Rebel Shop

Privacy Policy

Last updated: 1 October 2026

Rebel Shop is a sports gear marketplace operated by Rebel Shop (rebelshop.id). This policy explains what personal data we collect, why, where it is stored, and what you can do about it.

Data we collect

  • Account: name, email address, and WhatsApp number. Passwords are stored only as a one-way hash, never in readable form.
  • Google sign-in: only your email address, name, and profile photo, plus the technical sign-in data Google provides to link your account.
  • Rekber (buyers): the name, WhatsApp number, and shipping address you enter, and the photo of your transfer receipt.
  • Sellers: store name, store WhatsApp number, pickup address, and the bank account (bank, account holder name, account number) used to pay out Rekber funds.
  • Activity: products you like, clicks on "Chat via WhatsApp" (a record of interest, not a transaction), and your Rekber transaction history.
  • Technical: your IP address is used briefly in server memory to limit excessive attempts (for example guessing codes); it is not stored in our database. Our own cookies are only for sign-in and your language choice, and we use no advertising cookies. Google Analytics sets statistics cookies on public pages (see “Google Analytics” below).

Why we use it

  • To run your account and sign you in.
  • To connect buyers and sellers through WhatsApp.
  • To run Rekber: issue invoices, match incoming transfers, forward shipping details, and pay out sellers.
  • To send service emails, such as password reset codes.
  • To prevent fraud and abuse, and to act on reports about stores.

Who can see it

  • Sellers see the name, WhatsApp number, and shipping address of buyers who start a Rekber transaction with them, so they can ship the item.
  • Transfer receipt photos are visible only to the Rebel Shop team. Sellers only see whether the transfer amount was found on the receipt, not the image itself.
  • Store names, products, and store WhatsApp numbers are public. A seller's bank account is never shown publicly.
  • We do not sell your personal data.

Where it is stored

  • Our database and file storage run on Supabase in Singapore.
  • Transfer receipts are kept in a private storage bucket. They open only through short-lived links for the Rebel Shop team.
  • Receipts are read automatically on our own server to look for the transfer amount; the image is not sent to any third-party reading service. Long digit sequences (such as account numbers) in the read text are masked before it is saved.
  • The application runs on Railway, in Singapore.
  • Emails are sent through Resend, which receives your email address and the content of the message.
  • Conversations on WhatsApp happen outside Rebel Shop and follow WhatsApp's own privacy policy.

How long we keep it

  • Transfer receipt photos: at most 1 year after the transaction ends (completed, cancelled, or expired).
  • Account data: for as long as your account is active. If you ask us to delete your account, your personal data (name, email, WhatsApp number, and other personal details) is anonymized within 30 days of the request. Transaction records are kept to meet financial obligations.
  • Financial records (Rekber transactions, seller balances, and payouts): 10 years. These records are append-only and cannot be deleted earlier, because they are needed to account for funds.

Google Analytics

We use Google Analytics for anonymous visit statistics: which pages are viewed, the type of device, and an approximate city/country. It is not used for advertising. Your personal data, chats, and transactions are not sent to Google, and pages such as your account, store dashboard, Rekber, and transactions are not tracked at all. To opt out, use the Google Analytics Opt-out browser add-on or a tracker blocker.

Your rights

You can ask to access, correct, or delete your personal data, or withdraw your consent, by emailing us at halo@rebelshop.id. Changing your WhatsApp number is not yet available in the app, so please contact us for that too. Some data, such as financial records, may have to be kept for the period stated above.

Security

Connections to our site and database are encrypted, passwords are hashed, and transfer receipts are stored privately. No system is completely secure; if we become aware of a breach that affects you, we will notify you.

Changes to this policy

We may update this policy. The effective date at the top shows when it last changed.

Contact

Questions about privacy: halo@rebelshop.id.