Privacy Policy

This section is organised into the numbered subsections below.

• Full name and date of birth;
• Email address and mobile phone number;
• Profile photograph;
• Transaction history, listings, tipping records, and in-app communications;
• Your unit number, if you choose “Deliver to my unit” — kept separate from the public listing and shown only to the Acceptor of that request (and our admins); deleted if you delete the request before it's accepted, otherwise kept with the transaction record. Your device remembers your last unit number to pre-fill the next request;
• Subscription and payment information (processed by Apple App Store or Google Play — NexPick never sees your card details). We also store the app-store transaction identifiers for your purchases, to verify them, keep your subscription status up to date, and link each subscription to only one NexPick account. Purchases are made only in the mobile app — the web version has no purchases.

• A device identifier, for fraud detection and abuse prevention;
• An advertising identifier (the Android Advertising ID, or on iOS the IDFA only if you allow tracking) and ad-interaction data, collected by the Google AdMob software in the mobile app to show the optional rewarded ads described in Section 4;
• A push-notification token, to deliver notifications relevant to your account status;
• IP address and approximate location;
• App usage data and session logs;
• App integrity checks (via Google Play Integrity API on Android, Apple DeviceCheck on iOS) confirming you're using a genuine, unmodified copy of the app — no personal data is shared with Google or Apple beyond what this check inherently requires;
• Crash and performance diagnostics (via Firebase Crashlytics) when the app errors — this includes technical details like device model and an error trace, but not your name, email, or account info, and is disabled in our own internal testing builds, kept for about 90 days;
• Marketplace search terms — stored locally on your own device only (or in your browser's storage on the web version), never sent to NexPick's servers or linked to your account, and deletable by you at any time. Because this never reaches us, it isn't personal data we hold under the PDPA.
• Web version: your browser stores a little data to keep you signed in and remember your settings, and Google reCAPTCHA (which may set cookies) protects mobile number verification against abuse. App integrity checks, crash diagnostics, push notifications, and AdMob ads aren't used on the web version, so that data isn't collected there.

• Trust Score: an automatic average (0–5) of your verified ratings from other users, visible to them, and used to trigger our automated warning process (Terms of Service, Section 21);
• Review author name: shown partially masked to others (e.g. “Jas**** *an” for “Jasmine Tan”) rather than in full, as an added privacy protection for reviewers;
• Penalty stage, where applicable: your current warning stage and its dates — the internal reason is admin-only, not shown to other users;
• Merchant Auto-Accept settings, if you operate a Merchant account: whether it’s enabled and your list of pre-approved postal codes/units (up to 100);
• An active session ID, used to enforce single-device login for Basic, Member, and Admin accounts (Merchant accounts with an active subscription are exempt);
• A temporary re-registration block on your number/email for 90 days after account deletion or termination;
• Aggregate, anonymised view and copy counts on Sponsored Posts, for Advertiser reporting — never linked to any individual user;
• For Merchant subscribers: the same aggregate view/copy counts on their own Merchant Posts, visible only to that Merchant for their own reference (see Section 4.1);
• Your phone number visibility preference (whether transaction partners can see your number), your list of blocked users, and a private record of which users have blocked you — all stored as part of your account and used solely to control what's shown to other users within the Platform and to enforce blocks (including not delivering new chat messages from someone you've blocked; those messages are stored but never shown to you); none of these are shown to anyone else;
• An internal, admin-only record of changes to your email, phone, password, or profile photo, kept for security and fraud-prevention purposes and never shown to other users;
• Profile photos are automatically compressed and stripped of embedded location/device metadata (EXIF) at the point of upload — we never store or process this metadata. Before upload, the photo is checked on your device to confirm it contains a face; no facial data is collected or stored;
• If you submit a report about another user or their content (from a post, a chat, or a profile): an internal, admin-only record of the report (who reported whom, the reason, the related post where applicable, and its review status), used solely for trust and safety review — administrators are notified of new reports so they can review them promptly, and reports are never disclosed to the reported user;
• An internal record of each price negotiation on a transaction (previous and proposed prices, who requested it, the outcome), kept for 5 years under IRAS record-keeping rules and accessible only to administrators.

We use this data to: create and verify your account; facilitate transactions; prevent fraud; calculate your Trust Score and run the automated warning process; deliver notifications; provide support; manage Sponsored Posts and Merchant Posts (including performance reporting); show optional rewarded ads in the mobile app through Google AdMob; enforce our Terms of Service; investigate reports and disputes (including, where necessary, reviewing relevant chat content); and improve the Platform. We do not sell your personal data.

We may disclose your data to:

• Other users, to the extent needed for transactions and marketplace use — your name, profile photo, Trust Score and review count, verified status, Member/Merchant badges, join date, and any active warning with its stage and days remaining (never the reason); for Merchants, also your Merchant status and Auto-Accept collection points. Your email, phone number, and date of birth are never shown to other users, except that your phone number is shown to the other party of an accepted transaction if you've enabled that setting (Settings > Privacy > Show Phone Number). If you choose unit delivery, your unit number is shown only to the Acceptor of that request;
• Firebase (Google LLC) — our cloud infrastructure, authentication, database, storage, and push messaging provider;
• Google LLC and Apple Inc. — for app-integrity verification and app store subscription processing;
• Advertisers — aggregate, non-identifiable Sponsored Post performance data only, never personal data;
• Google LLC (AdMob) — IP address (approximate location), device/advertising identifiers, ad-interaction data, and diagnostics, for the optional watch-to-unlock feature (Section 4) — the ads SDK starts with the app, but ads are only requested when you choose to watch one; governed by Google's own privacy policy (policies.google.com/privacy);
• Singapore government authorities, law enforcement, or courts, where legally required;
• Professional advisers, under confidentiality obligations;
• NexPick administrators only — for user report data and, solely to investigate a report, dispute, or suspected violation, chat content; each such access is logged and never disclosed beyond the participants except where the law requires it.

Where your data is transferred outside Singapore (e.g. to Google's or Apple's infrastructure), we take reasonable steps to ensure it receives comparable protection, as required by the PDPA.

Sponsored Posts are paid placements created by NexPick administrators on behalf of Advertisers. NexPick does not use cross-app tracking in connection with Sponsored Posts, does not share identifiable user data with Advertisers, and does not use third-party ad networks in connection with Sponsored Posts. We do not ourselves profile individual users for targeted advertising — we only collect aggregate, anonymised view/copy counts for Advertiser reporting.

Separately, an optional feature (mobile app only) lets you watch a short video ad (via Google AdMob) for extra daily posts — Basic users get 1 free post plus up to 2 ads for a maximum of 3/day; Members get 3 free posts plus up to 5 ads for a maximum of 8/day. This is entirely optional and unrelated to the Sponsored Post/Advertiser relationship above; AdMob may collect your IP address, device/advertising identifiers, ad-interaction data, and diagnostics under its own privacy policy. On iOS, your advertising identifier is used for personalised ads only if you allow it in Apple's App Tracking Transparency prompt, shown the first time you choose to watch an ad; if you decline, you'll see non-personalised ads. If no ad is available, we may grant the extra post anyway.

Google and its advertising partners may use your advertising identifier to show ads based on your use of this and other apps (personalised ads). On Android, you can opt out of personalised ads or delete your advertising ID at any time in your device settings (Settings > Google > Ads, or Settings > Privacy > Ads on some devices). On iOS, you can change your choice at any time in Settings > Privacy & Security > Tracking. To learn how Google uses information from apps that use its services, visit policies.google.com/technologies/partner-sites.

All Sponsored Posts are clearly labelled "Sponsored". Sponsored Posts involve no cross-app tracking and don't use Apple's App Tracking Transparency framework — only the optional AdMob feature above does.

Beyond Sponsored Posts, the Shop tab displays two further categories, both visually distinct from Sponsored Posts and absent from the main feed by default:

• Merchant Posts — created directly by active Merchant subscribers via a self-service form, labelled "Merchant" and grouped under the heading "Merchant". Subscribers can see aggregate view/copy counts for their own posts. Posts are hidden (not deleted) if the subscription lapses, and reappear automatically if renewed; they're permanently deleted if the account is suspended or terminated.
• Local Picks — created by NexPick administrators (like Sponsored Posts), but each is labelled "Local Pick" and grouped under the heading "Local Picks". These don't involve a commercial agreement — they're content administrators consider useful to users.

None of Sponsored, Merchant, or Local Picks posts are offers you can accept through the Platform, and none form a contract between you and the Advertiser, Merchant, or NexPick.

Where we rely on your consent, you can withdraw it anytime by contacting dpo@nexpick.app. This doesn't affect processing already done lawfully. Withdrawing consent for data essential to core services (like OTP verification) may limit your ability to use the Platform.

• Account data: deleted within 30 days of account deletion, subject to legal holds; You can delete your account in the app via Profile > Settings > Delete Account.
• Push notification tokens: deleted on logout or account deletion;
• Transaction and tipping records: 5 years from the transaction date;
• Chat logs: become read-only at 12:00am Singapore time after the scheduled transaction time, permanently deleted 90 days later. During those 90 days, administrator access is only for investigating a report, dispute, or violation, and is always logged. If relevant to an ongoing dispute or legal proceeding at the end of the 90 days, we may keep it for that proceeding plus up to 2 years after;
• Account status notices: warnings, clearances, and bans (automated or admin-issued) are delivered via a single, ongoing, read-only "Admin" chat thread per user that you cannot reply to, with each new notice appended to it rather than creating a new thread. Also logged in our admin_audit records;
• Tax and financial compliance records: up to 7 years;
• Reviews (anonymised): kept indefinitely as part of our trust framework; a deleted account's reviews show as "Deleted User";
• Re-registration block (number/email only): 90 days from deletion or termination;
• Penalty stage records: for the duration of the penalty, cleared on recovery or expiry; a permanent, admin-only history of warnings/bans is kept for the life of the account and indefinitely after deletion for compliance purposes;
• App integrity check data: not kept beyond the verification session itself;
• Advertising data collected by Google AdMob: kept by Google under its own privacy policy and retention practices — NexPick does not receive or store it;
• Admin communication records: 1 year;
• Sponsored Post performance data: for the life of the post, deleted when an administrator removes it;
• Merchant Post data: for as long as the post exists — hidden if the subscription lapses, permanently deleted if the account is suspended or terminated;
• Your phone visibility preference and blocked-users list: for the life of your account, deleted when your account is deleted;
• Internal profile-change record: 2 years from each change;
• Profile photo location/device metadata (EXIF): never retained at all — stripped permanently at upload;
• User report records: 2 years from submission;
• Price negotiation records: 5 years from each entry, per IRAS requirements.

We use automated systems to calculate your Trust Score, determine your trust category, and run the warning pipeline (auto-warning → final warning → termination) based on Trust Score thresholds, clearing warnings automatically on recovery. These decisions directly affect your account standing. Separately, if you’re a Merchant who has enabled Auto-Accept, we automatically accept matching buy requests on your behalf without individual review — and this directly affects buyers whose requests are accepted this way too. We also automatically sign Basic, Member, and Admin accounts out of a device when the same account signs in elsewhere (single-device login — Merchant accounts are exempt). You can request human review of any automated decision described here by emailing legal@nexpick.app within 14 days.

You have the right to:

• Access personal data we hold about you, including your Trust Score and penalty stage;
• Request correction of inaccurate or incomplete data;
• Request your data in a portable, machine-readable format where applicable;
• Withdraw consent to specific uses of your data;
• Request human review of automated decisions affecting your account;
• Control whether your phone number is shown to transaction partners (Settings > Privacy > Show Phone Number);
• Request access to your internal profile-change history by contacting dpo@nexpick.app.

Submit requests to dpo@nexpick.app — we respond within 30 days, as required by the PDPA.

Terexa Pte. Ltd.

Email: dpo@nexpick.app

Address: 60 Paya Lebar Road, #6-28, Paya Lebar Square, Singapore 409051

We use industry-standard technical and organisational measures to protect your data, including encrypted storage, role-based access controls, secure transmission, and app-integrity verification.

Under the PDPA, a breach is notifiable if it's likely to cause significant harm (e.g. identity theft, financial loss, harassment) or affects 500+ people. We assess every incident promptly to determine if this applies.

If a notifiable breach affects you, we'll tell you as soon as practicable, by email and/or in-app notification, explaining what happened, what data was involved, the likely consequences, what we're doing about it, what you should do, and our DPO's contact details. We'll also notify the PDPC within 3 calendar days of determining a notifiable breach occurred.

If notified: change your NexPick password immediately; change it anywhere else you reuse it; enable two-factor authentication where available; monitor your financial accounts; watch for phishing (we'll never ask for your password, OTP, or financial details by email or SMS); and contact dpo@nexpick.app with questions.

Our security obligations don't extend to breaches originating from third-party infrastructure (Firebase, Apple, Google Play), your own device, or events beyond our reasonable control — though we'll still help by sharing available information and liaising with the relevant provider. Our liability for any breach remains subject to the limits in our Terms of Service.

The Platform integrates with Firebase, Apple (App Store, DeviceCheck), Google (Play Store, Play Integrity, AdMob — mobile app only), Google Maps, Google reCAPTCHA (web version only), and OneMap (Singapore Land Authority, for address lookup). NexPick isn't responsible for their own privacy practices — please review their respective policies directly.

We use device identifiers for fraud and abuse prevention. Sponsored Posts are first-party placements managed directly by NexPick — no third-party ad networks or cross-site tracking, and no Apple ATT trigger. The separate, optional watch-to-unlock feature (Section 4) uses Google AdMob, which may collect your IP address, device/advertising identifiers, ad-interaction data, and diagnostics under its own privacy policy. Because AdMob may use your advertising identifier across apps, on iOS we ask your permission through Apple's App Tracking Transparency prompt before any ad is requested; it's used for personalised ads only if you allow it. On Android, you can opt out of personalised ads in your device settings, as described in Section 4. On the web version, we store data in your browser only to keep you signed in and remember your settings, reCAPTCHA may set cookies during mobile verification, and there are no ads or tracking cookies — clearing your browser data signs you out.

Our privacy practices are disclosed in both app stores per their respective requirements. We request only the permissions our features actually need: photo library (profile photo or post photo), camera (post photos), notifications (transactional alerts), internet access, and — only if you use the optional watch-to-unlock advertising feature — App Tracking Transparency on iOS, for personalised ad selection via Google AdMob. Sponsored, Merchant, and Local Picks posts are each clearly and separately labelled, so all three remain distinguishable from organic listings and from each other at all times. The web version (app.nexpick.app) requests no device permissions — photos are chosen through your browser's file picker, and no browser notifications are sent.

The Platform isn't directed at anyone under 18, and we don't knowingly collect data from minors. If you believe a minor has registered, contact support@nexpick.app. We may suspend or terminate accounts reasonably believed to belong to someone under 18.

We may update this Policy at any time. Material changes will be communicated at least 14 days in advance via in-app notification or email. Continued use after that means you accept the update.

If you're unsatisfied with our response to a data request, you may complain to the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg or 1800-PDPA-LAW (1800-7372-529).

Terexa Pte. Ltd.

DPO Email: dpo@nexpick.app

Support: support@nexpick.app

Address: 60 Paya Lebar Road, #6-28, Paya Lebar Square, Singapore 409051

UEN: 202625140N