Privacy Policy

Last updated: 20 August 2026 · العربية

B3 complies with the Saudi Personal Data Protection Law (PDPL). Your data is never sold and never shared with a third party for marketing. You may request an export of your data or delete your account at any time. This page explains what we collect and why, what other people can see, and how your data is erased.

1. What we collect

2. What we never reach at all

3. What other users can see

4. ID photos at verification

Verifying an account is optional and requires valid ID. ID photos are stored in an encrypted space, separate from all other files, are used for review only, and are deleted the moment review completes.

5. Your listing photos, and the original

The photo you publish in a listing is shown to everyone after its location and camera data are stripped. The original as it left your device — the copy that may carry coordinates — reaches our servers for the moment of processing alone and is then deleted automatically as soon as it finishes.

No user ever sees the original. It is used for nothing except producing and reviewing the published photo, and it never enters our backups. If processing fails for any reason, it is deleted within two days at the latest.

6. Share links and preview cards

When you share a link to an item, an auction, a garage or an invitation, our servers draw a small preview image that appears inside the messaging app you shared it in. That image carries only what any visitor already sees in the app: the item's name, its price and its photo, or the garage's name. An invitation card carries the inviter's name, because the invitation is from them.

These pages and their images are open without sign-in — whoever holds the link can open it, and that is what sharing means. They never carry your phone, your email or your location. Do not share a link you would not want reaching anyone beyond the person you sent it to.

7. Reporting and blocking

8. How we use your data

We do not sell your data, and we do not share it with any third party for marketing. We use operational service providers only — Apple for processing in-app purchases, and cloud services for storage — and all of them are bound to protect your data.

9. Deleting your account

You can delete your account from inside the app at any time. The deletion is real: your data is erased from our systems immediately — name, email, phone, photos, balance and trust points — it does not appear in the app afterwards, and it is not restored if you return later. The one exception is contracts completed through the platform, which are documents between two parties and stay as they are.

When you delete your account your data is erased from our systems immediately and does not appear in the app afterwards. A copy remains in our encrypted backups for no more than 35 days and is then destroyed automatically. We use those backups only to restore service after a failure, and if we ever restore one we re-apply the deletion requests before service returns.

10. Your rights

11. Notifications

App notifications are optional and you manage them from your device settings or the app's settings. You can switch off any kind of them without it affecting your account.

To send them we keep the device token Apple gives us for that purpose alone. The token belongs to the app's copy on your device rather than to you, reveals neither your number nor your identity, is used for nothing but notifications, and is erased with your account when you delete it.

12. Children's privacy

The app is intended for those over 18, and we do not knowingly collect data from minors.

13. Updates to this policy

This policy may be updated from time to time. We will tell you inside the app about any material change, and the date of the last update always appears at the top of this page.

14. Contact us

For any question about your privacy, or to exercise any of your rights, write to us through the contact form on the site.

The contact form on this site uses Cloudflare Turnstile to tell a person apart from an automated script. It is not loaded until you actually begin filling the form in, so anyone who reads the page without writing to us never reaches Cloudflare at all. When you send your message we keep your device's IP address for two hours to stop flooding, and it appears alongside your message in our inbox. We use it for nothing else, and it expires on its own afterwards.