1. Introduction
BulBul.af (“we”, “us”) is operated by Pixels Clinic. We respect your privacy and only collect what we need to run the marketplace. This policy explains what we collect, how we use it, and the choices you have.
By using BulBul.af you agree to the practices below. If you don’t agree, please stop using the service.
2. Information we collect
We collect three kinds of data:
- Account details — name, email, phone number, password (hashed), date of birth, gender, bio, profile photo. You give us these directly when you register or edit your profile.
- Listing content — text, images, price, category, location, and any other detail you post in an ad.
- Usage data — IP address, browser type, pages visited, listing views, search terms, messages exchanged with other users, and timestamps. Collected automatically as you browse.
- Device + cookies — see the Cookie Policy for details.
3. How we use your information
- To create + secure your account.
- To show your listings to buyers and route their messages back to you.
- To verify your identity (email + phone OTP) and award the Verified Seller chip.
- To detect fraud, scams, and policy violations.
- To send notifications you opted into (new matches on saved searches, replies to your chats, support replies).
- To improve the platform — which categories perform, which provinces have demand, etc.
We never sell your personal data. We never share it with advertisers.
6. How long we keep your data
- Active accounts — kept indefinitely while you continue to use the site.
- Deactivated accounts — kept for 30 days. If you log back in during that window the account reactivates. After 30 days we scrub personal details (email, phone, DoB, gender, bio, avatar) but keep the listing rows for audit. Hourly cron handles this.
- Listing data — stays even after a listing is marked sold or expired, so disputes can be investigated. We can purge it on request.
- Messages — stored as long as both participants have active accounts.
- Server logs — typically 90 days, then rotated.
7. Your rights
You can:
- Access + correct your data anytime through /profile.
- Download a copy of everything we hold about you — email us at privacy@bulbul.af.
- Deactivate your account from the profile page. After the 30-day grace it’s permanently scrubbed.
- Ask us to delete a specific listing.
- Opt out of email notifications from notification settings.
- Block another user.
We respond to data requests within 30 days.
8. Security
Passwords are hashed with bcrypt. Authentication uses bearer tokens (Laravel Sanctum). Sensitive endpoints are rate-limited to discourage brute-force. Uploaded images go through our optimiser (PHP-GD → WebP). The site runs over HTTPS in production. Daily database backups via spatie/laravel-backup.
That said, no online platform is bullet-proof. Don’t share your password, use a unique one, and tell us right away at security@bulbul.af if you suspect your account is compromised.
9. Children
BulBul.af is intended for adults. You must be at least 18 to register. Users under 13 must not use the site. If we learn we’ve collected personal data from a child under 13 without parental consent, we delete it.
10. International transfers
Our primary servers are in Afghanistan / regional data centers via Hostinger. Some service providers (Firebase, Sentry) process data in other countries under their own privacy frameworks. By using BulBul.af you agree to these transfers.
11. Changes to this policy
We’ll post any change here and flag a banner on the site for material updates. The “Last updated” date at the top tells you when the policy last changed. Continuing to use BulBul.af after a change means you accept the updated version.
12. Contact us
Questions about this policy or your data? Email us at privacy@bulbul.af. For general support, head to /support.