Privacy Policy
Last updated: 16 October 2026
This policy explains what data Gemmo collects, why, who helps us process it and where, how long we keep it and what you can do about it. We collect only what the app needs to work and keep you safe. We do not sell your data, show ads or track you across other apps and websites.
1. Who we are
Gemmo is operated by Billions Works FZE LLC, Ajman NuVentures Centre Free Zone, licence No. 2625117796888, CWS-1V-227764, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates. We decide how your personal data is processed. For any privacy question write to support@gemmo.ae.
2. What we collect
Account and sign-in
- Phone number, if you sign in with a code in WhatsApp or by SMS. It is stored encrypted, is never shown to other users and is used only for sign-in and to protect accounts.
- Apple or Google account, if you sign in with them: a technical identifier (stored only as a one-way hash), the e-mail address the provider gives us (stored encrypted, never shown and not used for marketing) and, for Apple, a token we use to disconnect Gemmo from your Apple ID when you delete your account.
Profile
- Your name and profile photo.
- Optional contacts you add for buyers: a WhatsApp number and a Telegram username.
- The categories you are interested in, to build your feed.
Listings
- Photos, title, description, price, category and condition of the item.
- The address of the item, which you choose from address suggestions. It can be an exact address or an area.
- We remove location and other hidden metadata (EXIF, GPS) from every photo you upload. We treat photos and profile pictures as personal data. We do not use face recognition.
Chats, offers, reviews and reports
- Messages and offers you send in Gemmo chats.
- Your favourites, the users you block, the reports you send and the reviews you write.
Device and security data
- An app installation ID, the Android ID on Android, and the results of device checks by Apple (App Attest, DeviceCheck) and Google (Play Integrity). We use them to fight fraud and to stop blocked users from coming back. We store device identifiers only as one-way hashes.
- A push notification token, to send you notifications.
- Your IP address and the time of sign-ins and other security events.
How you use Gemmo
- Which listings you view in the feed and for how long, listing views, taps on contacts, offers and shares, and your search queries (long numbers in queries are masked). We collect this ourselves, without third-party analytics or advertising tools.
Support
- The e-mails you send to support@gemmo.ae and our replies.
3. What we do not collect
We do not collect your device’s location, your phone contacts, your date of birth, ID documents or advertising identifiers (IDFA, AAID). Gemmo has no advertising and no tracking. Payments between buyers and sellers do not go through Gemmo, so we have no card or bank details. The website gemmo.ae uses no cookies, scripts or trackers.
4. How we use your data
- To provide Gemmo: your account, listings, the feed and search, chats, offers, favourites, reviews and notifications. This is necessary to perform our Terms of Use with you.
- To keep Gemmo safe: moderation of listings and reviews, handling reports, preventing fraud, spam and abuse, and blocking accounts that break the Rules.
- To improve Gemmo: to choose what to show in your feed and to understand which features work, using our own usage statistics.
- To answer you when you contact support.
- To meet legal obligations, including requests of the competent UAE authorities.
5. What other people see
- Your name, profile photo, rating, reviews about you and your active listings are visible to other Gemmo users.
- The feed and search show only the district of a listing. The full listing shows the exact address you chose, with a pin on the map, so that buyers know where to pick the item up. Choose an area instead of an exact address if you prefer.
- Your WhatsApp number and Telegram username, if you add them, are shown to a user who taps them on your listing or profile.
- Your phone number is never shown to other users.
- Notifications are delivered through Apple and Google. A new message notification shows the sender’s name and the first 100 characters of the message on your lock screen.
6. Moderation and chats
Every listing and review is checked by a moderator before it is published. Gemmo moderators can read any chat in read-only mode, without notifying its participants, when they review a report, a review, a user or a listing — for example, to check a fraud report. Each such access is recorded in our internal log. Moderators see phone numbers only partly masked; every full view is also logged. Automatic tools only help moderators (for example, by highlighting phone numbers and links in listings); they do not block anyone on their own.
7. Imported listings
To fill the feed, Gemmo may import listings from public Telegram flea-market groups where people offer their things for sale. For an imported listing we take the text of the post (without phone numbers, links and mentions), up to 10 photos, the author’s Telegram name and username, and the price. The listing shows the author’s name and username; “Message” opens Telegram, so the conversation takes place there. We also keep internal Telegram identifiers of the author and the post, to avoid duplicates and to respect removal requests.
To turn a post into a listing draft we may use a language model by Anthropic. It receives only the text of the post after phone numbers, links, mentions and e-mails have been masked — no names, usernames or photos.
To remove your post: open the listing in Gemmo and tap “This is my listing — remove it”. The listing is removed at once and we will not import your posts again. If you do not use Gemmo, write to support@gemmo.ae with your Telegram username and a link to the post, and we will do the same. Imported listings live 7 days; the author’s name and username are erased 30 days after a listing is closed.
8. Service providers and locations
We use the following providers to run Gemmo. Each of them processes data only on our instructions and under a data processing agreement.
| Provider | What for and what data | Where |
|---|---|---|
| Newfold Digital, Inc. (Bluehost) | Our servers: all Gemmo data (database, photos while they are processed, logs) | Servers in Germany; standby server in the Netherlands; the company is in the USA |
| Cloudflare, Inc. | Network and security: all traffic between the app and our servers passes through Cloudflare; storage of photos and profile pictures | Photos stored in the EU; temporary copies (up to 7 days) on Cloudflare servers, including in the UAE |
| Backblaze, Inc. | Encrypted backups of the database and a copy of photos | Netherlands (EU) |
| Hetzner Online GmbH | Backup recovery tests: a temporary copy of the database for a few hours, then deleted | Germany (EU) |
| Amazon Web Services | Only the encryption key that protects phone numbers and other sensitive fields; no user data | Germany (EU) |
| Meta Platforms (WhatsApp) | Your phone number and the login code, each time we send a code in WhatsApp | Outside the UAE |
| Twilio Inc. | Your phone number, to send a login code by SMS (UAE numbers) | Outside the UAE |
| Google LLC | Sign in with Google; push notifications (Firebase Cloud Messaging: sender name and the first 100 characters of a message); address suggestions (the address text you type, sent from our server without your identity); maps in the app; Play Integrity device checks | Outside the UAE |
| Apple Inc. | Sign in with Apple; notifications on iPhone; App Attest and DeviceCheck device checks | Outside the UAE |
| Anthropic PBC | Masked text of imported Telegram posts (see section 7); technical service data without personal data | Outside the UAE |
| Proton AG | Our e-mail: messages you send to support@gemmo.ae | Switzerland |
| Functional Software, Inc. (Sentry), Grafana Labs | Error reports, metrics and logs without personal data | EU |
In short: Gemmo data is stored in Germany (EU, servers), backups in the Netherlands (EU), photos in the EU (Cloudflare), with temporary copies of photos on Cloudflare servers, including in the UAE. Our hosting operator, Newfold Digital, is a US company.
9. Transfers outside the UAE
Because our servers and providers are outside the UAE, your data is transferred abroad. We do this under Article 23 of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021): the transfer is necessary to perform our agreement with you, and you give your explicit consent to it when you create an account. Our providers are bound by data processing agreements that require them to protect your data and to tell us about any breach.
10. How long we keep data
| Data | How long |
|---|---|
| Account, profile, listings, favourites | While your account exists; see section 11 for deletion |
| Exact location of a closed listing | Erased 30 days after the listing is closed |
| Chats | While the chat exists; deleted when both participants have deleted their accounts or after 24 months without activity |
| Login codes | A code expires in 10 minutes and is stored only as a one-way hash; the phone number in a login request is kept for 24 hours, the request record for 30 days |
| Sign-in and security events (IP address, device) | 90 days |
| Technical logs | 30 to 90 days; full IP addresses no longer than 24 hours, then only shortened |
| Usage statistics | 90 days; after that only anonymous totals |
| Closed reports; rejected reviews | 2 years; 1 year |
| Log of moderator and administrator actions | At least 1 year (protected copy up to 400 days) |
| Backups | Up to 14 days |
| Hashes of identifiers of blocked accounts (phone number, Apple or Google ID, device) | Phone number: 12 months from the block; other identifiers: while the block lasts and 30 days after it is lifted |
| Hashes of identifiers of deleted accounts | 90 days |
| Imported listings | Photos are deleted 30 days after the listing is closed (7 days if it was rejected); the author’s name and username are erased after 30 days; the list of authors who asked not to be imported is kept indefinitely |
11. Deleting your account
You can delete your account in the app at any time: Profile → Settings → Delete account. Deletion is immediate and cannot be undone. If you no longer have the app, see Delete your account.
When you delete your account, we erase your name, photo, contacts and sign-in details; delete the photos and texts of your listings, your favourites and your interests; and clear copies of your photos from Cloudflare. Some data stays:
- The people you chatted with keep the chat in read-only mode: you are shown as “Deleted user” and your messages as “Message deleted”.
- Reviews you published stay, signed “Deleted user”. Reviews about you are deleted.
- Your listings remain in our statistics only as price, category and district, without photos, text or anything that identifies you.
- If there are open reports involving you, the reported messages and listings are kept until the reports are closed and 30 more days, but no longer than 90 days.
- One-way hashes of your phone number, Apple or Google ID and device identifiers are kept for 90 days to prevent abuse, and longer if your account was blocked (see the table above). A hash cannot be turned back into the original number or ID.
- Backups keep deleted data for up to 14 days, after which it is gone.
12. Your rights
- Correct your name, photo and contacts in your profile at any time.
- Delete your account and data in the app at once — this also withdraws your consent.
- Get a copy of your data or ask what data we hold about you: write to support@gemmo.ae. We reply within 30 days. To protect your account, we will ask you to confirm that you are its owner by signing in to the app.
- Object or complain: write to us first; you may also contact the UAE Data Office.
13. Security
All connections to Gemmo are encrypted. Phone numbers and chat messages are also encrypted in our database, and backups are encrypted before they leave our servers. Only a small number of authorised people can access personal data, and every access to phone numbers and chats is logged. If a data breach puts you at risk, we will notify you and the competent authorities as the law requires.
14. Age limit
Gemmo is for people aged 18 and over. We do not knowingly collect data of children. If you believe a child uses Gemmo, write to us and we will delete the account.
15. Changes and contact
We may update this policy. When we make important changes, the app will ask you to accept the new version. The date at the top shows the current version. Questions, requests and complaints: support@gemmo.ae.