Privacy policy
Multan Gives connects people who have useful extra items with people who can use them. This policy explains how the current pilot handles information.
Independent accounts and login
You can register with a first name, username, email, password and neighbourhood, or use Google as an optional shortcut. Supabase Auth processes passwords; application profiles do not store plaintext passwords. Email is private and used for confirmation and password recovery. A server-only username lookup resolves sign-ins without publishing account email addresses. Login throttling stores keyed hashes of connection information and username-attempt counters; the pilot removes counters older than one day when its login service runs.
Information and its use
Google sign-in provides basic identity information such as your name, email address, account identifiers and, where provided, profile picture. Google and Supabase authenticate your account. We do not request Gmail messages, Google Drive files or contacts. We use account identity to manage sign-in, ownership of posts, requests and permissions.
We store the listing details, first name, neighbourhood, photographs, requests, messages and reports you submit to operate the gifting service and handle abuse. Hosting and authentication providers may also process technical logs such as connection details, IP addresses and timestamps for service operation and security.
Visibility and sharing
Approved listings, photos, donor first names, neighbourhoods and availability are publicly visible. Keep phone numbers, home addresses, faces and identity documents out of public listings. Pending listings are restricted to their donor and administrators through the app.
Requests and collection conversations are restricted to their participants through the app. They are not end-to-end encrypted; authorized project operators can access the database. You may voluntarily share a phone number or collection address privately after acceptance. This is not required.
We do not sell personal information or Google user data or use Google user data for advertising. The current pilot has no advertising or payment collection. We may disclose information where required by applicable law.
Providers and device storage
Cloudflare hosts the website. Supabase processes accounts, records and photographs. Google handles Google sign-in. These providers may process information outside Pakistan under their infrastructure and terms.
The app uses browser session storage for login and may cache public application files for installation. Its app code does not intentionally cache private messages or API responses for offline use. Providers may use their own security cookies. Sign out on shared devices.
Retention and account removal
The pilot has no automatic expiry for accounts, listings or messages. Hiding a listing does not erase all associated records. Email soilscientist70@gmail.com for access, corrections, account deletion or removal of content, using your account email where possible. We may confirm ownership before acting. Never send passwords, verification codes or identity documents. Limited records may remain for unresolved abuse reports, legal requirements or provider backups. Previously generated photo links can remain valid briefly after a listing is hidden.
Revoking Google access in your Google Account does not itself delete records already stored by Multan Gives; contact us for removal.
Contact and updates
Operator: Dr. Muhammad Farooq Qayyum, Multan, Pakistan. Privacy enquiries: soilscientist70@gmail.com. Changes to this policy will be posted here with a revised date.