Privacy Policy

Last Updated: 2026-08-20
Effective Date: 2026-08-20

1. Scope and Controller

This Privacy Policy explains how personal data is handled when you use the ADON mobile application and related services (the "Service").

Data controller: HAEUN PARK
Privacy contact: gktp0528@gmail.com

We process personal data under the EU General Data Protection Regulation (GDPR) and applicable Hungarian law.

2. Data We Process

2.1 Account and Profile Data

Authentication data such as email address, authentication provider, Firebase user ID, and email-verification status
Public profile data you provide, such as display name, profile and cover images, bio, general location, reputation, sales and response information, and account activity status
Private settings such as language, consent records, marketing preference, notification preferences, and push tokens
If you sign in with Google or Apple, the identifier and profile fields that provider makes available according to your selection and its rules

ADON does not receive your plain-text password. Email/password credentials are handled by Firebase Authentication.

2.2 Marketplace and Communication Data

Listing title, description, category, condition, price, photos, approximate pickup area, timestamps, and moderation status
Wishlists, keyword alerts, transaction-completion records, reviews, and ratings
Chat messages, chat images, language and cached translations, read status, and conversation metadata
Reports, report reasons and optional details, blocks, appeals, and support correspondence

Listings, listing photos, approximate listing areas, public profiles, and reviews are intended to be visible to other users. Chats and chat images are limited to conversation participants and authorized service operations. Reports and block records are not public.

2.3 Location and Place Search Data

With foreground location permission, the app obtains the device's current coordinate to center the map and let you choose a listing area
Before a listing location is returned for upload, coordinates are rounded to two decimal places (an approximate area, often around one kilometre but varying by latitude), and the public label is limited to area-level information such as district, city, region, and country
The exact device coordinate is not stored as a listing location by ADON
If you type a place search, the search text, selected place identifier, language, and request metadata are sent to Google Places; the returned coordinate is rounded before storage

Location permission is optional. You can search for an area manually, and you can change location permission in device settings.

2.4 AI and Automated Processing Data

Photos you deliberately submit to the optional AI listing-analysis tool
Listing photos, title, description, category, price, currency, and condition sent to Google Cloud Vertex AI for listing safety moderation only after separate listing-moderation consent; pickup location is not included in this Vertex AI payload
Chat text processed for automatic language detection and, when requested, translation; generated translations may be cached with the message
AI results, moderation outcomes, rate-limit counters, and limited operational error metadata

2.5 Notifications and Technical/Security Data

Push token, app language, notification choices, unread count, and notification delivery result
A notification may contain the sender name, listing context, and a short message preview and may be visible on your lock screen depending on device settings
IP address and request metadata processed by hosting, cloud, security, and email providers when you connect to the Service
Authentication/session tokens and Firebase App Check attestation tokens or validity results used to verify that requests come from a genuine app and, where supported, an authentic device (Apple App Attest with DeviceCheck fallback on iOS; Play Integrity on Android)
Rate-limit, security-event, function, and diagnostic logs needed to prevent abuse and investigate failures

ADON does not currently use Firebase Analytics, advertising SDKs, or create an in-app browsing-history profile.

3. Where Data Comes From

We receive data:

Directly from you when you register, edit a profile, list an item, chat, search, report, block, review, or contact support
From your device when you grant location, camera, photo-library, or notification permission
From another user when they message, review, report, or transact with you
From Google or Apple if you choose their sign-in service
Automatically from Firebase, App Check, push, cloud, and email infrastructure as needed to deliver and secure the Service

4. Purposes and Legal Bases

We process data for these purposes:

Performing the service contract (GDPR Article 6(1)(b)): authentication, profiles, listings, search, chat, translation, wishlists, transactions, reviews, support, and account deletion
Consent (Article 6(1)(a)): optional AI photo analysis and the separate consent for sharing listing photos, title, description, category, price, currency, and condition with Google Cloud Vertex AI for listing moderation, as well as optional marketing preference, device location permission, and device notification permission where consent is the applicable basis. You may withdraw consent for future processing without affecting earlier lawful processing
Legitimate interests (Article 6(1)(f)): internal rules-based moderation and marketplace safety operations, fraud and abuse prevention, App Check, rate limiting, service security, delivery diagnostics, and enforcing the Terms. We balance these interests against user rights
Legal obligations (Article 6(1)(c)): responding to lawful authority requests and meeting applicable legal duties
Legal claims (Article 6(1)(f) or applicable law): establishing, exercising, or defending a claim when necessary

We do not sell personal data.

5. AI Photo Analysis and Other AI Features

The enhanced listing-photo analysis is optional. Selected photos may first be staged in an owner-only temporary Firebase Storage path while a draft is prepared. Only after you grant the separate listing-analysis consent does an authenticated, App Check-protected Cloud Function validate up to three selected photos and send their contents to Google Cloud Vertex AI to produce editable product suggestions.

The temporary copies are normally deleted immediately after the request, whether it succeeds or fails
If the app closes or the request never reaches the function, scheduled cleanup removes abandoned temporary inputs after they have been at least about one hour old

Before a new listing is published, or after an edit that requires a new safety review, listing photos may first be staged in an owner-only temporary Firebase Storage path. The separate listing-moderation consent allows an authenticated, App Check-protected Cloud Function to send the listing photos, title, description, category, price, currency, and condition to Google Cloud Vertex AI for automated safety moderation and related multilingual listing information. Pickup location is not included in this Vertex AI moderation payload. If you do not grant this consent, you can keep the draft and edit it, but the affected publish or review request is blocked. Manual listing creation and editing remain available where no AI safety review is required, including price, condition, and pickup-area-only edits.

Withdrawing either AI consent blocks future requests for that feature and queued requests that have not started. It does not guarantee retroactive cancellation of processing already started, and it does not automatically delete an already approved listing. Chat language detection and translation remain a separate feature with its own consent.

You can create and edit listing drafts without using optional photo analysis. Listing moderation is separately consented and is required only for the publish or content-review paths described above. After separate translation consent, text you request to translate — including chat messages and listing titles or descriptions — may be sent to Google Cloud Vertex AI for language detection and Google Cloud Translation API for translation. If the Translation API is unavailable, Vertex AI may translate the text instead. Resulting translations may be cached with the related content in Firestore.

ADON's secure AI functions are designed not to log image contents, prompts, chat text, search text, access tokens, or provider response bodies. Google Cloud may process service metadata and may retain content or logs for abuse monitoring where its applicable terms, settings, or law allow. Do not submit unnecessary personal or sensitive information to AI features. AI results can be inaccurate and are reviewed or used as assistance rather than treated as guaranteed facts.

6. When Data Is Shared

6.1 Other Users

We share public profiles, listings, listing photos, approximate listing areas, and reviews as part of the marketplace. Conversation content is shared with its participants. We do not automatically disclose your account email, private notification settings, push token, reports, or block list to other users.

6.2 Service Providers

We use providers only for functions needed to operate the Service:

Google Firebase: Authentication, Firestore database, Storage, Cloud Functions, Firebase Cloud Messaging (FCM), and App Check. Firebase privacy and security information
Google Cloud Vertex AI: listing assistance, content moderation, language detection, translation, and related AI processing. Vertex AI data retention information
Google Cloud Translation API: translation of text you request to translate, when available.
Google Places: address autocomplete and place details when you search for a listing area. Google Privacy Policy
Expo push service: relays supported push notifications. Delivery also uses platform push infrastructure such as FCM or Apple Push Notification service. Expo Privacy Policy
Apple and Google: authentication and mobile-platform services when you choose or use them

These providers may process identifiers, content, and technical metadata necessary for their role under their own terms and our service configuration.

6.3 Legal and Safety Disclosures

We may disclose information when required by law, a valid court or authority request, or when necessary and proportionate to protect rights, safety, and Service security. If the Service is reorganized or transferred, data may be transferred with appropriate notice and safeguards.

7. Retention and Account Deletion

We keep data only for as long as needed for the purpose described above, while your account or relevant content is active, or for a limited period required for security, dispute handling, or law. We do not apply an automatic 90-day inactivity deletion rule.

In Settings > Delete Account, successful Firebase Authentication deletion starts a retryable server-side cleanup of the user's profile, listings and listing media, conversations and chat media, transaction references, notifications, reports, blocks, reviews, search records, AI logs and rate-limit records, and other linked operational data. Some administrative records may be anonymized where deleting the whole record would affect another user's record.

Deletion from active systems does not always remove data instantly from rotating provider backups or security logs. Those copies are isolated from ordinary use and expire under provider backup schedules, or are retained only where necessary for a legal obligation, security incident, or legal claim. If deletion cannot be completed automatically, contact gktp0528@gmail.com.

8. International Transfers

Some providers may process data outside Hungary or the European Economic Area. Where required, transfers rely on an adequacy decision, the EU Standard Contractual Clauses, or another lawful safeguard. Provider locations and safeguards can change; current details are available in the provider notices linked above.

9. Security

We use measures including HTTPS/TLS, Firebase Authentication, access-controlled database and storage rules, private temporary AI storage, server-side authorization, App Check, request validation, rate limits, restricted service accounts, and limited operational logging. Public marketplace content remains public by design, and no online service can guarantee absolute security.

We assess personal-data incidents and notify the Hungarian supervisory authority and affected individuals when and within the time required by GDPR Articles 33 and 34.

10. Your GDPR Rights

Subject to the conditions and exceptions in law, you may request:

Access to your personal data and information about its processing
Correction of inaccurate or incomplete data
Erasure of data
Restriction of processing
Portability of data you provided in a structured, commonly used, machine-readable format
Objection to processing based on legitimate interests
Withdrawal of consent for future processing
Information about safeguards for an international transfer

To exercise a right, email gktp0528@gmail.com. We may need to verify your identity. We normally respond within one month; GDPR permits an extension of up to two additional months for a complex or numerous request, with notice.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): naih.hu, ugyfelszolgalat@naih.hu, 1055 Budapest, Falk Miksa utca 9-11, Hungary. You may also contact the supervisory authority where you live or work.

11. Choices and Permissions

Location: deny or revoke foreground location access in device settings and search manually instead
Notifications: change ADON notification choices in the app and banner, sound, badge, and lock-screen visibility in device settings
AI photo analysis: do not select the AI analysis consent; manual listing remains available
Marketing: do not opt in, or withdraw a previous marketing preference by contacting gktp0528@gmail.com
Profile and listing content: edit available fields or delete the relevant listing or account

12. Children

The Service is not intended for children under 13. If you believe a child under 13 has provided personal data, contact gktp0528@gmail.com. Where local law requires parental authorization for a minor's use or consent, the user must have that authorization.

13. Changes to This Policy

We may update this Policy to reflect the Service, providers, or law. We will change the date above and give reasonable additional notice if a change materially affects your rights or processing where required.

14. Contact

Data controller: HAEUN PARK
Email: gktp0528@gmail.com