Sikuruhatheby Foxora
Join free

Privacy Policy

Last updated: 24 October 2026

This Policy explains what personal data SikuruHathe (operated by Foxora) collects, why, and how we protect it. We follow the principles of Sri Lanka’s Personal Data Protection Act, No. 9 of 2022. By using SikuruHathe you agree to this Policy.

1. Data we collect

  • Account details: your name, email address, phone number, National Identity Card (NIC) number and password (stored only as a secure one-way hash).
  • Ad details: the information in your proposal, such as display name, gender, date of birth, height, religion, ethnicity, marital status, district, education, profession, hometown, personal and family descriptions, and photos.
  • Contact details you add to an ad: phone, WhatsApp, email, Facebook, Instagram and contact person.
  • Payment details: bank slip images, amount, payment date, bank reference and the package purchased.
  • Technical and security data: IP address, browser/device information, sign-in sessions, actions such as sign-ins, contact reveals and admin decisions (audit logs), and anonymous view counts on ads.

2. Why we use it

  • To create and run your account, publish and moderate ads, and show them to other members according to their membership level.
  • To verify members, keep one account per person (using your NIC), and prevent fraud, fake profiles and abuse.
  • To verify payments, activate Pro membership, and keep financial records.
  • To protect the platform: rate limits, watermarks that trace leaked photos, security monitoring and audit logs.
  • To contact you about your account, ads or payments, and to comply with the law.
  • We process data on the basis of your consent, to perform our agreement with you, for our legitimate interests in running a safe service, and to meet legal obligations.

3. Who can see your information

  • Everyone (including visitors): basic ad details and a deliberately blurred cover photo. Your NIC, account phone number and email are never shown on your ad.
  • Pro members: your full ad, clear photos (each carrying a hidden watermark tied to the viewer), and — only when they request it, within daily limits and logged — the contact details you added to the ad.
  • Our team: authorised administrators, to review ads and payments, handle reports and keep the platform safe.
  • Service providers who host and store data for us under their own security commitments: MongoDB Atlas (database), Cloudinary (image storage) and Vercel (website hosting). Their servers may be located outside Sri Lanka.
  • Authorities, banks or courts, when required by law or needed to investigate fraud or protect someone’s safety.
  • We never sell your personal data or share it for third-party advertising.

4. How we protect it

  • Contact details, NIC numbers and phone numbers are encrypted with AES-256. Passwords are hashed with Argon2. All traffic uses HTTPS.
  • Original photos are never sent to non-members; free visitors receive a blurred version created on our servers. Photos are stripped of location data (EXIF) on upload.
  • Access to data is restricted, rate-limited and logged. No system is perfectly secure, but we work hard to protect your information and will act promptly on any incident.

5. How long we keep it

  • Account data: until your account is deleted.
  • Ads and photos: until you or we remove them. Ads marked “found a partner” are hidden from the site and kept as a record.
  • Payment slips and payment records: kept permanently, even after an ad or account is deleted, because they are financial records needed for accounting, dispute resolution, fraud prevention and legal compliance.
  • Security and audit logs: about 400 days. Sign-in sessions end after 7 days of inactivity.

6. Your rights

  • You may ask to access or correct your personal data, withdraw consent, or delete your account and ads. You can edit or delete your ads yourself from My space.
  • Some data cannot be deleted when we must keep it by law or for legitimate reasons — in particular payment records, and logs needed to investigate abuse.
  • To make a request, email sikuruhatheinfo@gmail.com from your registered email address.

7. Cookies

  • We use only essential cookies: a secure sign-in session cookie, a cookie that remembers your language, and a short-lived cookie that shows confirmation messages. We do not use advertising or tracking cookies.

8. Children

  • SikuruHathe is only for people aged 18 and over. We do not knowingly collect data from anyone under 18 and will delete such accounts.

9. Changes

  • We may update this Policy. The date at the top shows the latest version, and important changes will be announced on the site.

10. Contact us

  • Privacy questions or requests: sikuruhatheinfo@gmail.com

Terms of Service →