Security and privacy
Kept on record. Not kept forever in full.
A purchase register has to prove who sold a phone without turning into a database of everyone’s Aadhaar. This is how Recashy draws that line.
ID numbers
- When a shop records an ID, only its type and last 4 digits are stored.
- To recognise a repeat seller, a one-way fingerprint of the number is kept (an HMAC-SHA256 digest with a secret key). It cannot be turned back into the number.
- The full Aadhaar or ID number is never stored anywhere.
Verification codes
- Before a purchase record opens, a one-time code goes to the seller’s own mobile number.
- Codes expire, wrong attempts are counted, and sending is rate-limited per shop.
- The code only verifies a number. It is never used to take or send money.
Photos
- Photos of a handset, the seller or an ID are stored outside the public website folder.
- Only the signed-in shop that filed a record can open its photos.
- Every time an ID-proof photo is opened, it is written to an audit log.
Records
- A filed record is locked. It cannot be edited or quietly deleted.
- Corrections are filed as a new record linked to the original.
- Each record carries the next number in that shop’s register, so gaps are visible.
Between shops
- Each shop sees only its own records, customers and stock.
- The repeat-IMEI check tells a shop only how many other dealers recorded a handset, never which dealers or who sold it.
- In the dealer market, other shops see a lot’s handsets and price, not your purchase records.
Accounts and connection
- Shops sign in with Google. Recashy never stores a shop password.
- All pages are served over HTTPS.
- Admin access is limited to a fixed list of Recashy staff accounts.
Found a security problem?
Write to support@recashy.com with the details. Please do not test against real shops’ data.
The legal version
Read the privacy policy and terms of use.
Selling a phone? Protect yourself too.
Reset it, sign out of your accounts, and keep your record number.