Privacy

Who is responsible

Locals Only, Tbilisi, Georgia, is responsible for your personal data. Questions about it go through our contact page; we answer by email.

What we collect

• Your account: email, username, display name and password (stored only as a secure hash).
• Your orders: name, phone, delivery address, notes, what you bought and the payment result.
• Payments: the bank tells us whether a payment succeeded and a masked card number (like •••• 9893). We never see or store your full card details.
• What you post: community photos, captions, comments and reactions, and messages you send us.
• Cookies: only the ones that keep you signed in. Your bag is saved in your browser on this device. We don’t use advertising or tracking cookies.

Why we use it

• To take payment, ship your order and email you about it.
• To run your account and the community feed.
• To answer your messages.
• To keep the records that tax and accounting law require.

We don’t sell your data, and we don’t send marketing email unless you ask for it.

Who else sees it

• Bank of Georgia, to take your payment.
• The courier who brings your parcel: your name, phone and delivery address.
• Vercel, which hosts the website; Supabase, which hosts our database and files; and Resend, which sends our emails.
• Authorities, when the law requires it.

How long we keep it

Account data stays until you delete your account. Order records are kept for as long as Georgian tax and accounting law requires, even after an account is deleted. Messages you send us are deleted once they’re no longer needed to help you.

Your rights

Under the Law of Georgia on Personal Data Protection you can ask to see, correct or delete your data, or object to how we use it. You can edit or delete your account yourself from your account page. If you think we handle your data wrongly, you can complain to the Personal Data Protection Service of Georgia.