DUTRES is operated by a single individual (the "Operator"). Unlike many platforms, there is no team, staff, or third-party company with routine access to user data.

The Operator is the only person with access to user data, and that access is used solely for building, maintaining, securing, and troubleshooting the Platform. There is no internal team, contractor, or department that user data is shared or reviewed with as a matter of course.

2.1 Account Information

To use DUTRES, you must create an account. Account creation is mandatory — the Platform cannot be browsed or used without signing in. We support two sign-up/sign-in methods:

• Email and password — we collect the email address and a securely hashed password (we never store your password in plain text).
• Google Sign-In — if you choose this option, we receive basic profile information from Google (such as your name, email address, and profile photo, depending on what Google shares) to create and authenticate your account. We do not receive your Google password.

Additional profile information you may choose to add: display name, avatar/profile photo, school/campus, and a short bio.

2.2 Listings and Content

When you create a listing, we collect the title, description, price, category, and any images you upload. Uploaded images are automatically compressed/downsized from their original file size before being stored, purely to reduce storage space and improve load times — this is a technical processing step, not an edit to the content or meaning of your image.

2.3 Messages

DUTRES includes an in-app chat system, and it is the only channel through which buyer-seller communication on the Platform is intended to happen. Messages you send through this system are stored on our servers so that conversations persist and remain accessible to both participants.

2.4 Usage and Device Information

We may automatically collect limited technical information needed to operate and secure the Platform, such as IP address, browser/device type, and basic usage logs (e.g., login timestamps, error logs). This is used for security, debugging, and keeping the service running — not for profiling or advertising.

We use the information collected strictly to operate the Platform, specifically to:

• Create and authenticate your account (via email/password or Google Sign-In).
• Display your listings to other Users.
• Deliver and store in-app chat messages between buyers and sellers.
• Compress uploaded listing images to save storage space.
• Maintain platform security, investigate reported abuse, and troubleshoot technical issues.
• Communicate with you about your account (e.g., password resets, safety notices).

We do not use your data for advertising, profiling, or any purpose beyond running the Platform.

Aside from the routine, automatic image compression applied to listing photos (which reduces file size without altering the substance of the listing), DUTRES does not modify user-submitted data. Your listing text, messages, and profile information are stored as you enter them.

We do not sell, rent, trade, or otherwise share your personal data with any third party for marketing, advertising, or commercial purposes — ever.

Your data may only be disclosed in the following limited circumstances:

• When required by law — if we receive a valid legal request (such as a court order or subpoena) that we are legally obligated to comply with.
• To protect safety — in rare cases where we believe disclosure is necessary to prevent harm, fraud, or a violation of our Terms & Conditions that poses a risk to Users.
• Essential infrastructure providers — data may pass through third-party infrastructure that keeps the Platform running (e.g., cloud hosting or storage providers, and Google, for Google Sign-In authentication). These providers process data only as needed to deliver their service to us and do not use it for their own purposes.

Other than the above, no one but the Operator has access to user data, and it is never shown to, or shared with, any outside party.

We take reasonable technical and organizational measures to protect your data, including password hashing, secure storage practices, and restricted access (limited to the Operator, as described in Section 1). However, no system is completely immune to risk, and we cannot guarantee absolute security.

We retain your account information, listings, and messages for as long as your account is active, or as needed to operate the Platform. If you delete your account, we will remove your personal data within a reasonable period, except where retention is required to comply with legal obligations or resolve disputes.

Depending on your location, you may have rights to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Withdraw consent for optional features (e.g., disconnecting Google Sign-In, where email/password login remains available).

To exercise any of these rights, contact us using the details in Section 12.

DUTRES is intended for students who meet the eligibility requirements described in our Terms & Conditions. We do not knowingly collect data from children below the age required to use the Platform under applicable law. If you believe a child has created an account in violation of this policy, please contact us so we can investigate.

If you choose to sign in with Google, your use of that feature is also subject to Google's own privacy policy. We only receive the profile information Google shares with us upon your authorization, and we use it solely to create/authenticate your DUTRES account.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will update the "Last updated" date above when changes are made, and will make reasonable efforts to notify Users of material changes.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact divinehlaluko@gmail.com.