Privacy Policy

1. Who We Are

SCRAPPY is operated by 9Melons Limited, a company registered in England and Wales. We provide a marketplace for scrap materials and skip hire services across the United Kingdom through our mobile applications (iOS and Android) and website at myscrappy.org.

For questions about this policy, contact us at privacy@myscrappy.org.

2. Data We Collect

Information you provide:

• Phone number — used for account creation and verification via SMS OTP
• Name — first and last name for your profile
• Email address — optional, for account communications
• Postal address and postcode — to match you with local services
• Company name — if you register as a business (collector, trader, skip company)
• Photos and videos — of scrap materials you list for sale
• Service areas — postcodes you cover (for waste collectors and skip providers)

Information collected automatically:

• Device information — device model, operating system, app version
• Push notification token — to send you real-time updates about bids and bookings
• Crash reports — via Firebase Crashlytics to improve app stability
• Usage data — pages viewed, features used (anonymised)

3. How We Use Your Data

• To create and manage your account
• To match scrap sellers with buyers in their area
• To match skip hire customers with approved local providers
• To send push notifications about bids, quotes, and booking updates
• To display your listings to potential buyers
• To process ratings and reviews between users
• To send transactional emails (booking confirmations, account alerts)
• To monitor and improve app performance and fix bugs
• To prevent fraud and ensure platform safety

4. Third-Party Services

We use the following third-party services to operate SCRAPPY:

We do not sell your personal data to any third party.

5. Data Retention

• Account data — retained while your account is active, deleted within 30 days of account deletion
• Listing photos — deleted when the listing is removed or 12 months after expiry
• Transaction history — retained for 6 years for legal/tax compliance
• Crash reports — retained for 90 days
• Push notification tokens — cleared on logout or device change

6. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data via your profile settings
• Erasure — delete your account and all associated data (Profile → Delete Account)
• Portability — receive your data in a machine-readable format
• Objection — opt out of non-essential processing
• Withdraw consent — disable push notifications in device settings at any time

To exercise any of these rights, email privacy@myscrappy.org. We will respond within 30 days.

7. Data Security

• All data transmitted over HTTPS (TLS 1.2+)
• Authentication tokens stored in device secure storage (iOS Keychain / Android Keystore)
• Passwords hashed with bcrypt (admin accounts)
• Firebase phone authentication with reCAPTCHA protection
• Rate limiting and CSRF protection on all API endpoints
• Sensitive fields (passwords, tokens) redacted from server logs

8. Children's Privacy

SCRAPPY is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

9. Cookies

Our website uses essential cookies only (session management, authentication state). We do not use advertising or tracking cookies. No cookie consent banner is required as we only use strictly necessary cookies.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via the app or email. The “Last updated” date at the top reflects the most recent revision.

11. Contact

9Melons Limited
Email: privacy@myscrappy.org
Website: myscrappy.org