Privacy Policy

Last updated: October 16, 2026

This Privacy Policy explains how Mahdi Saifullah Srizan (operating as Bitflecks) (“we”, “us”, or “our”) collects, uses, and shares information when you use the Messtro mobile app and this website (together, the “Service”). Messtro helps a shared household or hostel (a “mess”) pool its food and bills, track meals, and keep a shared ledger. By using the Service you agree to this policy.

1. Information we collect

We collect only what we need to run the Service:

Account & profile. When you sign in with Google, we receive your name, email address, profile photo, and a Google account identifier. If you sign up with email instead, we receive the name and email address you enter and the password you choose — the password is held by Firebase Authentication and never visible to us. You can add a phone number to your profile. We use these to create and secure your account and to show you to the members of your mess.
Mess content you create. Information you and your mess add — member names, emails and phone numbers, meal records, deposits and withdrawals, bills, payments, one-off expenses, notes, and the resulting balances/ledger. This is largely financial record-keeping about your shared household. A mess can also save contact details for people who aren't members — such as the cook, the landlord, or a shop the mess buys from on credit (name, phone number and a note) — which only that mess's members can see.
Photos you upload. A profile photo you choose, and photos you attach to a board post. They are stored with our hosting provider (Firebase Cloud Storage). Your profile photo is shown to other signed-in users who see you — chiefly the members of your mess; a board post's photos are shown to anyone signed in who views the post.
Premium purchase details. If you buy Premium through the Google Play Store or Apple App Store, the purchase is processed by Google or Apple and by RevenueCat, our subscription-management provider — they receive a purchase/subscriber identifier linked to your account and mess (so the right mess is granted Premium), your purchase/subscription status, and price. If you buy Premium on this website instead, we collect the plan selected and the payment proof you enter — the mobile number you paid from and the bKash/Nagad transaction ID — solely to verify and apply your payment.
Premium Perks claims. If your mess wins a perk and the manager claims it, we collect the link to the post sharing the win and the bKash/Nagad number to pay — solely to verify the claim and send the credit — and the manager's agreement to have the mess named publicly, which claiming requires. We name a winning mess only with that consent. See the Premium Perks rules.
Location (optional). The app reads your device's location only when you ask it to — tapping “Use current location” to place the mess or a post, or choosing “Near me” on the boards — and only with your permission. It never reads your location in the background. What happens to it depends on where you used it:
- The mess's location is saved on the mess and is visible to its members. A manager can remove it in Mess settings at any time.
- A seat listing (advertising a vacancy in your mess) shows as much of the mess's location as the poster chooses: the exact spot, only the nearby area (the centre of an area roughly 1 km across — the exact point is not stored), or nothing but the written address. The nearby area is the default. Cook entries and buy & sell posts show the area the poster chose — starting from the mess's location, or where they are when they post — and never store an exact point: only the centre of an area of roughly 5 km, so a reader learns the neighbourhood and not a home.
- “Near me” searches send only an approximate area (about 1 km across, plus the areas around it) to find listings nearby. It is used to answer that search and is not saved.
To show a place name instead of coordinates, your device's built-in geocoding service (Google on Android, Apple on iOS) looks the coordinates up.
Feedback & support. When you send feedback from the app, we store your message together with your name, email address, account and mess identifiers, your role in the mess, its plan, and your app version and platform, so we can understand and act on it. If you email us, we receive what you send, including your email address.
Notifications. A device push token (via Firebase Cloud Messaging) so we can send you relevant alerts, such as approval requests and reminders. You can turn off notifications in your device settings.
Technical & diagnostic data. Standard information our infrastructure provider records to operate the Service reliably and securely, such as device/app version, approximate timing of requests, and error logs — including crash reports (via Firebase Crashlytics: crash stack traces, device model, and OS version) and anti-abuse/bot-protection signals (via Firebase App Check), tied to your device rather than your identity.
Account app activity. We record your account's latest reported app-use time, app version and build number, and platform (Android or iOS) to help with support and understand app updates. Reports are sent when you use the app online, normally at most once every 24 hours per device and when the app version changes. Only our operators can view these reports; other users cannot. We keep the latest report, not a login or device history, and remove it when your account is deleted.

2. How we use your information

Provide the Service and sync your mess's data across its members' devices.
Authenticate you and keep accounts and data secure.
Calculate meals, bills, balances, and monthly summaries.
Show listings on the boards, and find the ones near you when you ask.
Verify and apply Premium payments, and manage entitlements.
Send operational notifications you've enabled.
Respond to support requests and prevent abuse or fraud.
Comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

3. How your information is shared

With your mess. Data you add to a mess is visible to the other members of that mess — that is the core purpose of a shared ledger. The mess manager can manage members and records.
With other users, on the boards. A listing you post — a seat listing, a cook entry or a buy & sell post — can be seen by anyone signed in to Messtro, including its location as described in Section 1. You choose to publish it; nothing is placed on a board automatically.
Service providers. We use Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Crashlytics, and App Check) to host data, run the Service, and keep it secure and stable. Your data is processed on Google's infrastructure under their terms and security controls. We send account emails — address verification, password reset, and password-change notices — through Resend, which receives your email address and the message for that purpose only. Email to our support address is routed by Cloudflare and handled in Google's Gmail.
Purchases. An in-app purchase is processed by Google Play or the Apple App Store, and managed for us by RevenueCat, our subscription-management provider — see “Premium purchase details” above for what they receive. A web purchase's payment proof is reviewed (by us and via mobile-financial-service transaction records) only to confirm your payment.
Legal reasons. We may disclose information if required by law or to protect the rights, safety, and security of our users or the Service.

4. Data retention & deletion

We keep your information while your account and mess are active. Detailed month-by-month records may be retained for a limited window (which can vary by plan) and older raw detail is pruned once a month is closed, while summary balances are carried forward. You can leave a mess or, if you are the manager, delete the entire mess — deleting a mess removes its records.

Listings on the boards expire on their own within 45 days, and you can close them sooner. Deleting a mess also takes down its seat listings, and deleting your account removes the cook entries and buy & sell posts you posted. A post's photos are deleted with the post, and your profile photo with your account. Feedback you have sent is kept to improve the Service; ask us and we will delete it.

You can delete your account in the app (More → Delete account), or ask us to. Either way we can only delete an account that no longer belongs to any mess, so you'll be asked to leave each one first — that is what keeps the remaining members' accounting consistent. Deleting your account removes your sign-in account, your central profile (name, email, phone, photo), your notification tokens and any undecided join request.

Two things deliberately outlive it. Each mess you belonged to keeps its own member record with your name, email and phone as they were, so the balances other members still rely on stay attributed to a person rather than a blank; those go when that mess is deleted. And we keep the email address of any account that has used a free trial, indefinitely and for no other purpose, so the same address cannot claim repeat trials. Beyond those, we may retain limited records we are required to keep for legal, security or fraud-prevention reasons — for example, a completed payment. Our deletion page sets this out in full.

5. Your rights & choices

Access and review your data within the app.
Correct information you've entered, or ask us to help.
Leave a mess, or delete a mess you manage.
Turn off push notifications in your device settings.
Refuse or withdraw location permission in your device settings — the app still works, you just type an address instead.
Request deletion of your account and personal data by emailing us.

Depending on where you live, you may have additional rights (such as access, correction, deletion, or objection). Contact us to exercise them.

6. Security

Access to data is restricted by authentication and server-side security rules, and traffic is encrypted in transit. No method of transmission or storage is 100% secure, but we work to protect your information and limit access to what each member is permitted to see.

7. Age eligibility & teens' privacy

The Service is available to users aged 13 and older. It is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13 — if you believe a child under 13 has provided us information, contact us and we will delete it.

If you are between 13 and 17, you may use the Service only with the involvement of a parent or guardian, who should agree to these Terms and this Policy on your behalf and is welcome to review your mess activity with you. We collect the same limited information described in Section 1 from a teen user as from an adult — nothing extra, and never for advertising; the Service shows no ads and none of your data is used for third-party advertising or tracking.

8. International data processing

Our infrastructure is hosted with Google in the Asia-Southeast (Singapore) region. If you use the Service from another country, your information may be processed in locations outside your own, with appropriate safeguards from our provider.

9. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and significant changes may be communicated in the app or on this site.

10. Contact us

Questions about this policy or your data? Email us at support@messtro.app.