Privacy policy

1. Who is responsible for your data

Coding Legends (Private) Limited, of 298/34, Edirisingha Mawatha, Malwana, Biyagama, Sri Lanka, operates Vikka at https://vikka.codinglegends.io and is the controller of the personal data described here. Questions, requests and complaints go to apps.codinglegends@gmail.com.

2. What we collect

When you create an account

• Your name, and your email address or mobile number.
• A password, stored only as an irreversible hash. We never hold the password itself.
• Your district and city, if you give them, and your language preference.

When you post or browse

• Your listings: titles, descriptions, prices, photographs, and the town you select.
• Items and searches you save, so we can tell you when something matching them is posted or drops in price.
• Messages you exchange with other users through Vikka.

When you buy or sell

• Delivery addresses, orders, returns and disputes.
• Wallet balances and payout requests, including bank account details for sellers, encrypted, and never shown back to anyone but you.

When you verify your identity

Sellers may be asked for an identity document. The document is stored in a private location that is never publicly readable, the identity number is encrypted, and nothing in the platform can decrypt it. A reviewer reads the number from the document in front of them. Every staff access is recorded against the person who made it.

Technical data

• Your IP address and browser user-agent, kept with your sign-in sessions so you can see and end them.
• Diagnostic reports when something breaks. Request bodies are dropped entirely before a report leaves the server, and authentication headers are redacted.

3. Card details: we never receive them

Payments are taken on the payment provider's own hosted page. Your card number, expiry and security code are never sent to Vikka, never stored by us, and never written to any log or error report. We receive only a confirmation that a payment succeeded or failed, and a reference for it.

4. Why we use it, and on what basis

• To provide the service. To run your account, publish your listings, carry your messages, take orders and pay sellers. This is necessary to perform our agreement with you.
• To keep the platform safe. To screen listings and messages for fraud and prohibited content, and to act on reports. This is our legitimate interest in a marketplace people can use safely.
• To meet legal obligations, including identity records, and financial and tax records.
• With your consent, recorded at registration against the version of this policy you agreed to (currently 2026-09-24). You can withdraw it by closing your account.

5. What other people can see

This matters more on a marketplace than the list above, so it is set out plainly.

• Public to anyone: your listings, the town you chose, your display name and public handle, your seller rating and reviews, and your shop's details if you have one.
• Shown only when you choose: your phone number on a classified ad, revealed to a buyer who asks. Each reveal is recorded.
• Shared with the other party to a transaction: your delivery address and contact details go to the seller you bought from, and a seller's details go to the buyer.
• Never public: your email address, your password, your identity document, your bank details, and your private messages.

6. Who we share it with

• Our payment provider, to take payments and make payouts. They receive what they need to process the transaction and are responsible for the card data we never see.
• An SMS provider and an email provider, to deliver one-time codes and notifications. They receive the destination and the message, nothing more.
• Our hosting and storage providers, who hold the data on our behalf and act only on our instructions.
• Authorities, where the law requires it.

We do not sell your personal data, and we do not share it with advertisers.

7. Cookies

Vikka sets three cookies, all strictly necessary. There are no advertising or tracking cookies.

• vikka_at and vikka_rt keep you signed in. Both are httpOnly, so no script on the page can read them.
• vikka_cart holds a basket for a visitor who has not signed in, so it survives a page reload. It is claimed by your account when you sign in.

8. How long we keep it

• Your account and the things only you rely on are deleted when you close your account: saved items, drafts, sessions and blocks.
• Records somebody else relies on are kept, detached from your name: orders, messages in a conversation, reviews and financial entries. They are the other party's record as much as yours and are needed to settle a dispute.
• Identity documents are kept for six years after your account closes, then destroyed. That period is Sri Lanka's Financial Transactions Reporting Act No. 6 of 2006, which requires records of identity to be kept for six years from the end of the business relationship. The record that a check was done survives; the document and the identity number do not.
• Financial records are kept as long as tax and accounting law requires.

9. Your rights

• A copy of your data. From your settings, at any time. It is produced immediately and lists what it excludes and why.
• Deletion. From your settings. Your account is anonymised, the data only you rely on is deleted, and your uploaded photographs are removed from storage.
• Correction of anything inaccurate, from your profile or by writing to us.
• To object or withdraw consent, and to complain to Sri Lanka's Data Protection Authority.

If you cannot reach your account, because you have lost access or it has been suspended, email apps.codinglegends@gmail.com and we will handle the request by hand. We have to satisfy ourselves who you are first, because deletion cannot be undone.

Deletion is refused while an obligation is outstanding: an order still in progress, a payout still pending, or money still in your wallet. A right to erasure is not an escape from an obligation to somebody you have dealt with. You will be told which one applies.

10. Security

• Identity numbers and bank account details are encrypted where they are stored.
• Sign-in cookies cannot be read by any script on the page.
• Two-factor authentication is available on your account, and we recommend it.
• Staff actions on accounts, money and identity documents are written to a record that cannot be edited or deleted.

11. Children

Vikka is not for people under 18. If we learn that an account belongs to a child, we will close it and delete the data we are not required to keep.

12. Changes

We will publish any change here and update the version. Where a change is significant, we will ask you to agree to it again. This is version 2026-09-24.

13. Contact

Coding Legends (Private) Limited, 298/34, Edirisingha Mawatha, Malwana, Biyagama, Sri Lanka. apps.codinglegends@gmail.com, +94 74 206 4801.