Privacy Policy

For Free is a service-listing platform. The controller can be contacted about personal data, legal notices, and rights requests at privacy@forfree.services.

Data controller: Artsiom Mazhylouski

Contact address: ul. Stanisława Lema 15C/33, 31-571 Kraków, Poland

Registration number: REGON 525101996

VAT/tax number: NIP 6751781337

Depending on how you use the Platform, we process:

• — Telegram ID, username and display name, or Google email, display name and authentication identifier;
• — profile and listing contact details, including phone number and WhatsApp/Viber preferences;
• — country, city, and coordinates selected for a listing. Stored and public listing coordinates are snapped to an approximate grid of about 100 metres. Device location is requested only when you press a location button. It is used in memory to center the map or select a point; viewed map bounds reach our server and the tile provider, and a coarsened point reaches our server for local reverse geocoding;
• — listing text and uploaded photos. New photos are re-encoded to remove metadata such as EXIF/GPS; legacy photos are sanitized before display;
• — a timestamp and policy version when you confirm that you are 18 or older; we do not collect your birth date or identity document for this confirmation;
• — reports, moderation decisions and appeals; support, privacy and legal email correspondence, including sender addresses, message content, attachments and our responses; privacy-rights requests and our response records; versions and times of legal-document acknowledgments;
• — technical security and request data, such as IP address, user agent, rate-limit events, server logs, cookie/session data, page visits and performance measurements.

We use this data to:

• — authenticate users, maintain accounts, publish active listings and display their approximate city area;
• — disclose listing contact details only after an authenticated adult user deliberately requests them;
• — search local city data, display map tiles, operate filters, and remember optional settings on your device;
• — prevent abuse, enforce the Terms and Community Standards, investigate reports, give reasons, and handle appeals;
• — respond to privacy requests, prove legal-document acknowledgments, secure and troubleshoot the service, and meet legal obligations;
• — measure visits and performance with Vercel Analytics and Speed Insights; listing descriptions and contact details are not sent as custom analytics events.

We use Supabase for database, storage and authentication; Vercel for hosting, analytics and performance; Telegram for the bot and Mini App; Google for sign-in; Google Workspace for monitored support, privacy, moderation and legal email; and Upstash, when configured, for rate limiting. City search and reverse geocoding use a local city directory and are not sent to Nominatim. Your browser obtains map tiles from TomTom when configured or OpenStreetMap otherwise, which reveals the IP address and viewed map area to that provider. Opening a Telegram, WhatsApp or Viber link is your action and may share connection data with that provider. A Viber link passes the listing phone number to the Viber app; inside the Telegram Mini App, the external-browser handoff also passes it to Telegram in a URL fragment. You can copy the number instead. We do not sell personal data.

Account and listing data is kept until you delete it, except data that must be retained for a legal claim or duty. Hidden listings remain in your profile until deleted. Deleted photos and authentication identities are queued for cleanup and temporary failures are retried. Closed moderation records and completed privacy-request records are normally deleted after three years. Support, privacy, moderation and legal email correspondence is kept only as long as needed to resolve the matter, meet a legal duty or establish or defend claims, then removed under the documented mailbox retention procedure. Legal acknowledgments are kept while needed to prove acceptance and defend claims. Security logs and backups follow documented provider retention periods; deletion instructions must be respected during backup restoration. Copies saved by other people while content was public are outside our control.

Where GDPR applies, the legal bases are:

• — contract (Article 6(1)(b)) for authentication, accounts, listings, contact disclosure, and requested platform features;
• — legitimate interests (Article 6(1)(f)) for proportionate security, abuse prevention, moderation, diagnostics, service measurement, and records needed to establish or defend claims;
• — consent (Article 6(1)(a)) for optional device geolocation. You can revoke browser permission. The main map does not keep your current device position in local storage; earlier saved positions are removed when the map opens or through privacy settings. Reading this notice is not blanket consent. We process data when required by law under Article 6(1)(c).

Subject to applicable conditions, you may:

• — access your data, download a copy, and request portability;
• — request correction, deletion, or restriction of processing;
• — object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing;
• — delete a listing or account in your profile, use the privacy-request form, or contact us by email.

We may verify your identity and normally answer within one month where GDPR applies; lawful extensions will be explained. You may complain to the Polish supervisory authority (Prezes UODO, uodo.gov.pl) or your local data-protection authority. The Platform does not use AI to decide reports or make decisions with legal or similarly significant effects.

We use a language cookie, Supabase authentication cookies, and a temporary account-linking cookie. Local storage remembers legal-document versions and filters. Earlier app versions also saved a map position; opening the map removes it, and you can clear settings on this page or in your browser. We do not use marketing cookies; Vercel Analytics and Speed Insights are configured without analytics cookies.

Providers may process data outside the EEA. Where GDPR requires it, transfers rely on an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Contact us for current information about relevant providers and safeguards.

We use access controls, signed authentication, rate limiting, restricted service credentials, photo re-encoding, approximate public locations, and logging intended to protect data. No online service is completely secure. Interactive use is restricted to adults aged 18 or over; we do not knowingly collect data from children for accounts or listings. Contact us if you believe a child supplied personal data.

Material changes are dated and require a renewed acknowledgment in the Platform. Polish law and the GDPR apply where relevant, without limiting mandatory rights under other applicable law.