Privacy Policy

1. Introduction

Welcome to ZWAP, a marketplace application designed exclusively for college students. Your privacy is important to us. This Privacy Policy explains how ZWAP collects, uses, discloses, and protects the personal information of users when you access or use our mobile application.

By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the terms set forth herein, you must not use the App.

ZWAP is operated from the United States. This Privacy Policy is intended to comply with applicable United States federal law and state privacy laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), and other applicable state privacy statutes.

2. Information We Collect

We collect personal information that you provide directly, that is generated through your use of the App, and that is collected automatically by our technical systems. The categories and specific types of information collected are described below.

2.1 Account Information

When you register for an account, we collect the following:

• Full name or display name
• University-issued email address (ending in .edu), used for student verification
• Username
• Password (stored in encrypted form via Firebase Auth)
• Date of birth (where voluntarily provided, used solely to verify minimum age)
• Profile photograph (if voluntarily uploaded)
• Optional payment handle (e.g., Venmo or Zelle username, if voluntarily provided)

2.2 Transaction Information

When you engage in buying, selling, or requesting items on the platform, we collect:

• Listing details, including item descriptions, photographs, and asking prices
• Offer and counter-offer history
• Transaction status records
• Reviews and reputation scores associated with completed transactions
• Chat messages exchanged between buyers and sellers in connection with transactions

2.3 Usage Data

We automatically collect certain technical and behavioral information when you use the App, including:

• App features accessed and frequency of use
• Device type, operating system version, and application version
• Installation identifier (as assigned by Firebase)
• Crash reports and performance diagnostics (collected via Firebase Crashlytics)
• Anonymized usage statistics (collected via Firebase Analytics)

Usage data is used solely to maintain and improve the performance and reliability of the App. It is not used for advertising profiling and is not linked to your identity for advertising purposes.

3. How We Use Your Information

We use the personal information described above for the following purposes:

• Creating, verifying, and managing user accounts
• Verifying student status through .edu email verification
• Enabling buying, selling, and requesting of items on the platform
• Facilitating messaging between buyers and sellers
• Processing and tracking transactions
• Displaying listings, reviews, and reputation scores
• Sending notifications related to account activity and transactions
• Preventing fraud, spam, and abuse on the platform
• Enforcing our Terms of Service and moderation policies
• Improving the performance, security, and reliability of the App
• Complying with applicable legal obligations

We do not sell personal information to third parties, including advertisers. We do not use personal information to serve targeted advertising.

4. Disclosure of Personal Information

4.1 With Other Users

Certain information is visible to other users of the App to the extent necessary to facilitate transactions, including:

• Username and display name
• Listings posted
• Reviews received and reputation score
• Chat messages exchanged in connection with a specific transaction

4.2 With Service Providers

We engage trusted third-party service providers to operate and maintain the App. These providers process personal information solely on our behalf and only as necessary to deliver their designated services. Our current service providers include:

• Firebase Auth – user authentication
• Cloud Firestore – database storage
• Firebase Storage – image storage
• Firebase Cloud Messaging (FCM) – push notification delivery
• Firebase Crashlytics – crash and error reporting
• Firebase Analytics – anonymized usage analytics
• SendGrid – transactional email delivery
• Google Sign-In / Apple Sign-In – third-party authentication options

All service providers are contractually obligated to maintain appropriate data security standards and are prohibited from using your information for any purpose beyond the services they provide to us.

4.3 Legal Disclosures

We may disclose personal information where we have a good-faith belief that such disclosure is necessary to: (i) comply with applicable law or respond to valid legal process, including subpoenas, court orders, or government requests; (ii) protect the rights, property, or safety of ZWAP, our users, or the public; or (iii) enforce our Terms of Service or investigate potential violations thereof.

4.4 Business Transfers

In the event that ZWAP undergoes a merger, acquisition, reorganization, or sale of all or substantially all of its assets, personal information held by us may be transferred to the acquiring entity as part of that transaction. We will notify users of any such transfer and any material changes to this Privacy Policy that result therefrom.

5. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with our legal obligations. The following retention schedule applies:

• Transaction records and reviews: retained permanently to maintain the integrity of the marketplace and users' reputation histories
• Chat messages: retained permanently as part of transaction records
• Moderation logs: retained permanently and immutable to support platform integrity and legal compliance
• Abuse and safety reports: retained permanently and not subject to user deletion
• Email one-time passcodes (OTP): automatically expire and are deleted after 10 minutes
• Usernames: retained permanently, including after account deactivation, to preserve historical transaction records
• Local device preferences (SharedPreferences): persist on the device until the App is uninstalled
• User accounts: subject to administrator-controlled deletion upon valid request (see Section 7)

We retain transaction records, reviews, and moderation logs permanently in order to maintain the integrity and trustworthiness of the marketplace, prevent fraud, and comply with potential legal and regulatory obligations. Where a user requests deletion of their account, identifiable account data will be removed to the extent technically and legally permissible; however, anonymized or aggregated records related to completed transactions and moderation actions may be retained.

6. Data Security

We implement appropriate technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encrypted authentication systems
• Role-based access controls restricting internal data access
• Monitoring and abuse detection systems
• Secure cloud infrastructure provided by Google Firebase

Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your information. In the event of a data breach that affects your personal information, we will notify you and relevant regulatory authorities as required by applicable law.

7. Your Rights and Choices

Depending on your state of residence, you may have certain rights with respect to your personal information. These rights are summarized below. To exercise any of these rights, please contact us using the information provided in Section 13.

7.1 Rights Available to All Users

Regardless of location, all users of the App may:

• Access and review the personal information associated with their account
• Correct inaccurate information by updating their account profile
• Request deletion of their account (subject to the limitations described in Section 5)
• Opt out of push notifications via device settings or the App's notification preferences
• Choose not to provide optional profile information (e.g., payment handles, profile photographs)
• Choose not to use Google or Apple Sign-In and instead register via email

7.2 Rights of California Residents (CCPA/CPRA)

If you are a resident of California, you have the following additional rights under the CCPA/CPRA:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collection, and the categories of third parties with whom it has been shared.
• Right to Delete: You may request deletion of personal information we hold about you, subject to exceptions permitted by law (including for security, legal compliance, and marketplace integrity purposes).
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: ZWAP does not sell personal information and does not share personal information for cross-context behavioral advertising. Accordingly, no opt-out mechanism for the sale or sharing of personal information is required at this time. Should our practices change, this Policy will be updated accordingly.
• Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information as defined under the CPRA, you have the right to limit our use of such information to that which is necessary to perform the services you have requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a verifiable consumer request under the CCPA/CPRA, please contact us at the email address provided in Section 13. We will respond to verifiable requests within the timeframes prescribed by applicable law.

7.3 Rights of Residents of Other States

Residents of certain other U.S. states (including Virginia, Colorado, Connecticut, Texas, and others with enacted comprehensive privacy legislation) may have additional rights with respect to their personal information, including rights of access, correction, deletion, portability, and opt-out of certain processing activities. If you believe you hold rights under the privacy law of your state of residence, please contact us and we will respond in accordance with applicable requirements.

8. Children's Privacy

ZWAP is a marketplace application intended exclusively for college students. The App is not directed to children under the age of 13, and we do not knowingly collect personal information from any individual under 13 years of age.

During account registration, users are required to confirm that they are at least 13 years of age. Where a date of birth is voluntarily provided, it is used to enforce this minimum age restriction. If we become aware that personal information has been collected from a child under the age of 13 without verifiable parental consent, we will take prompt steps to delete such information from our systems.

Given that the App is designed for use by college students, the practical expectation is that substantially all users will be 18 years of age or older. If you have reason to believe that a minor has registered for an account, please notify us at the contact address provided in Section 13.

9. Tracking Technologies

ZWAP is a mobile application and does not use browser cookies. However, we employ the following limited tracking technologies in the operation of the App:

• Firebase Analytics: collects anonymized, aggregated usage statistics to help us understand how users interact with the App. This data is not used for cross-app or cross-website tracking, and is not linked to your identity for advertising purposes.
• Firebase Crashlytics: collects crash and error data linked to a device installation identifier, used exclusively to diagnose and remediate technical issues.
• FCM Device Tokens: generated by Firebase Cloud Messaging and used exclusively to deliver push notifications to your device. These tokens are not used to track your activity across third-party applications or websites.

These technologies do not track you across third-party applications or websites, and none of the data collected through them is used for advertising or data-brokering purposes.

10. Do Not Track Signals

Some web browsers and mobile operating systems include a "Do Not Track" (DNT) feature or similar setting. Because ZWAP is a mobile application that does not employ browser-based tracking, and because there is currently no universally accepted standard for interpreting DNT signals in mobile environments, the App does not respond to DNT signals at this time. Our data collection practices are described in full in this Privacy Policy.

11. International Users

ZWAP is operated from the United States and is intended for use by students enrolled at United States colleges and universities. If you access the App from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States. Data protection laws in the United States may differ from those applicable in your country of residence.

By using the App, you consent to the transfer and processing of your personal information in the United States in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. If we make material changes to this Policy, we will notify you by posting a prominent notice within the App, sending a notification to the email address associated with your account, or both. The revised Policy will indicate the updated "Last Updated" date at the top of this document.

Your continued use of the App following the effective date of any material changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised terms, you must discontinue use of the App.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of the rights described herein, please contact us at:

Email: zwap@ruraltechnologies.co

We will endeavor to respond to all privacy-related inquiries within a reasonable period of time and in accordance with any applicable legal deadlines.