Privacy policy

Last updated: 27 Oct 2026

This policy explains what information QuickSell collects, how it is used and what you can control. It covers the QuickSell website (quicksell.pk) and the QuickSell Android app (pk.quicksell.app).

What we collect

• Account details: your name, email address and city. If you create an account with a password, we store the password only in a hashed form.
• Sign in with Google (optional): if you use Google sign-in, Google tells us your Google account ID, your email address and your name. We use them to create or find your QuickSell account. Google may also include a profile photo in the sign-in token, but QuickSell does not save or use it.
• Private mobile number (optional): after Google sign-in, or in your account, we may ask for your mobile number. It is stored on your account and used for account purposes only (for example account security and support). It is private: it is never shown on your ads, on public pages or to other users.
• Ad details: the text, price, location and photos of the ads you post. The Android app uploads photos only (up to 8 per ad). The website can also take a short video.
• Contact choice for each ad: the contact number you type on an ad, and whether you turned Call and WhatsApp on. The Call and WhatsApp buttons on your ad show buyers the contact choice you made for that ad, and only when they tap a button.
• Support tickets: when you contact support from your QuickSell account (website or app), we store your ticket (subject, category, your messages, an optional link to one of your ads and up to 2 screenshots you attach) together with our replies and the date and time of each message. Internal staff notes about a ticket are visible to staff only, never to you or other users. You see the ticket and our replies in your account, and we also email you each reply.
• Reports and blocks: when you report an ad or a seller, we store your report (the reason and any note you write) so our team can review it. If you block a seller, we store that choice on your account so their ads are hidden from you. You can unblock in Account settings.
• Push notifications (Android app): if you allow notifications, the app uses Firebase Cloud Messaging (a Google service). We store the device's notification token with your account so we can tell you, for example, that your ad was approved or rejected. Signing out of the app removes that token from our server.
• Two-factor login (optional for sellers, required for staff): if you turn on two-factor login, we store an encrypted authenticator secret (authenticator app method), your chosen method, and 8 recovery codes in a hashed form. When you choose the email method, we email you a 6-digit code that expires after 10 minutes and works once. We do not log the codes.
• Usage details: pages you visit, your IP address, browser type and device, collected to keep the site secure and working well.

How we use it

• To run your account and show your ads.
• To let buyers contact you through the Call and WhatsApp buttons you choose to turn on for your ad.
• To sign you in, protect your account (including two-factor login) and send important account emails such as verification codes.
• To send push notifications about your ads, if you allowed them.
• To review ads and reports, prevent fraud and spam, and enforce our rules.
• To reply to your messages and support tickets, and to email you when we reply to a ticket (the email does not contain your phone number and you log in to the site or app to answer).

Sharing

We do not sell your personal information. Sellers choose whether to show a contact number for Call and WhatsApp on each ad: the number a seller types on the ad is shown to buyers only when they tap Call or WhatsApp, and only if the seller turned those options on. Your private account mobile number is never shown, and is never used as an ad contact number.

We use Google (sign-in) and Firebase Cloud Messaging (push notifications) to provide those features, so some data passes through Google for that purpose. We may also share information with other service providers that help us run the site, or with authorities when the law requires it.

Cookies

We use cookies on the website to keep you logged in, remember your preferences and understand how the site is used. The Android app does not use browser cookies; it keeps your sign-in token in the phone's secure storage.

Your choices

You can edit your profile, delete your ads, turn two-factor login on or off (staff accounts must keep it on), remove your private mobile number, unblock sellers you blocked, or delete your account at any time. You can also ask us to correct or delete your information.

Deleting your account

You can delete your account yourself, in the QuickSell app (Account, then Delete account) or on the web at https://quicksell.pk/delete-account. You confirm with your password, or with a 6-digit code we email to you if you signed in with Google or forgot your password. You can also email support@quicksell.pk from your account address.

• Deleted straight away: your name, email address, phone number, city, profile photo, your two-factor secret and recovery codes (they are part of your account), all your ads with their photos and videos, your saved ads, ad reports you sent, your blocked-seller list, contact-form messages sent from your email, your support tickets with their replies and screenshots, and your sign-in sessions, app tokens and push-notification registrations.
• Kept: a short, non-identifying log line that an account was deleted (date, method and number of ads, with no name, email, phone number or IP address). Routine server security logs and backups may hold copies for a limited time until they are rotated out automatically (our own database backups are kept for 7 days); we do not use them to restore deleted accounts. We also keep information we are required to keep by law or for an investigation.
• Ads you delete yourself while keeping your account are held for 30 days and then removed permanently.
• Staff accounts and accounts that are currently suspended or banned cannot be deleted automatically. Email support@quicksell.pk for help.

Data retention

• Account data (your profile, ads, photos, saved ads, blocked-seller list and support tickets) is kept while your account is active and is deleted when you delete your account (see "Deleting your account" below).
• Search: we do not store what you type into the search box.
• One-time codes: email codes expire after 10 minutes and work once. Expired codes and password-reset tokens are deleted automatically within about a day.
• Server logs: our application logs are deleted automatically after 14 days, and are never kept longer than 90 days. Our hosting provider may also keep routine web-server logs for a short period under its own schedule.
• Backups: we take an automatic database backup every night and keep the last 7. Older ones are replaced automatically. Occasional manual safety copies made before maintenance work are deleted automatically after 30 days at most.
• Security and moderation records (for example approvals, bans and security events) are kept for as long as we need them to run and protect the service. When you delete your account, the IP address and device details are removed from the records that mention you.

Contact

Privacy questions? Email us at support@quicksell.pk or use our contact form.