Information used
Depending on the features you choose, GGMarket processes account and profile details, email-verification state, listings and images, favorites and saved searches, recently viewed listings, conversations and messages, offers, trades, notifications, ratings, reports, and verification records.
Authentication sessions include encoded access and refresh credentials and related user/session metadata. GGMarket does not intentionally place those credentials in localStorage or IndexedDB.
Why it is used
The current implementation uses this information to authenticate accounts, operate marketplace and messaging features, preserve requested preferences, deliver notifications and Realtime updates, prevent abuse, enforce authorization, and support account and listing safety.
The precise GDPR lawful basis for each purpose is a controller decision and is not established by source code. The owner must document and approve that mapping before publication.
Authentication and storage
GGMarket uses essential first-party Supabase SSR cookies for sign-in persistence, refresh-token rotation, logout, email confirmation, and password recovery. Private authenticated responses are marked not to be stored in shared caches. The service worker caches only the offline page and site icon.
Read the Cookie policy for the exact keys, browser-storage mechanisms, attributes, and technical maximum durations.
Service providers and recipients
Supabase is the verified external platform used for authentication, PostgreSQL data access, file storage, and Realtime delivery. Hosting, email-delivery, payment, moderation, support, and other provider arrangements are not proven by this repository and must not be inferred from this draft.
The owner must confirm processor agreements, hosting regions, subprocessors, transfer safeguards, and which entity sends authentication emails.
Retention and security
The auth cookie has a technical maximum age of 400 days, but server expiry, rotation, logout, or revocation can end the session sooner. That browser limit is not a business retention schedule for account or marketplace records.
GGMarket uses server-side session validation, Supabase row-level security, origin checks for state-changing requests, private response caching rules, and production HTTPS cookie restrictions. No online service can promise absolute security.
Your rights
Subject to applicable law, people may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent where consent is used, and complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority.
Formal request instructions and a verified privacy contact must be added by the owner. Account controls may provide immediate access to some profile changes in the meantime.
Owner review required
Before launch, approve the legal identity, address, privacy contact, lawful-basis table, record-by-record retention schedule, child/minor policy, data-export and deletion process, breach contact, Supabase and email-provider terms, transfer disclosures, and regulator wording.