Draft for legal review — not yet in force.

Privacy Policy

Last updated 24 September 2026

What we collect

• Account: name, email and/or phone number, a salted password hash, and an encrypted two-factor secret if you turn 2FA on.
• Security: sessions and sign-in events with IP address and browser description, used to show your devices and alert you to new sign-ins.
• Identity verification: only the outcome and a reference from our verification partner. Your ID documents and national ID number stay with the partner and are never shown on RELIST.
• Marketplace activity: listings, photos, private purchase proofs, offers, messages, transactions, reviews, reports, saved listings and searches, recently viewed items, follows and wanted posts.
• Support requests: the name, email or phone number, and message you send through the contact form, so we can reply.
• Delivery: if you choose courier delivery, the recipient name, phone number and address you give, and the seller’s pickup address. The seller sees your delivery address only after your payment is held in escrow.
• Usage: which kinds of pages are visited, searches, and key steps such as starting a chat, making an offer or starting checkout, with the page type, city, language and device type (phone, tablet or computer). Visits are counted with a random id in a cookie; we don’t record IP addresses for this, and nothing is recorded if your browser sends Do Not Track or Global Privacy Control. We use it to understand and improve RELIST, and delete it after 13 months.
• Location: the area and map position you choose for a listing. Your privacy settings control how precisely it is shown.
• Payments: amount, method, status and the payment provider’s reference. Card numbers and wallet PINs are entered on Stripe’s or bKash’s own pages and never reach RELIST. Payout account numbers are stored encrypted and shown only as the last four digits. If you choose to save a card, Stripe stores it; RELIST keeps only Stripe’s customer reference, and you can remove saved cards under Payments at any time.
• Business accounts: if you register a shop, its name, address, phone number, logo, description and policies are shown on your public shop page. The trade licence number, TIN and licence document are seen only by RELIST staff.

Why we use it

To run your account and the marketplace, verify members, prevent fraud and abuse, hold and release escrow funds, keep financial and tax records, send the notifications you choose, and investigate reports and disputes. We don’t sell personal data.

Who we share it with

• Other members: your public profile, listings, reviews and verification badges; your messages go to the member you are talking to.
• Service providers, only for the service they provide: Stripe and bKash (payments), Pathao (courier delivery: the delivery and pickup details for a parcel), our identity verification partner, SMS and email delivery providers, cloud storage for photos and documents, and, if you use photo suggestions when selling, an AI provider that analyses the listing photos you upload.
• Push notifications: if you turn them on, your browser’s push service (Google, Apple, Mozilla or Microsoft) delivers them. The message is encrypted so only your device can read it; the push service sees only when a message is sent.
• Maps: map views load tiles from OpenStreetMap, which receives your IP address.
• Authorities: when the law requires it, or to protect members from fraud or harm.

Cookies and local storage

We use one sign-in cookie (relist_session), a short-lived cookie during two-factor sign-in (relist_2fa), a cookie that remembers your language (relist-locale), a cookie that remembers your chosen city (relist-city), and a random visitor id for counting visits (relist-visitor). Your browser also stores preferences such as recent searches and saved listings locally. We don’t use advertising or cross-site tracking cookies.

How long we keep it

Account data is kept while your account is active. When you request deletion, your account is deactivated immediately and your profile and listings stop being shown. Payment, payout, tax and moderation records, and the append-only audit log, are kept as long as financial and legal obligations require.

Your choices

• Change profile, location and activity visibility in privacy settings, and notification channels in notification settings.
• Review sessions and sign-in alerts in security settings.
• Download a copy of your data from Settings, as one JSON file.
• Deactivate your account or request deletion from Settings.

Security

Connections are encrypted, sensitive fields are encrypted at rest, and staff access to account data is restricted and logged. Tell us immediately if you think your account has been compromised.

See also the Terms of Service and safety guidelines.