Privacy Policy

This Privacy Policy explains what SilkDots collects from visitors and account holders, why we collect it, and how long we keep it. We try to keep data collection to the minimum required to run a safe directory.

1. What we collect

From visitors (no account)

• Approximate location derived from your IP address, used only to suggest a city.
• An anonymous device fingerprint hashed with a server-side secret, used to throttle abusive traffic and to gate review eligibility.
• Standard server logs (IP address, user agent, timestamp). IPs are stored in hashed form for security review.

From account holders

• Email address (required to verify the account and receive password resets).
• Password (stored as a bcrypt hash — we cannot read it).
• Username and any optional profile fields you choose to fill in.
• Login events: timestamp, hashed IP, browser/OS, fingerprint, and outcome — shown to you in your settings so you can spot strange access.
• Devices you've marked as trusted, which you can revoke any time.

From advertisers

• Everything in your ad: title, description, photos, prices, contact methods, services, location.
• Verification selfies, when you opt in, retained while your account is active.
• Boost purchases and wallet transactions, retained for accounting.

2. Why we collect it

• To run the directory and keep your account secure.
• To moderate listings and prevent fraud, impersonation, and abuse.
• To verify advertiser identity (when opted in).
• To process payments via our payment provider.
• To respond to legal requests where we are required to comply.

We don't sell your data. We don't share it with third parties for advertising. We don't use behavioral tracking across other sites.

3. Cookies and similar

We use a small number of first-party cookies and localStorage keys: a session cookie to keep you signed in, an age-gate flag, and a CSRF token for forms. We do not use third-party advertising cookies or cross-site trackers.

4. How long we keep it

• Active accounts: as long as the account exists.
• Login events and rate-limit buckets: rolling 90 days.
• Deleted accounts: most personal data is removed within 30 days; some records are retained where law requires (e.g., financial records).
• Verification selfies: removed when verification is rejected or revoked, or when the account is deleted.

5. Your rights

You can request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account. You can also revoke trusted devices and disable any session from your dashboard settings. Deletion of an account removes your ads and reviews.

6. Children

The Service is for adults only. We don't knowingly collect personal data from anyone under 18. If you believe a child has submitted data to the Service, contact us and we will remove it.

7. Security

Passwords are bcrypt-hashed. IP addresses are stored as salted hashes. We log unusual login signals and surface them to you. We don't guarantee absolute security, but we try hard.

8. Changes to this policy

We may update this Privacy Policy occasionally. Material changes will be announced on the site.

9. Contact

For privacy questions or data requests, see the contact page.