1. Information We Collect & Why
To secure transactions and prevent platform fraud, we collect minimal profile identifiers and ledger logs. We do not run advertising systems or track your browsing activity across other websites.
Data Collected & Purpose:
- Authentication Identifiers: Name, email address, and cryptographically hashed passwords collected to maintain your private account session.
- Optional Identity Verification: CNIC and identity profile details are collected only when a user chooses to request the optional verified identity trust signal.
- Structured Ledger Logs: Reference codes (e.g.
SSL-X4M8QK), matched payment values, and withdrawal bank or wallet details collected to verify transactions. - Structured Communications: Access details, credentials, and OTP requests exchanged through official support tickets to investigate disputes.
2. Authentication Data Handling
We delegate core authentication and session security to Firebase Authentication (a Google service). When you sign up using your email and password, or authenticate using Google Sign-In, Firebase generates a secure session token.
Your password never touches our backend directly; it is processed securely by Firebase using industry-standard salting and cryptographic hashing methods.
3. Application Data Storage
All transactional information, user profiles, active stashes, escrow status, ratings, and communication histories are stored in a secure relational database managed by Supabase.
All database traffic is encrypted in transit via SSL, and access control is enforced at the database layer using Row-Level Security (RLS) policies to ensure that your private profile data can only be accessed by you or authenticated platform administrators resolving disputes.
4. Payment Reference Storage
Split Stash coordinates payments manually. We do not act as a payment gateway, and we never collect, store, or process credit card numbers or wallet PINs.
We only store the manual transaction metadata you provide:
- The payment method selected (Easypaisa, JazzCash, or bank transfer).
- The payment date, amount, and corresponding Split Stash reference code.
- Receipt tracking details needed for manual verification.
5. Third-Party Service Providers
We share coordination updates with reputable services to run the marketplace operations:
- Vercel: Used for static page delivery and Edge edge-route analytics. We do not transmit individual user data to analytics dashboards.
6. Data Retention & Deletion Requests
We retain profile data for as long as your account remains active. However, we maintain ledger logs (transaction matches, dispute history, and ratings) as permanent immutable records to track platform integrity, preserve host payouts, and calculate historic Trust Scores.
If you wish to terminate your account and delete your personal information, you can submit a deletion request to support@splitstash.com. Our team will process the request within 7 business days, purging authentication credentials and replacing your profile name with a generic identifier (e.g. “Deleted User”) to keep historical ledger calculations intact.
7. Updates to This Policy
We may adjust this policy occasionally as database tables or external API tools evolve. If we make significant changes in how we handle personal identifiers, we will notify you via email or in-app alerts at least 14 days before the updates go into effect.