Draft for review · intended initial launch: South Africa
Privacy Policy
Status and effective date
Draft dated 21 October 2026; it is not yet a final effective policy. This draft is also published at https://the-plug-legal.pages.dev/privacy-policy.html. Use the public Privacy Policy URL in the Google Play listing only after the policy is finalized, matches the production app and has been approved for release.
Responsible party and contact
The operator and responsible party is Jurgens Human, operating The Plug personally and not through a company. The intended initial launch market is South Africa. No home address is published; a suitable non-residential service or mailing address and any required Information Officer particulars must be confirmed before public launch. For support or privacy requests, contact akajurgiii@gmail.com. This email address must be actively monitored.
Information The Plug handles
Account information includes your email address, username, account identifier and email-verification status. Supabase handles authentication credentials; The Plug does not receive your password in readable form. Community posts can include product names, prices, shop names, typed areas, selected branch names and coordinates, photos, timestamps and your public username. Find reports and follow relationships are also stored. Moderation audit entries can include administrator and target account identifiers, the action taken, a reason and a timestamp; these entries are not automatically removed when an account is deleted. The app’s age gate checks your date of birth on your device, does not send or store the birth date, and stores only an adult/underage result locally. Saved finds and some preferences are stored on your device. The app does not currently request your device’s live GPS location. The app does not explicitly strip EXIF metadata before uploading the selected image; test the platform picker behavior and disclose it accurately.
How information is used
Information is used to create and secure accounts, verify email, show and search public finds, display maps and directions, support follows, receive and review reports about finds, prevent abuse, maintain and improve the service, respond to requests, and meet legal obligations. A shop name and area entered for branch search are sent to Photon to return location suggestions. If you open map directions, the selected shop destination is sent to Google Maps or the map service your device uses. The app does not currently provide direct user-to-user blocking or in-app account reporting.
Public posts and choices
Community finds are public. Your username, find details, price, shop/area, selected branch location and attached photo can be viewed by anyone and may be copied outside the app. Photos are stored in the service’s public photo storage; do not post private, sensitive or identifying information. Your email address and password are not displayed on your public profile. Device-only saved finds are not uploaded just because you use the app.
Service providers and transfers
Supabase provides the configured database, authentication, photo storage and account-deletion service. OpenStreetMap provides map tiles, Photon provides location search, and Google Maps or another installed maps service may receive a destination when you request directions. Cloudflare Pages hosts this legal website. These providers may receive technical connection data, such as an IP address, when your device connects to them. The project’s actual Supabase region and plan are not available in the app code and must be checked in the project dashboard. Before launch, the operator must verify each provider’s legal entity, role, privacy notice, data received, processing locations, subprocessors, contractual terms and transfer safeguards. Email delivery, diagnostics, analytics and any other SDK or provider used in the production build must also be identified. The current intended initial market is South Africa; any later country expansion needs a new assessment. The Plug does not sell personal information according to the current service design; this must be checked against all production providers.
Marketing choices
Marketing email consent is optional, separate from account creation and off by default. If you opt in, your choice is recorded so it can be respected. Email marketing is not currently configured and no promotional emails should be sent until the operator has a lawful provider, a working unsubscribe process and the required contact details. You can withdraw consent in your profile at any time; withdrawal does not affect earlier lawful processing.
Retention and security
The app is designed to delete an account, its profile, finds, find reports, follows and uploaded photos from active service systems. The deletion flow removes the account’s photo objects before deleting its Supabase Auth user; database foreign-key rules remove associated records. The current database has no automatic expiry schedule for active accounts, public finds, reports or moderation audit entries. Moderation audit entries include account identifiers, actions, reasons and timestamps and are not automatically deleted with an account; the retention purpose, access limits and period must be set and disclosed before launch. Supabase database-backup retention depends on the project plan and any backup add-ons, which have not been confirmed. Supabase documents that database backups do not include Storage objects. The exact backup and provider-copy handling, request completion times, lawful/security exceptions and safeguards against restoring deleted information into active use must be verified before this policy takes effect. Security controls and the incident-response process also require verification; no internet service can promise absolute security.
Your privacy rights
Subject to applicable law, you may ask to access or correct personal information, object to or restrict certain processing, withdraw consent, or request deletion. You can delete your account in the app or, if you cannot access it, request deletion by email using the public page at https://the-plug-legal.pages.dev/account-deletion.html. The operator will verify requests and respond within applicable legal time limits. You may also complain to the Information Regulator of South Africa where applicable.
Children, changes and review
The Plug is intended only for people aged 18 and older. The in-app age check is self-declared and is not identity or age assurance. If you believe a person under 18 has provided personal information, contact the operator. The intended initial launch market is South Africa. This draft has not yet received qualified South African privacy and consumer-law review and is not legal advice. A qualified professional should review it against the final business, hosting, marketing and deletion arrangements before release. Reassess the documents before expanding to other countries.
Legal grounds and regional rights
The operator must document the lawful basis and purpose for each use of personal information under South African law before launch. Accepting the Terms is not consent to all processing, and optional marketing consent is separate. Subject to applicable law, you may request access to or correction or deletion of personal information and may raise an objection or complaint with the Information Regulator of South Africa. The operator must confirm the required Information Officer registration/contact details and complete the notices required for the production service before launch.
Permissions, device information and photo metadata
The app may request camera or photo-library access when you choose to attach a product image. The app does not currently request live GPS access. The app uploads the selected image bytes and does not explicitly remove EXIF metadata before upload; do not assume GPS or other metadata is stripped. The exact platform picker behavior, device/local storage, and any diagnostics, analytics, identifiers or website technologies must be verified against the production build and disclosed accurately before release.