RYCA Development Privacy Notice
Local development testing only. This is not RYCA's final launch privacy policy.
This notice describes the User Module's current development behaviour. The full marketplace policy, including Orders, payments, hosting providers and support procedures, remains pending review before launch.
Account information
RYCA stores account names, email addresses, registered mobile numbers when provided, internal account identifiers, contact verification status and account timestamps. Passwords are stored as hashes, not readable passwords.
Verification codes
Verification records include the delivery destination, channel, purpose, code hash, expiry time, attempt count and verification or invalidation timestamps.
Security and sessions
RYCA records login and account-security events. Login History stores hashed login identifiers, IP addresses and session keys, together with limited browser information and event timestamps. Hashing does not make these records anonymous. Browser information is supplied by the browser and may be inaccurate.
Session cookies support authentication and session-related features. Security controls include inactivity timeout, session revocation and login or password-reset throttling. Throttle records use hashed keys.
Preferences and terms records
RYCA stores promotional email and WhatsApp preferences, the latest preference submission time, and the version and time of explicitly accepted development terms. Promotional preferences default to off. Terms acceptance does not enable promotional messages.
Development delivery and logs
The current local email backend prints email messages to the development console. The temporary WhatsApp sender prints the destination and readable OTP when DEBUG is enabled. These outputs may contain personal information and codes. Use disposable test data and do not share console output containing active codes.
Hashed Login History fields do not mean that raw information is absent from every request, session, console output or server log. Production delivery and logging configuration must be reviewed before launch.
Administrative access
Administrators with the relevant permissions can inspect account, verification and security records and perform permitted account-moderation actions. Certain fields are read-only in Admin, but read-only does not mean hidden.
Deactivation and retention
Deactivation disables account access; it does not delete the account or its records. Eligible accounts can be reactivated through the available workflows.
Cleanup utilities exist for expired incomplete registrations and old Login History. Their existence does not guarantee automatic deletion: execution and scheduling must be configured. Final retention periods and deletion procedures remain pending review. Development test records may be changed or removed during testing.
Before launch
RYCA must publish a reviewed policy describing its actual production processing, service providers, applicable retention arrangements and contact procedures. Viewing this notice does not create a consent record or subscribe you to promotional messages.