Last updated: 30 October 2026

Privacy policy

Khomo Market operates an online marketplace for buyers and sellers. This notice explains how the marketplace operator handles information and how to contact us about privacy.

Information we receive

We receive information you provide, such as your name, email or phone number, district, addresses, profile photo and store details. Marketplace records may include listings, orders, bids, offers, messages, saved items, reviews and support or dispute information associated with your account.

Google & Facebook

Google sign-in supplies a name, verified email and account identifier. Facebook Login uses the basic-profile permission and Khomo stores your name and app-scoped Facebook identifier; it does not request Facebook email, phone number, friends, posts or messages. We do not receive your Google or Facebook password. Facebook access tokens are used on the server to validate sign-in and fetch the name and identifier, then discarded rather than saved to your account.

How we use information

We use information to create and secure accounts, display listings, connect buyers with sellers, operate orders and marketplace features, handle requests and disputes, prevent abuse and understand site performance. We do not sell personal data.

Visibility and service providers

Listings, stores, published reviews and seller responses are public. Private messages and collection or delivery details are available to the relevant participants and authorised staff as needed. Render hosts the website; Supabase provides database and photo storage. Google and Meta process sign-in under their own policies. Loading externally hosted product or marketing images may also share connection information, such as your IP address, with the image host. Providers may process information outside Malawi.

Cookies and browser storage

Essential cookies maintain sign-in and protect authentication. Remembered sessions expire after 30 days; signing out revokes that session. Browser storage holds preferences such as theme and language and may hold searches, recently viewed items and shopping preferences. You can clear site storage through your browser. Site analytics record page and performance events using a daily hashed visitor identifier. Analytics older than 30 days are removed when new analytics events are processed. Hosting providers may also keep operational connection and security logs.

Payments and communications

Live payments are currently unavailable on this test site. When payment or notification services are connected, relevant transaction or contact details are shared to provide the requested service, and provider disclosures will be updated. Khomo must never receive mobile-money PINs, bank passwords or card security secrets.

Retention and security

We retain information while needed for accounts and marketplace operations and to handle outstanding orders, disputes, fraud concerns and applicable obligations. Retention and deletion depend on the record and the reason it is needed; request a review if you want details removed. Backups and operational logs may follow the provider’s retention cycle. Safeguards include HTTPS, protected session cookies, server-side role checks and restricted storage access; no online service can guarantee absolute security.

Your choices and privacy contact

You can edit profile details in Profile settings, sign out or clear browser storage. To request access, correction or deletion, or ask a privacy question, use our privacy-request form. Requests are queued for manual review and may require ownership verification; never send passwords, payment PINs or identity documents in the form. Removing Khomo in Facebook does not itself delete Khomo records.

Updates

We update this notice when the service or its data practices change. The date above identifies the latest revision.