Privacy Policy

Zim Items & Services Listings ("the Platform") is committed to protecting the privacy of all users. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Platform, you consent to the practices described here.

Information you provide directly:

• Registration data: Username, phone number, name, surname, location, email address (optional), Facebook profile link (optional)
• Profile data: Professional title, profile picture, contact preference
• Listing data: Title, description, category, price, location, photographs, and videos you upload
• Messages: Inquiries and support messages you send through the Platform
• FAQ questions: Questions you submit to the community Q&A

Information collected automatically:

• Login records: IP address, timestamp, and outcome of login attempts (for security purposes)
• Session cookies: A secure cookie is set when you log in to keep you authenticated during your visit
• Last activity: Each page you load while logged in updates a "last seen" timestamp on your account. This is used to show an online/offline status indicator to other users
• Site usage: Page views and listing click counts (aggregated, not personally identifiable)

We use the information we collect to:

• Create and manage your account
• Display your listings and profile to other users
• Enable buyers to contact you via WhatsApp or on-site messaging
• Send you replies to your support messages and FAQ questions through your dashboard
• Detect and prevent fraudulent activity and security breaches
• Improve Platform performance and user experience
• Enforce our Terms of Use

We do not use your data for automated profiling, targeted advertising, or selling to third parties.

What is publicly visible:

• Your listings (title, description, price, location, category, photos)
• Your username, first name, title, and location on listings and your public seller profile page
• Your phone number is shown on listings to enable WhatsApp contact
• Your online/offline status (derived from last activity — shows "Online" if active within 5 minutes, otherwise "Offline")
• Your public seller profile page at /seller/your-username showing your active listings
• FAQ answers, once published by admin, are visible to all visitors

What is private:

• Your password (stored as a cryptographic hash — never readable)
• Your email address (not displayed publicly)
• Your support messages and admin replies
• Your login history and IP address

We do not sell, rent, or trade your personal information to any third parties. Information may be disclosed to authorities only if required by Zimbabwean law or a valid legal order.

We use a single session cookie (uid) to keep you logged in during your browsing session. This cookie:

• Contains only your encrypted user ID
• Is marked httpOnly — it cannot be accessed by browser scripts
• Is removed when you log out

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No data is shared with Google Analytics, Facebook Pixel, or similar services.

We take the security of your data seriously. Measures in place include:

• Passwords are hashed using bcrypt with an individual salt — they are never stored in plain text and cannot be reversed
• Existing accounts using the older SHA-256 format are automatically and transparently upgraded to bcrypt on next login — no action required from you
• Failed login attempts are logged and monitored for brute-force patterns
• Suspicious IP addresses can be blocked by the platform administrator
• Session cookies are set with the httpOnly flag to prevent cross-site scripting attacks

While we take these precautions, no internet-based system is 100% secure. You are responsible for keeping your login credentials confidential.

Your account and listing data is retained for as long as your account remains active. If you wish to have your account or listings removed, please contact us via the Contact page.

Security logs (login attempts, IP addresses) are retained for a minimum of 90 days for fraud prevention purposes.

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information via your profile settings
• Delete your listings at any time directly from the listing page or your dashboard
• Mark listings as Sold once a transaction is complete, removing them from active search results
• Renew listings approaching their 60-day expiry to keep them live
• Request account deletion by contacting us — we will process this within 14 days

To exercise any of these rights, log in and submit a request through the Contact page.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that a minor has registered, the account will be deactivated.

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. We encourage you to review this page periodically. Continued use of the Platform following updates constitutes acceptance of the revised Policy.