Privacy Policy

We collect the following categories of information:

• Account information: your name, email address, and password (stored as a secure hash, never in plain text).
• Profile information you add: university, phone number, department, batch, and bio.
• Student verification: a photo of your student ID, which is stored privately and only visible to admins reviewing your verification request.
• Task and bid content: titles, descriptions, locations, amounts, and messages you post.
• Wallet and transaction records: top-up amounts, escrow holds/releases, cash-out requests, and the bKash Transaction ID (TrxID) you submit for a top-up. We do not collect or store your bKash PIN or full bKash account credentials.
• Reports and reviews you submit or receive.
• Basic technical data such as IP address and browser information, collected automatically for security and abuse prevention.

• To operate the core marketplace: posting tasks, bidding, matching, messaging, and payments.
• To verify that you're a real student and to show a verified badge on your profile.
• To hold and release escrow funds correctly between a task's poster and the assigned Runner.
• To send you account emails: OTP codes for sign-up and password reset, and notifications about your tasks.
• To investigate reports, enforce our Community Guidelines, and keep the platform safe.

We don't sell your data. We share the minimum necessary information with the service providers that run the platform:

• Resend — to deliver account emails (OTP codes, notifications).
• Vercel Blob — to store your student ID photo securely.
• Neon (PostgreSQL) — our database provider.
• bKash — you interact with bKash directly when sending a top-up payment; we only see the transaction reference, not your bKash credentials.

Other students can see your name, department, rating, and verification badge when you post or bid on a task. Your email, phone number, and student ID photo are never shown to other students.

We keep your account and transaction data for as long as your account is active, and for a reasonable period afterward to resolve disputes, meet legal obligations, and prevent fraud. You can request deletion at any time — see Section 6.

Passwords are hashed, not stored in plain text. Student ID photos are stored with private access and only reachable through an admin-authenticated route. Escrow balances are only ever modified through server-side, atomic transactions.

You can review and update most of your profile information from your account. To request that we delete your account and personal data, visit our account deletion page. This works whether or not you're able to log in. We'll confirm your request and process it within a reasonable time, retaining only what we're legally required to keep.

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you by email.

Questions about this policy? Email us at support@boloy.app.