Privacy Policy

In plain English

Saamman is a classified ads marketplace for Pakistan — on the website saamman.com and in the Saamman mobile app on Google Play (package com.saamman.app). You can browse listings, post an ad, save favourites, chat with a buyer or seller, and manage a profile. This page is the honest version of what happens to your information while you do that — whether you use the site or the app.

We are not a shop. We do not take the buyer’s money and pass it to the seller. If you buy a phone or a car through an ad on Saamman, that deal is between you and the other person. We store the account, the ad, and the messages that make that possible.

Who we are

Saamman is operated from G-9 Markaz, Islamabad, Pakistan. When this page says “we” or “us”, it means the people behind saamman.com.

Questions about privacy go to saamman.com@gmail.com. Everyday support goes to the Contact Us page.

What you give us

Most of what we hold is information you typed in yourself.

When you create an account

You can register with email or continue with Google. Depending on how you sign up, we may store:

• First name, last name, and gender
• Email address and a Pakistan mobile number (03XX-XXXXXXX)
• A password, stored in hashed form — we cannot read the original
• A profile photo, if you upload one
• Date of birth, bio, timezone, and display preferences, if you add them later

If you join with Google, Google sends us enough to recognise you — usually your name and email. What Google keeps on their side is covered by their own policies, not this one.

When you post an ad

A listing can include a title, description, price, category, condition, photos, and a location. For some categories we also ask for extra detail — for example PTA status on a mobile, or rooms on a property. On the mobile app you pick photos from your device gallery. That content is stored so other people can find and read the ad.

When you use chat, contact us, or subscribe

• Chat messages between you and another user, tied to the listing you were talking about
• Name, email, subject, and message if you write to us through Contact Us or the report form
• An email address if you subscribe to the newsletter from the footer or from your profile
• Notification choices: email, SMS, push (on the app or website where offered), and which newsletter topics you want

If you turn on two-factor authentication, we store a secret used only to check the codes from your authenticator app. We do not see those codes unless you type one to turn 2FA on or off.

When you allow location on the mobile app

On Android (and iOS where offered), the app may ask for location permission when you use “Use my current location” while posting an ad. If you allow it, we read your approximate device coordinates once to help fill the city or area on that listing. You can always type a location manually instead. We do not track your movements in the background for advertising.

What we collect ourselves

Some records are created by the site as you use it, not by a form you filled in.

• Login session. Access and refresh tokens, plus a small snapshot of your account, are saved on your device — in the browser’s local storage on the website, or in the app’s secure on-device storage — so you stay signed in.
• Recently viewed ads. Kept on your device so the “recently viewed” strip can work. That list does not go to our servers.
• Favourites. Which ads you saved, stored against your account if you are signed in.
• Visit records. On some API requests (website and app) we store the IP address that reached our servers, a rough location (city, region, country — not your street), the address or screen that was called, the time, and how often that IP has shown up. We use this to understand traffic and to look into abuse. Location is looked up from the IP using MaxMind GeoLite2 data.
• Chat reports. If you report someone from a conversation, we keep who reported whom, and the reason.
• Listing reports. If you report an ad (from the website or the app), we keep the details you submit so our team can review it.
• Push notification devices. If you allow notifications and stay signed in, we store a device push token (for example a Firebase Cloud Messaging token), the platform (Android, iOS, or web), an optional app-generated device id, and when that device was last seen. We use this only to deliver alerts about your account — such as chat messages and other in-product notices — not to sell ads.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. Some place names come from GeoNames, licensed under CC BY 4.0.

How we use it

We use this information to:

• Run the marketplace — accounts, ads, photos, search, favourites, and chat
• Show your public listing to other people, including your name, photo, location, and phone number if you added one
• Send account emails such as verification and password reset
• Send newsletters and optional notifications (email, SMS, or push), only where you asked for them or granted OS permission for banners
• Deliver push alerts for chat and similar account activity to devices you registered while signed in
• Reply when you contact us or report an ad
• Filter offensive language on contact and support messages
• Spot spam, fake ads, and other abuse
• Keep the website and app working and understand which parts people actually use
• Comply with Pakistani law if we are required to

We do not sell your personal information. We do not rent your phone number to marketers.

What other people can see

An ad is public. Anyone on the internet can read the title, photos, price, description, and the area you listed. They can also see the name and photo on the seller card, and they can reveal the phone number you attached to the listing.

Chat is not public. Only you, the other person in that thread, and — if a report is filed — our team can see those messages.

When we share it

We share information only in these situations:

• With other users, as described above — that is the point of a classified ad.
• With companies that help us run the marketplace, such as Google for sign-in, Google Firebase Cloud Messaging (to deliver push notifications to your device), email delivery, cloud hosting, and app distribution on Google Play. They get only what they need to do that job — for example, Firebase receives the push token and the notification content we ask it to deliver.
• With Pakistani authorities, if the law requires it — for example a lawful request under the Prevention of Electronic Crimes Act, 2016, or a court order.
• If Saamman is sold or merged, account and listing data would move with the business. We would still expect the new owner to treat it with the same care.

Cookies, browsers, and the mobile app

On the website we rely mainly on local storage in your browser for login and recently viewed ads.

You can clear site data in your browser. That will sign you out and wipe the recently viewed list on that device. The ads and account on our servers stay until you change or delete them.

In the mobile app, login tokens and similar preferences are stored on the device by the app (not in a web browser). Clearing the app’s data or uninstalling the app removes that local copy. Signing out also clears your session on that device.

Mobile application

The Saamman Android app (Google Play package com.saamman.app) uses the same backend and the same kinds of personal data as the website: accounts, listings, photos, chat, favourites, notifications, and reports. This section also describes device permissions the app may request. Declining a permission may limit that feature; the rest of the app still works.

• Photos / media. The app may ask for access to photos on your device so you can set a profile picture or add images to an ad. We do not use the camera unless you later choose a feature that needs it.
• Location. Optional. Used only when you tap “Use my current location” on Post Ad, to help fill the listing location. You can enter a city or area by hand instead.
• Notifications. Optional. On Android 13 and newer the system asks for notification permission so we can show banners for chat and other account alerts. If you allow it while signed in, we register a push token with our servers and deliver messages through Google Firebase Cloud Messaging. You can deny permission, turn notifications off later in your phone’s Settings → Apps → Saamman → Notifications, or sign out (we stop targeting that device).
• The app talks to our servers over HTTPS. Technical visit data (such as approximate location from IP) may be recorded as described above. That is separate from optional GPS location for posting an ad.
• Google sign-in in the app is handled by Google’s SDK under its own policies. We receive the account details needed to recognise you on Saamman.
• You can delete your account from the app under Settings → Delete account, or by emailing us. Closing the account removes associated device push registrations we no longer need.
• You can report a listing from the ad screen in the app, and report or block a user from chat.

How long we keep it

We keep your account and ads while the account is open. If you delete an ad, it is removed from public view. If you ask us to close the account, we delete or anonymise what we no longer need, unless we have to keep a record — for example a fraud report or a legal hold.

Visit records and support messages are kept only as long as they are useful for running the site and handling complaints.

Push device tokens stay linked to your account while the device is active. We deactivate or remove them when you sign out from that device, when the token is rejected by the push provider, or when the account is closed.

How we look after it

Passwords are hashed. On the website you can add two-factor authentication from your profile. Access to our systems is limited to people who need it to do their job.

No online service is perfectly safe. If you think someone else is using your account, change your password and write to us. Turn on 2FA on the website if you have not already.

Your choices

You can:

• Edit your name, phone, photo, and address from your profile
• Turn email, SMS, and newsletter topics on or off in Settings
• Allow or deny push notification permission in the OS settings for the Saamman app (or browser prompts on the website where push is offered)
• Deny or revoke location or photo access in the OS settings; you can still type a location and use features that do not need those permissions
• Unsubscribe from a newsletter using the link in the email
• Delete or edit your own ads
• Block or report a user from chat
• Report a listing from the ad page (website or app)
• Ask us for a copy of what we hold, or ask us to correct it
• Close your account from the mobile app (Settings → Delete account), from your website profile where available, or by emailing saamman.com@gmail.com

We will need to confirm it is really you before we delete an account when you contact us by email. In-app deletion uses your signed-in session. Some records may remain if the law says we must keep them.

Under 18

Saamman is for adults. You must be 18 or older to create an account or post an ad. If you believe a child has given us personal information, email saamman.com@gmail.com and we will look into it.

Pakistan law

Saamman is based in Pakistan. This policy is meant to be read with Pakistani law, including the Prevention of Electronic Crimes Act, 2016 (as amended). That law deals with things like unauthorised access, identity theft, and certain kinds of harmful online content. It is a criminal statute, not a full privacy code.

Pakistan does not yet have a standalone personal data protection act in force. We still tell you what we collect and we still let you ask for access, correction, or deletion, because that is the decent way to run a marketplace — not because a European-style privacy statute currently applies to us.

If a Pakistani court or a lawful authority asks for information, we may have to provide it. This policy is governed by the laws of Pakistan. The courts in Islamabad have jurisdiction over disputes about it.

If this page changes

If we change how we handle information in a way that actually matters, we will update this page and the date at the top. Keep an eye on it if you use Saamman regularly.