This Privacy Policy applies to the SlopMart website and to SlopMart mobile applications when their connected features are available. The website is a static product preview; it does not host live auctions, accounts, or checkout. The mobile app may run in a local demo mode or connect to a Firebase-backed service. Where a feature has not launched, this policy does not imply that it is already collecting data.
At a glance. Real users create, bid on, and buy virtual items with marketplace credits. Account and transaction records support that social game. Optional store purchases add AI creation capacity, not marketplace credits. The connected mobile app uses Firebase Analytics to measure screens and aggregate feature interactions; analytics events exclude email, handles, user-entered text, and marketplace record identifiers. The current website does not include advertising or first-party analytics scripts. No physical address is needed for fictional delivery.
Who operates SlopMart?
SlopMart is operated by Tortuga Co & Development, TOO, based in Kazakhstan. For questions or privacy requests, email the official SlopMart inbox at [email protected].
What data may be processed?
| Category | Examples and source | Visibility |
|---|---|---|
| Account and profile | Firebase user ID, email address or provider account information, display name, pseudonymous handle, and account creation time. | Account data is restricted; the profile handle can be visible to signed-in users. |
| Marketplace content | Item titles, descriptions, traits, author and owner handles, auction and SHOP prices, bids, comments, reviews, and ownership history created by users or generated from their input. | Listings, bid records, visible comments, reviews, and item history can be read by signed-in users. |
| Game economy and deals | Marketplace-credit balance, holds and ledger entries, deal participants, checkout and shipment status, fictional waybill text, virtual tracking events, and a game delivery address made from a user-selected real city plus a server-generated fictional street, building, and postal code. | Wallet and saved game-address records are restricted to their owner. A confirmed game-address snapshot and deal records are restricted to the two deal participants. |
| Store purchases | Store product, transaction, purchase, refund, entitlement, and related account or app identifiers processed through Apple or Google and RevenueCat for optional AI creation packs. | Restricted billing and audit records are used to credit non-transferable creation capacity, prevent replay, and handle refunds. They are not public marketplace records. |
| Safety reports | Reporter handle, lot or comment identifier, report reason when provided, and moderation status. | Restricted to the service team and systems, not shown in the marketplace. |
| App usage analytics | Mobile app screen views and aggregate actions such as sign-in method, lot category and duration, bids, comments, credit claims, and virtual checkout. Analytics events do not contain email, handles, user-entered text, or marketplace record identifiers. | Processed by the operator and Google Firebase to understand app usage and improve the product. |
| Technical data | Authentication and App Check signals, network requests, service logs, device or browser information needed to deliver and protect the service. | Processed by the operator and service providers, subject to their roles. |
Authentication providers such as Apple or Google may give Firebase the information required for the sign-in method you choose. SlopMart does not receive your password from those providers. If you use email/password registration, Firebase Authentication processes the credentials.
Why do we use this data?
- To create an account, identify the user who owns an item, and maintain accurate creation and marketplace-credit balances.
- To publish lots, record real user bids and SHOP purchases, settle virtual deals, and preserve item provenance.
- To validate optional AI creation-pack purchases, prevent transaction replay, apply refunds, and keep billing audit records.
- To show sellers and buyers their fictional shipment, unboxing, reviews, and collection history.
- To receive reports, moderate harmful or prohibited listings, prevent abuse, and protect the service.
- To operate, secure, troubleshoot, and improve the website and connected app.
Where applicable law requires a legal basis, these uses generally rely on providing the service you request, legitimate interests in security and moderation, compliance with legal duties, or your consent for an optional feature that specifically asks for it. Consent is not treated as a substitute for a separate choice when one is required.
What other users can see
SlopMart is a social marketplace. Signed-in users may see the handle attached to a listing, a bid, a comment, a review, or an item’s ownership history. Avoid putting private contact information, a real-world address, or another person’s personal information in public content. The backend rejects common contact patterns in lot text, comments, waybills, and reviews, but no filter can guarantee that every issue is caught.
When an account is deleted, the active profile and wallet are removed and open auctions are cancelled. Existing items and past deals may retain a pseudonymous handle and transaction history so the item’s story and other users’ records remain coherent. Deleting an account is therefore not the same as erasing every public record involving that account; contact us if a retained record contains personal data that needs review.
Photos and AI features
In the connected app, you can request an editable lot draft from a text idea and, optionally, a photo of an ordinary object. The app uploads a selected photo to Firebase Storage under your account. A server function reads and deletes that uploaded source photo, then sends the idea and any photo to Google's Gemini and Vertex AI services to review the concept, generate an item image, and draft listing details. Generated item images are stored in Firebase Storage; an image attached to a published lot may be visible to other users. The draft is not published until you choose to publish it. The local demo uses templates and does not upload photos or call AI services.
Service logs, generated drafts, usage records, and stored images may be retained according to the purposes above and the retention section below. Do not upload another person’s photo or confidential material unless you have the right to use it. AI results may be inaccurate or resemble existing material and should be reviewed before publication.
Optional profile photos
You may choose a profile photo in the connected app. The selected image is uploaded to a temporary Firebase Storage path, checked by a server function, and saved as your profile photo. The temporary copy is deleted after processing. Your photo is visible to signed-in users beside your handle on profiles, lots, bids, comments, and reviews. Unlike a photo used to create a lot, a profile photo is not sent to Gemini or Vertex AI by this feature. You can replace or remove it from your account screen; deleting your account removes the stored profile photo. Do not choose an image you do not have permission to share.
Advertising in the mobile app
Mobile versions that show advertising use Google AdMob to support the service. Ads are labelled and appear in the marketplace feed. SlopMart requests non-personalized ads; this does not mean that no data is processed. Depending on platform, permissions, and privacy choices, Google Mobile Ads may process IP addresses (which can indicate an approximate location), device or app identifiers, ad views and interactions, crash logs, and performance information to deliver and measure ads and prevent fraud. SlopMart does not send account email, handles, lot text, or photos as ad targeting parameters.
Google's User Messaging Platform presents consent or privacy choices where required. Ad requests wait until the platform permits them. Where available, you can reopen the form from Account → Advertising choices. Declining personalized advertising does not prevent use of the marketplace. We do not request precise device location for advertising or present an Apple tracking-permission prompt in this integration. See How Google uses advertising data and Google's Privacy Policy. Advertising is not enabled in the local demo or on this website.
Who helps provide the service?
SlopMart uses Google Firebase services for authentication, database records, server functions, app integrity checks, mobile app analytics, and static hosting. Apple and Google may act as sign-in providers and operate their respective in-app purchase systems. RevenueCat helps present store products and validate purchase, entitlement, and refund events for optional AI creation packs. These providers can process technical, usage, account, identifier, diagnostic, and purchase data under their own terms and privacy notices. Google AdMob provides advertising in mobile versions that enable it, as described above. Firebase and RevenueCat provide the separate service and purchase functions described here.
The public website serves fonts and images from its own host. It has no first-party analytics or advertising scripts in the current build. The hosting provider may process standard request and security logs needed to deliver the site.
How long is data kept?
We keep account and marketplace data while needed to operate the service and resolve transactions, reports, security incidents, or legal requests. When you delete your account in the app, Firebase Authentication deletes the sign-in account and a server process removes the active profile and wallet. Open auctions are cancelled. Pseudonymous item and deal history may remain for provenance and other participants. Service logs and backups follow provider and operational retention cycles. We will review specific deletion requests against these needs and applicable law.
Game delivery addresses and shipments are fictional. Detailed address lines, seller signatures and seals, and private waybill text are removed asynchronously after 30 days from actual delivery or deal closure. For older records without a reliable completion date, this period starts at the first server inspection. Item provenance, participants, city or settlement, route and tracking events remain. Account deletion queues removal of details from completed deals; details needed for active deals remain until the deal finishes. Queue delays may postpone completion of removal.
Copies of detailed delivery addresses in request receipts are also removed asynchronously after 30 days from receipt creation, or from the first server inspection for older receipts without a reliable date. Your current game address and seller marks remain profile settings until replaced or your account is deleted. This cleanup does not delete the item, deal history, or financial and purchase records required to prevent duplicate processing.
How is data protected?
Client access to the connected database is restricted by sign-in and record-level rules. Bids, balances, ownership changes, and deals are written through authenticated server functions rather than direct client writes. No system can promise absolute security. If you believe there is a security issue, contact [email protected].
International processing
The operator is based in Kazakhstan and its providers may process data in other countries. Where transfer safeguards are required, we rely on the arrangements applicable to those providers and the relevant law. The location of a database does not mean that authentication, support, or security processing is confined to that location.
Your choices and rights
You can delete your account from the app, subject to any reauthentication required by your sign-in provider. You can also email [email protected] to ask about access, correction, deletion, restriction, objection, or a copy of your data where these rights apply. We may need to verify that a request comes from the account holder. You may also complain to the relevant data protection authority where applicable.
To stop optional notifications, use device or app controls when those features exist. This website currently has no marketing subscription form.
Age and children
SlopMart is not intended for children under 13. A higher minimum age may apply under local law or the applicable storefront. Users below the age of legal majority must have permission from a parent or legal guardian as described in our Terms. We do not knowingly collect personal data from children under the applicable minimum age. If you believe such a child has created an account, contact [email protected] so we can review and take appropriate action. This policy does not claim that an automated age-verification system is implemented.
Changes to this policy
We may update this policy as the product develops, especially before enabling new photo, AI, analytics, or monetization features. The updated date will appear on this page. When a change materially affects active users, we will give notice through a suitable channel where required.
Contact
Operator: Tortuga Co & Development, TOO, Kazakhstan.
Privacy contact: [email protected].
Related terms: SlopMart Terms of Service.