Privacy Policy

The company behind the Preloved app and preloved.co.id is PT Preloved & Thrift Indonesia, so whenever this page says "Preloved", "we" or "us", that's who we mean. Below you'll find what we know about you and why, plus the say you have in it. In the language of Indonesia's Law No. 27 of 2022 on Personal Data Protection (the "PDP Law"), we're the controller of your data.

There's an Indonesian version of this page too. If the two ever say different things, the Indonesian one is the one that counts.

What we collect

Things you tell us

To make an account you hand over a name, a username, your email and a password. That last one gets hashed before it's saved; nobody here can read it. Anything else on your profile, like a photo, bio, location or website, is up to you.

A courier can't do much without an address. That's why we ask who the parcel is for, how to reach them by phone, where exactly they are (postcode included) and where the pin goes on the map. When you sell, your listing carries the photos and details you add, from the price to the brand to how worn the item is. Getting paid means telling us where to send the money: the bank or e-wallet, the account number and the name on it.

Chats live on our servers. So do the messages you send our team, the reviews and reports you write, and whatever photos or videos you attach to a complaint.

Things we record as you use Preloved

Browsing leaves a trail. We see which items you open and like, what you search for, what lands in your cart, the offers you make, and what you end up buying or selling. Your phone or browser also tells us its IP address, what kind of device or browser it is and which app version you're on. There's a notification token too, otherwise push messages couldn't reach you. Server logs pile up in the background, and crash reports arrive whenever the app falls over.

On the website, cookies and local storage do a few jobs. Mainly they keep you signed in and remember how you like things set up. One of them measures our ads; more on that under Cookies and advertising.

Things we get from others

Signing in through Google, Facebook or Apple means that service shares your name, email and an account ID with us. When you pay, our payment partner lets us know if it worked, and shows us only a masked fragment of the method you used, typically the last few digits. Your full card details never reach us. Couriers send us tracking updates for each parcel. And other users may write reviews or reports about you.

What we use it for

Mostly, to run Preloved: your account, your profile and listings, offers, orders and chat. Payment details let us take payments, hold the money until an order is done, send refunds and pay out balances to verified accounts. Addresses and phone numbers go to the courier so parcels can be picked up, delivered and tracked.

Some of it goes into keeping Preloved safe. That covers verifying certain purchases, scanning listings automatically (photos included, for any text in them), filtering links, phone numbers and certain words out of chat, stripping phone numbers from listings and bios, and following up on reports.

Your browsing history is what makes your feed feel like yours; it also nudges search results and suggestions. Push notifications and emails about your orders and chats depend on your data, and so does customer support, whether that's a quick question or a full-blown complaint. Once in a while we'll mention a promo, or show off a feature we just shipped.

Then there's the less glamorous stuff. Are the ads worth what we pay? Which screens confuse people? What crashed last night? Finally, the law makes us keep and process some data, for tax, for accounting, or when the authorities make an official request.

Our legal grounds

The PDP Law sets out the grounds on which personal data may be processed, and we rely on a few of them.

The main one is our agreement with you, the Preloved Terms & Conditions. Without processing your data, your account, orders, payments and deliveries simply couldn't work. Keeping transaction records for tax and accounting is a legal obligation. Where we're protecting users from scams, recommending items or making the app better, we rely on our legitimate interests. Push notifications and marketing are different: those need your consent, and you're free to take it back.

Who we share it with

We don't sell your personal data. We share it only where there's a real need.

Some of it other users can see anyway. Profiles, listings and reviews are public. When a sale happens, buyer and seller see each other's name, phone number and the address needed for delivery, and nothing beyond that.

Xendit and Midtrans take care of payments and payouts. Shipping runs through Biteship, which passes the job to the courier chosen at checkout (JNE, J&T, SiCepat, AnterAja, GoSend, Grab Express, Ninja Xpress and so on). Both of them get the names, phone numbers and addresses on either end of the parcel.

Behind the scenes, other companies keep Preloved running. Address search and the maps come from Google Maps Platform. Your photos and our servers live with Cloudflare and Amazon Web Services. Emails go out through SendGrid, push notifications through Firebase Cloud Messaging and Expo. PostHog shows us how the app gets used. Sentry pings us when it breaks. Operational alerts land in our team's internal chat. None of them may use your data for their own ends.

We advertise on Facebook and Instagram, which belong to Meta. The Meta Pixel and Conversions API we use for that are covered in the next section. Signing in with Google, Facebook or Apple obviously brings that company into the picture too.

If the law says we must give data to the authorities, we will, and we may also do so to protect the rights, safety or property of Preloved or its users. Should Preloved one day merge, be acquired or hand over part of the business, your data goes along, still covered by this policy.

Cookies and advertising

Cookies and your browser's local storage are what keep you logged in on the website and remember your preferences.

We've also put the Meta Pixel on our website, to measure and improve our ads. It can send Meta details such as which pages you open, your IP address and browser data. When you sign up, we send your email to Meta through the Conversions API, but hashed (scrambled so it can't be read directly), together with your IP address.

Head to your Meta ad preferences if you'd like to change what ads Meta shows you. Your browser settings let you block or wipe cookies; just know that bits of the website might break if you do.

Data sent abroad

Not all of our providers keep their servers in Indonesia, so some data may be stored or processed abroad. The PDP Law requires the destination country to offer equal or stronger protection, or other adequate and binding safeguards to be in place, and we make sure one of those holds.

How long we keep it

As long as you have an account, we keep what it takes to run it.

Delete the account and the profile, listings and likes disappear along with the rest of your account data. For a short while, copies might still show up in search results or previews until our systems catch up.

Some records we can't erase straight away. Tax and company records rules mean we have to keep order, payment, refund and payout records for 10 years. Chats and evidence tied to a complaint, a report or suspected fraud stay until the case is closed, and for as long as they may be needed for a legal claim. Logs and crash reports hang around only while they're useful for security or debugging.

Security

Traffic between your device and Preloved is encrypted with HTTPS, and we never store passwords in readable form. Within the team, access to data is on a need-to-know basis, and logging in as an admin takes a second verification step. Even so, no system is completely bulletproof. If a personal data protection failure ever happens, we'll notify you and the authorities as the PDP Law requires.

Your rights

The PDP Law gives you a number of rights over your data. You can ask how it's being processed and request a copy. If something's wrong, you can have it corrected, and most of it you can change yourself in Settings. You can delete your data and account (here's how), withdraw consent for notifications and marketing, and ask us to restrict or pause certain processing.

If a decision with a significant effect on you is made purely by an automated system, you have the right to object. You can also ask for your data in a commonly used format so you can take it elsewhere.

To do any of this, email [email protected] from the address registered to your account. We may need to confirm it's really you, and then we'll reply within the time limit set by the PDP Law. Data the law requires us to keep, as described above, stays with us.

Changes to this policy

We may update this policy from time to time. The date of the latest update is at the top of the page. For important changes, we'll let you know through the app, by email or on this page before they take effect.

Contact us

Questions or requests about your personal data? Email us at [email protected].