:** elonchiuz25@gmail.com 📞 **Phone:** +998 94 640 09 93 🏢 **Address:** Tashkent, Uzbekistan --- **Your privacy matters to us. Thank you for your trust!** --- **Last Updated:** December 13, 2025 **Version:** 1.0 **Effective Date:** December 13, 2025 --- © 2025 E'lonchi. All rights reserved.