Privacy

Privacy Policy

This Privacy Policy explains what information we collect, how we use it, and how we protect it when you use the TOLOCA mobile application and related services.

1. Information We Collect

Account Information

When you create an account, we may collect your name or nickname, email address, phone number, profile photo, user role (Client or Tolocan), and languages.

Location Information

TOLOCA collects location-related information to enable marketplace features such as showing nearby listings and Tolocans in search. This includes city or area selected by the user, approximate location voluntarily provided, and addresses added by the user.

TOLOCA does not request or use precise GPS location permissions. Location is based on user-selected cities, areas, or addresses provided voluntarily.

When usage analytics is on, Google Analytics for Firebase also derives an approximate location (country and region, not city) from your device’s network address. TOLOCA does not receive your GPS location through this service.

User Content

Users may create content including listings, service descriptions, tasks, rental offers, chat messages, reviews, ratings, and uploaded photos.

Technical Information

We collect limited technical information needed to operate and secure the app, such as device type, operating system version, app version, push notification tokens, and Firebase-generated identifiers.

Analytics Information

Installation identifier. When you first open TOLOCA, the app creates a random installation identifier and stores it on your device. It is not your advertising identifier, it is not derived from your device hardware, and it does not give access to your account or data. It is reset if you uninstall the app or clear its data.

How you found TOLOCA. If you arrive through a TOLOCA link (for example a campaign link or a shared public profile link) or, on Android, from Google Play, we record which channel brought you. If the channel cannot be determined, we record it as unknown. When you sign in for the first time, this information and your installation identifier are linked to your account once and are not changed afterwards.

Rental searches. When you search for rentals, we record the search in a normalized form (up to 80 characters, with email addresses and long number sequences removed), the selected category and city, how many results were shown, and when the search happened. If you are signed in, the search is linked to your account; otherwise it is linked to your installation identifier. Search analytics records do not include your IP address, your device’s advertising or hardware identifiers, your precise location, or your name.

Moderation & Safety Data

When users submit reports about other users or content, we collect the report details including the reason, description, and references to the reported content.

2. How We Use Information

We use collected information to provide marketplace functionality, create and manage accounts, enable secure in-app chats, improve platform safety and moderation, prevent fraud and abuse, monitor app performance, provide customer support, and send service notifications.

We use analytics information only to understand how people find and use TOLOCA — for example, which channels bring new users, what renters search for, and how often searches lead to rentals. We do not use it for advertising, and we do not use it to track you across other companies’ apps or websites.

3. Chat Moderation & Safety

TOLOCA includes moderation and safety systems to reduce spam, fraud, harassment, and unsafe behavior. This may include content filtering, spam prevention, user report processing, blocking functionality, and account restrictions.

4. Infrastructure & Third-Party Services

TOLOCA uses trusted third-party services:

• Firebase Authentication — identity and login. Methods include Google Sign-In, Sign in with Apple on iOS, email with a one-time verification code, and phone verification, depending on platform and app version.
• Cloud Firestore — application database
• Firebase Storage — file and media storage
• Cloud Functions — backend processing
• Firebase Cloud Messaging — push notifications

TOLOCA does not sell personal information or use data brokers.

In addition to the services above, TOLOCA records its own limited analytics (described in Section 1) within its Firebase infrastructure. In production versions of the app we also use two Google services that process data on our behalf. Google Analytics for Firebase measures how the app is used, for example which screens are opened, app sessions and whether a notification was opened. It uses an identifier for your app installation and an approximate location (country and region) that Google derives from your network address; it does not receive your GPS location, and we do not link this data to your TOLOCA account or use it for advertising. Usage analytics is on by default, and you can turn it off at any time in Privacy & Data → Usage analytics. Google Analytics keeps this data for 2 months. Firebase Crashlytics receives a report when the app crashes, containing technical information such as the error details, the app’s state, the device model and operating-system version, and installation identifiers used by the service. While usage analytics is on, a crash report may also include a short record of the screens and app events just before the crash. Crash reporting is needed to keep the app working and stays on when usage analytics is off; crash reports are kept for 90 days, after which Google begins deleting them. Because this analytics and crash data is not linked to your TOLOCA account, deleting your account does not delete it; it is removed when these retention periods end.

5. Data Sharing

TOLOCA does not sell personal information. We may share limited information with other users as part of marketplace functionality, with infrastructure providers, when required by law, or to protect safety and platform security.

Analytics reports we prepare contain only pseudonymized identifiers and aggregated data — no names, contact details, photos, messages or review text — and may be processed by a reporting service provider acting solely on TOLOCA’s behalf.

6. User Content Visibility

Some profile and marketplace content is visible to other users, including public profile information, listings, and reviews. Users should avoid sharing sensitive personal information in public areas.

7. Data Retention

We retain personal information only as long as necessary to provide services, maintain safety, comply with legal obligations, and resolve disputes.

When you request account deletion in the app, your account is scheduled for permanent deletion after 30 days, or right away if you choose immediate deletion. During the 30-day period, you can restore your account by signing in. When deletion is completed, your personal profile data, credentials, and private preferences are permanently removed and cannot be restored. Some data may be retained or anonymized:

• Reviews you wrote are displayed as “Deleted User” with your profile photo removed; the review text, rating, and review photos remain
• Completed transaction records may be retained with personal details removed. These records are designed to store internal identifiers rather than profile fields, though user-entered descriptions may contain user-provided information.
• Handover and return photos from rentals are retained as rental evidence
• Chat messages remain visible to the other participant; your name and photo are removed
• Reports, blocks placed on your account (with your name and photo removed), moderation records, and safety logs may be retained
• Deletion request records may be retained as audit trails
• Rental search analytics records are kept for up to 200 days and then deleted automatically

Some retained records may keep internal identifiers for audit, transaction integrity, or safety purposes, but the deleted user’s profile and authentication account are removed and no longer resolve to an active account.

8. Account and Data Deletion

You may delete your account at any time through the app: Settings → Privacy & Data → Delete my account. If you cannot access the app, email support@toloca.app.

Deletion covers your entire account, including both Client and Tolocan profiles. If you have active orders, bookings or rentals, deletion cannot be requested until they are resolved. In the app, deletion is scheduled for 30 days later, with an option to delete permanently right away. You can restore your account by signing in before the deletion date. Our support team responds to email requests within 7 business days.

Account deletion also removes the link between your account and your installation and acquisition information, and the rental search history recorded while you were signed in. Searches made while you were not signed in are not linked to your account; after account deletion they can no longer be associated with you, and they are deleted automatically within 200 days.

See Delete Your Account for full details.

9. Children’s Privacy

TOLOCA is not intended for children under 18. We do not knowingly collect personal information from children.

10. Security

We use reasonable technical and organizational measures to protect user information. No platform can guarantee complete security.

11. International Data Transfers

TOLOCA uses cloud infrastructure that may process information in multiple countries. By using the platform, you understand information may be transferred outside your country of residence.

12. Your Rights

Under the Data Privacy Act of 2012 (RA 10173), you may have the right to be informed about data processing, request access to personal data, request correction, object to certain processing, and request deletion or anonymization. Submit requests via support@toloca.app.

13. Changes

We may update this policy. Updated versions may be posted in the app or through official channels. Continued use constitutes acceptance.

14. Contact

TOLOCA Support
Email: support@toloca.app