Privacy policy

What this policy covers

This policy explains what personal data Phsar collects, why, how long we keep it, and the choices you have. It applies to the Phsar app, phsar.org, and our Telegram bot. Phsar is operated by Sochetra Phy, Phnom Penh, Cambodia.

Where your data is stored

Your account and listing data is stored with Supabase, in Singapore. Photos are stored with Cloudflare R2.

What we collect

We collect: your phone number; your Telegram ID and username, if you sign in with Telegram; your name, username, bio and district; your profile photo; an optional email address; your listings; your messages; your favourites and saved searches; notifications we send you; reports you file or that are filed about you; and moderation records related to your account.

How long we keep it

• Draft listings you haven't published: 30 days.
• Listings you delete: purged after 90 days.
• Photos sent in chat: 1 year.
• Search logs, not linked to your account: 180 days.
• A hashed record of the phone number used for a login code: 90 days.
• A hashed record of the IP address behind a report: 30 days.
• Moderation and report records: 12 months.
• A data export file you download: available for 24 hours, then deleted.

Your rights

• Download your data. Go to Settings → Privacy to request a copy. You can request one file per day.
• Delete your account. Go to Settings → Privacy. Your account enters a 14-day grace period — logging in again during that time cancels the deletion. After that, your account and listings are removed. Messages you sent stay visible in the other person's chat, labelled "Deleted user." Moderation records are kept for 12 months as described above.
• Turn off usage statistics. You can opt out of anonymous usage statistics (PostHog) at any time, in the cookie notice or in Settings → Privacy.

Who else sees your data

We share data only as needed to run Phsar, with these processors: Supabase (database), Cloudflare (photo storage), Vercel (hosting), Upstash and Inngest (background jobs), Telegram (login and bot notifications), our SMS provider (login codes), Namecheap (our support email, when you write to us), Sentry (error monitoring, based in the EU), and PostHog (anonymous usage statistics, based in the US — no session recordings, no IP addresses stored). We do not sell your personal data to anyone.

Contact

Questions about this policy or your data: message @Phsar_Support on Telegram or email support@phsar.org.