Privacy Policy

What data JustMess collects, why, who receives it and how to control it.

Edition of 2026-09-09

This Policy describes the processing of personal data on the JustMess barter platform, in its built-in messenger and in the Pixel Garden game. The data controller is Sharapudin Sharapudinov (an individual), 2761 Lavender Terrace, San Jose, CA 95111, USA, justapp4u@gmail.com.

The servers of the Service are located in the Russian Federation. For users in Russia, processing takes Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” into account (see section 11); for users in the EEA and the UK, section 12 additionally applies, drafted with the GDPR in mind.

This is a translation; the Russian edition prevails in case of discrepancy.

1. What we process

Account data: email address, username, display name, password hash (we neither store nor see the password itself), country, city, date of birth if you provided one, avatar, bio, language and interface settings.

Swap data: listings and their photos, the category and city of a listing, proposals sent and received, deal history, escrow operations and the fee withheld in in-app currency, saved and hidden listings, comments on listings.

Reviews and rating: ratings given and received, review texts and the public rating calculated from them.

Dispute submissions: reports about users, listings, deals and reviews, the messages exchanged in a dispute discussion and the decisions taken.

Your content: messages and attachments (photos, video, documents, voice messages, video notes), stories, profile wall entries, notes, polls, events, comments, reactions.

Voice transcripts: the recognised text of a voice message or video note, if you or another chat participant tapped «Text» under it. A transcript is stored next to the message, is available to members of the same chat and is deleted together with the message. Speech is recognised on our own server — the audio is not passed to anyone for this.

Call data: the fact, time, duration and participants of a call and technical connection parameters. We do not record or store the audio or video of calls.

Technical data: IP address, app type and version, device model and operating system, session identifier, sign-in and sign-out times, push notification tokens, approximate country derived from IP.

Usage data: activity in chats and the feed, interests and subscriptions, hidden authors and topics, in-app search history, ad impressions and clicks, achievements and statistics.

Pixel Garden data: progress, plots and plants, inventory, in-app currency balance, transaction history.

Moderation data: reports you file or that are filed about you, and the decisions taken.

We do not request or process special categories of data (health, religious or political views and the like). We do not collect precise geolocation (GPS): you choose your city yourself — see section 3.

2. Purposes and legal bases

Providing the Service — registration, sign-in, the feed of listings, messaging, calls, the game. Basis: performance of the contract (the Terms of Service) and your consent.
Running swaps — publishing listings, matching them by city, receiving proposals, holding in-app currency in escrow and calculating the fee, confirming deals and cancelling them automatically. Basis: performance of the contract.
Participant reputation — collecting reviews, calculating and displaying ratings, detecting manipulation. Without a public reputation, swapping between strangers does not work. Basis: performance of the contract and legitimate interest.
Handling disputes — a discussion involving both parties and the Administration, decisions about frozen currency, listings and reviews. Basis: legitimate interest and performance of the contract.
Security — protection against account takeover, spam, fraud and block evasion, incident investigation, sign-in and password-change alerts. Basis: legitimate interest and legal obligation.
Moderation — handling reports, restricting unlawful content and listings offering prohibited items. Basis: legitimate interest and legal obligation.
Voice message transcription — when a chat participant taps for it, we convert the speech in a voice message or video note into text and store it for the members of that chat. Without that tap no transcription happens; we never recognise speech automatically. Basis: your consent expressed by the action, and performance of the contract.
Notifications — push messages and emails about events in the Service. Basis: performance of the contract and consent; notifications can be turned off in settings.
Improving the Service — aggregate statistics, error diagnostics, performance measurement. Basis: legitimate interest.
Advertising — displaying promoted channels, profiles and listings, frequency capping, measuring effectiveness. No advertising profile is built about you: see section 5. Basis: legitimate interest.
Legal compliance — responding to lawful requests from competent authorities and retaining data for statutory periods. Basis: legal obligation.

3. City, reviews and rating — what others see

Swapping things means carrying them by hand, so the city is the feed’s primary filter. We store the city you chose and the country code, together with the city’s identifier in the open GeoNames geographical database (CC BY 4.0 licence), which lets us read place names consistently across languages and tell identically named cities apart.

you choose your city yourself from the reference list; the Service does not ask for your device’s satellite location;
your IP address is used only to derive an approximate country — for interface language and sign-in security;
your city is visible to other users on your listings, and is used to show you listings nearby;
you can change your city in settings or leave it unset, in which case the feed shows listings without a geographic filter;
the “where I am browsing right now” choice in the feed header is kept on your device only and is not sent to the server.

Your rating, your number of completed swaps and the reviews about you are public too: anyone opening your profile or your listing can see them. That is a condition of the platform working — there is no other way to judge a stranger. A review you leave is shown as coming from you.

Your swap history as such is not public: other users see aggregate figures (rating, number of deals) and reviews, but not the list of your deals or the messages about them.

5. Advertising in the Service

Advertising in the Service means promotion within the Service itself: other users’ channels, profiles and listings. We place the ad slots ourselves; there are no third-party ad networks, SDKs or pixels in the app, so advertisers get no access to your data and cannot follow you outside the Service.

What is marked as an ad. Every ad slot is labelled “Ad” and looks distinct from ordinary listings and posts. If there is no label, it is not advertising.
There is no profile-based selection. We do not build an advertising profile and do not choose what to show you based on your interests, age, gender, city or messages. Everyone sees the same queue of promoted material, ordered by the advertisers.
What is taken into account. Only two things: how many times you have already seen that material (so it is not shown again beyond a daily cap) and whether you already follow the promoted channel (in which case it is not shown to you). The impression counter is stored on the server against your account.
What the advertiser sees. Aggregate statistics only: how many times a slot was shown and how many clicks it received. They receive neither your data nor a list of who was shown the ad.
Private stays private. The contents of your messages, calls and files are never used for advertising.

If we ever introduce interest-based ad selection, we will update this section before it goes live, notify you separately and give you a way to opt out. Advertising cannot be switched off entirely in the free version of the Service.

6. How we protect data

all traffic between the app and our servers goes over HTTPS/WSS (TLS);
passwords are stored only as an irreversible hash (bcrypt);
message contents are stored encrypted in the database;
server access is restricted and key-based, and administrator actions are logged;
sensitive events (password change, sign-in from a new device) trigger an email alert, and two-factor authentication is available.

No transmission over the internet is completely secure. We apply reasonable safeguards but cannot guarantee absolute security — protect your password and enable two-factor authentication.

If data is nevertheless breached. On discovering a breach we fix the cause and then notify: the supervisory authority within 72 hours (Article 33 GDPR), Roskomnadzor within the periods set by Federal Law 152-FZ, and you personally without undue delay where the breach is likely to result in a high risk to your rights. The notice goes to the email registered to your account and says which data is affected and what you should do.

7. Retention

account data and content — while the account exists;
listings — while they are published; once withdrawn or swapped, the card remains in the deal history of the parties;
the history of completed swaps, reviews and ratings — indefinitely, because the other party’s reputation rests on them; after an account is deleted they are anonymised;
after a deletion request — a 14-day grace period (you can change your mind), then the data is erased or anonymised as described in Deleting your account and data; it disappears from backups within 30 days. If an unfinished deal, dispute or complaint exists at that moment, the data is kept until it is resolved;
technical logs — up to 12 months;
data we are required to keep by law — for the statutory period;
moderation and blocking records — up to 3 years, to prevent evasion of restrictions.

8. Your rights

You may obtain information about the processing of your personal data, have it corrected, request that it be blocked or deleted, and withdraw your consent.

Most of this is available directly in the app: edit profile data and your city in settings, withdraw a listing in your own swaps section, delete content in the relevant screen, delete the account in account settings.

Send other requests to justapp4u@gmail.com from the address registered to the account. We reply within 30 days. We may ask you to verify your identity so that data is not disclosed to someone else.

Withdrawing consent stops the processing and, as a rule, ends your ability to use the Service, because it cannot technically operate without processing data.

9. Children

The Service is not intended for children under 13. We do not knowingly collect their data. If you are a legal guardian and believe a child registered without your consent, write to justapp4u@gmail.com — we will block the account and delete the data.

Our measures against child exploitation are described in Child Safety Standards.

10. Cookies and local storage

We use cookies and browser/app storage, including to keep you signed in and to remember the city you are browsing. See the Cookie Policy.

11. Where data is processed

Personal data of Russian citizens is recorded, systematised, accumulated, stored, updated and retrieved using databases located in the Russian Federation.

The controller is an individual residing in the USA and accesses the data from there. This is a cross-border transfer, of which you are informed by this Policy; we have no other recipients of data in the USA.

In addition, cross-border transfer occurs as far as needed to deliver push notifications (Apple, Google) and to protect against automated attacks (Cloudflare), and when you use the Service from abroad.

13. Additional information for users in the United States

We do not sell personal data and do not share it for cross-context behavioural advertising — not for money, and not for any other valuable consideration. Accordingly, we do not need a separate “Do Not Sell or Share My Personal Information” link: there is nothing to sell and no one to sell it to.

California residents have the right (CCPA/CPRA) to know what categories of personal information we have collected, where it came from, what it is used for and who it was disclosed to; to obtain a copy of it; to request its correction or deletion; and to limit the use of sensitive information. We do not discriminate against you for exercising these rights: prices and features stay the same.

Categories collected, in CCPA terms: identifiers (email address, username, IP address, device identifier), customer records (city), commercial information (swap and proposal history), internet activity (actions within the Service), coarse geolocation (city), audio and visual information (photos you upload, voice messages, calls) and inferences (interests used for the feed and for advertising). The source is you and your device. Purposes and recipients are in sections 2 and 4.

Sensitive personal information (as defined by the CPRA) is collected only in the form of your sign-in credentials and used solely to provide and secure the Service — that is, within the limits in which the right to limit its use does not arise.

Send requests to justapp4u@gmail.com from the address registered to your account, or carry them out yourself in the app (see section 8). We reply within 45 days, extendable once by a further 45 days with notice. An authorised agent may submit a request on your behalf with a power of attorney.

Do Not Track and Global Privacy Control. No single standard for handling the Do Not Track signal has emerged, and we do not act on it, because we do not track you across third-party sites at all. We do honour the Global Privacy Control signal as an opt-out of sale and sharing — although no such sharing takes place in the first place.

Residents of other states with privacy laws (Virginia, Colorado, Connecticut, Utah, Texas and others) have equivalent rights: access, correction, deletion, a copy of their data and an opt-out of profiling for advertising. The procedure is the same.

14. Changes to this Policy

The current edition is always available at https://justmess.chat/privacy. We will announce material changes inside the Service or by email at least 7 days in advance.

Edition of 2026-09-09.