Privacy policy

JustSell buys, repairs and resells consumer electronics in India. This policy covers the JustSell website and the JustSell apps for iOS and Android.

JustSell is the trade name of a proprietorship registered in Karnataka. The proprietor is the data fiduciary for everything described here, under India’s Digital Personal Data Protection Act, 2023. Our legal name, principal place of business and GSTIN are at the foot of this page and on every page of the site.

To identify you. A mobile number or an email address — whichever you sign in with. We never ask for a password and never store one. Sign-in uses a one-time code, held only as a cryptographic hash, valid for ten minutes, usable once.

To value your device. The model and storage size, and your answers to the condition questions. In the apps, the on-device diagnostic also produces readings — whether the touchscreen responded across the display, whether a played tone was heard by the microphone, whether each camera produced a live image, whether the motion sensors and biometric hardware responded, and the battery’s charge level. Those readings are sent with your valuation and stored against it, so the person who collects the device can check the grade against what the phone measured rather than take it on trust.

To collect and pay for it. A name, a contact number for the visit, and either a collection address or the counter you have chosen to bring it to. Your chosen settlement method.

To keep your history. Your valuations, orders and repair bookings.

To see how the site and apps are used. The website uses Google Analytics and the apps use Google Analytics for Firebase, both provided by Google. They record which pages or screens are opened and a few actions — a listing viewed, a valuation or repair priced, a booking or order placed with its reference, category, model and amount, and whether you signed in by email or phone — together with your device and browser type, an approximate location Google derives from your IP address, and an identifier Google’s tools keep on your browser (a cookie) or device.

We do not send them your name, email address, phone number, address or payment details. The pages reached from a deletion or newsletter email, whose links carry your email address, do not run analytics at all, and neither does a page whose address contains an email address or phone number — a search for one, for example. Google processes this data under its own terms. You can block it with Google’s Analytics opt-out browser add-on or a content blocker; the rest of the site works the same without it.

The camera test captures frames from each lens, measures whether the sensor produced a live image, and discards them immediately. They are never shown to you, never written to storage and never uploaded. The speaker test plays a tone and measures its loudness through the microphone; the recording is discarded the moment the measurement is taken. No photograph and no audio recording ever leaves your device.

We also cannot read your serial number, IMEI or device UDID. Apple closed that to third-party apps in iOS 7 and Android restricted the equivalent in Android 10. Any service claiming to read them is either asking you to type them in or is managing your device.

We do not take card numbers, bank credentials, UPI PINs or net-banking logins. We are paying you, not charging you: your payout details are taken at collection by the person handling the device, and are not entered into the app. Anyone asking you for a PIN or an OTP for your bank in our name is not us.

We do not sell your data, and we do not share it with advertising networks or data brokers.

Transactional messages — a sign-in code, a collection confirmation, an erasure certificate — are part of the service and are sent because you asked for something. Marketing is separate, defaults to off, and stays off until you turn it on. You can change it at any time in Account → Preferences in the app, and withdrawing consent is as easy as giving it.

Sign-in codes expire in ten minutes and are deleted on use. Sessions expire and can be revoked by signing out.

Records of a completed transaction — what we bought, what we paid and where we collected it — are kept while we are required to keep them under Indian tax and accounting law, and for as long as any warranty or dispute on that transaction can still be raised. We do not delete them on a timer, and we would rather say so than describe an automatic erasure we do not perform.

You can delete your account from Profile → Your data in the app, or Account → Security on the website; you can also request deletion without signing in at justsell.co.in/delete-account. In-app deletion is immediate when there is no active order or repair and no positive vault balance. Public requests are email-verified and reviewed by our team. Account data, quotes, saved addresses, sessions and non-completed repair bookings are removed; retained order, collected-repair, payment and wallet ledger records are unlinked from your account and their direct contact details are removed. Wallet transaction amounts, methods and dates remain for accounting, while free-text titles are replaced with a generic label. Retained business records do not currently have an automatic expiry. A non-identifying completion record and withdrawn-consent suppression state may also remain. See deleting your data for the deletion blocks and retention details.

Under the DPDP Act you may ask us for a copy of what we hold on you, ask us to correct anything wrong, ask us to delete it, withdraw a consent you gave, and nominate someone to exercise these rights if you cannot. Write to us and we will answer.

The site and apps talk to us over HTTPS only. Session tokens are stored as hashes rather than as the tokens themselves, so a copy of our database is not a set of live logins. Staff passwords use a memory-hard hash. Staff access is graded by role, and every change a member of staff makes to a price, a booking or an account is recorded with who made it and when.

No system is perfect. If you believe your account has been accessed by someone else, write to us and we will revoke every active session on it.

JustSell is not for under-18s. We do not knowingly collect data from a child, and selling a device to us requires an adult.

If we change this policy we will change the date at the top. If a change materially affects what we do with your data, we will tell you rather than rely on you re-reading the page.