1. Who we are

Brtr is operated by [Legal entity name], [company registration number], [registered address]. For the purposes of data protection law we are the data controller for the information described in this policy.

Our data protection contact is [name / role], reachable at legal@brtr.app.

2. What we collect

Information you give us

Account details — your name, email address, and phone number. The phone number is required before you can message anyone or make an offer, and is used for verification and anti-abuse. It is never shown to other users.
Profile information — display name, optional photo, and the general area you trade in.
Listings — photos, titles, descriptions, condition, category, and what you are looking for in exchange.
Messages and offers — the content of conversations and trade proposals between you and other traders.
Meet-up arrangements — the place, date and time attached to a trade.
Ratings and reports — ratings you give after a completed trade, and any reports you submit.

Information we collect automatically

Device and app data — device model, operating system version, app version, language and region settings, and crash diagnostics.
Approximate location — used to show you listings within a sensible distance and to display distance on a listing. State clearly whether precise GPS is used, whether it is optional, and what granularity is stored — e.g. “we store location rounded to a 1km grid, never a precise coordinate”.
Usage data — which screens you open and which actions you take, used to understand where the product is confusing.

What we never collect

Brtr has no payments, so we never collect card numbers, bank details, or billing addresses. There is no price field anywhere in the product and therefore no transaction history in the financial sense.

3. Why we use it

Purpose	Lawful basis
Creating and running your account	Performance of a contract
Showing you relevant nearby listings	Performance of a contract
Phone verification and fraud prevention	Legitimate interests
Investigating reports and enforcing the guidelines	Legitimate interests
Diagnosing crashes and improving the app	Legitimate interests
Sending service emails about your trades	Performance of a contract
Sending waitlist or product emails	Consent

If you operate outside the EU/UK, replace this table with the correct basis framework for your jurisdiction — e.g. Saudi Arabia’s PDPL uses a different set of legitimate-purpose grounds.

We do not sell personal data, and we do not share it for advertising.

We share limited data with service providers who process it on our behalf: list your actual processors — hosting, crash reporting, analytics, SMS verification provider, email delivery, customer support tooling — and the country each processes data in.

Other traders see only your display name, profile photo, general area, rating, and completed-trade count. They never see your email address, phone number, or precise location.

We may disclose information where we are legally required to, or where it is necessary to investigate a credible safety concern.

5. How long we keep it

Replace with your actual retention schedule. A defensible default: account data for as long as the account is active plus [X] days; messages and trade records for [X] months after a trade closes; reports and safety records for [X] years; crash logs for 90 days.

When you delete your account we remove your profile and listings. Messages you sent remain visible to the other participant in the conversation, shown as from a deleted account, because they form part of that person’s own trade record.

6. Your rights

Depending on where you live, you have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. You can also withdraw consent for marketing email at any time.

To exercise any of these, email legal@brtr.app. We respond within [30 days].

Add the relevant supervisory authority and complaint route for your jurisdiction.

7. Children

Brtr is not intended for anyone under [16 / 18]. We do not knowingly collect data from children, and we remove accounts we find to belong to them.

8. Security

We use encryption in transit and at rest, restrict internal access to personal data to staff who need it, and require verification before high-risk account actions. Describe any additional controls you can honestly claim — no more than that.

9. Changes

We will post material changes to this policy here and, where the change is significant, notify you in the app before it takes effect.