Privacy Policy

QawaDoz helps people find cafés in Erbil. This policy explains exactly what the app stores, why, who else sees it, and how to have it removed. It is written to match what the software does — if you find a gap between the two, tell us and we will fix whichever is wrong.

Without an account

You can browse cafés, menus, the map, events, jobs and the coffee guide without an account, and we store nothing that identifies you. If you use “Near me”, your position is used as described under Your location.

Your account

• Signing up with email or phone: your name, and your email address or phone number. Your password is stored only as a bcrypt hash, which cannot be reversed.
• Signing in with Apple or Google: we receive your name, your email address (with Apple, it can be a private relay address that hides your real one) and an identifier for your Apple or Google account. We never see your Apple or Google password. For Apple we also keep a token that lets us tell Apple when you delete your account.
• Optional: a profile photo, and your preferred language.

What you do in the app

When you are signed in, we store what you create or choose:

• Ratings and reviews — stars, the parts of the visit you scored, the words and any photos you add.
• Saved cafés, and your café passport: the cafés you marked “Been here”, the days you were there, and the cafés you plan to visit with the day you chose.
• “I’m here” check-ins: which café, and when. A check-in ends by itself after two hours and is deleted a day later.
• Events you sign up for — the name and phone number you give, the number of seats and any note — and jobs you apply for — your name, phone number, years of experience and your message.
• Table bookings, where a café takes them — the contact name, phone number, date, party size and any note.
• Cafés you suggest we add, with what you tell us about them.
• People you hide or report, and what you write in a report.
• Your notifications — the messages in the app’s inbox.

Photos you upload are re-encoded on our server before they are stored, which removes the hidden data a camera adds — including where the photo was taken.

How the app is used

Unless you turn it off, the app tells us — and only us — how it is used, so we know what to make better and can show each café how many people found it:

• Which screens are opened, which cafés are viewed and what is tapped on them (call, directions, menu, share and the like), the words of a search and how many results it found, the filters used, and which coffee guide drinks, events and jobs are opened.
• When the app is opened and for how long, the app’s version, the phone’s system version and model, and the app’s language.
• A random number the app makes when it is installed, so a phone is counted once. It is not an advertising identifier and says nothing about the phone itself; deleting the app forgets it. When you are signed in, this is linked to your account.

It never includes your location, anything you type into a form, your contacts or your photos. To stop it, turn off Profile → Settings → Share usage statistics: nothing at all is recorded or sent while it is off, and what had not been sent yet is dropped.

Your location

The app asks for your location only while you are using it, and only the first time you use a feature that needs it. You can say no, and everything else still works. It is used for:

• “Near me” and distances — your position is sent to sort cafés by distance. It is not stored, and it is blanked out of our server logs.
• Your dot on the map — drawn on your phone by the map.
• “I’m here” and “Been here” — your position is checked once, at the tap, to confirm you are at the café (within about 150 metres). The position is not stored; only the café and the day are.
• Suggesting a café you are standing in — only if you turn on “I’m at this café now”, your position is saved with the suggestion as the café’s location, so our team can find it. It is never shown to other people.

The app does not track your location in the background, and we never keep a history of where you have been.

Who’s here

Each café page shows how many people pressed “I’m here” in the last two hours, and how many plan to come this week. These are only numbers.

Your name appears only if you turn on Show me at cafés, which is off until you choose it. Then people who are signed in see your first name, your photo, how many cafés you have verified stamps from and how many days you have been to that café. Never your full name, contact details, gender, or the hour you plan to come. You can turn it off at any time, and you can hide or report anyone — once you hide someone, neither of you sees the other.

Security, notifications and crashes

• Sign-in sessions record the device description and IP address, so a session can be recognised and signed out.
• Notifications: if you allow them, we store the push token your device issues. It identifies the device, not you. Reminders for a day you planned are set on your phone itself.
• Crash reports: when the app or our server fails, a report is sent with the device model, system and app version and what the software was doing. It does not include your name, email, phone number or location.
• Server logs record each request and the IP address it came from, to keep the service running and to stop abuse. They are overwritten automatically within days.

What we do not collect

• Advertising or tracking identifiers. There are no ads and no third-party analytics or tracker in the app; the usage statistics above go only to us, and are never used for advertising. We do not track you across other apps or websites.
• Your contacts, photos library or microphone. When you add a photo, you pick that one photo; the app sees nothing else.
• Payment details. Nothing is sold in the app and no card is ever handled.

Who else sees it

• Everyone sees a review you publish, with your name and profile photo.
• Signed-in people see your first name at a café only if you turned on Show me at cafés (see above).
• A café sees what you send it: an event sign-up, a job application or a booking — the name, phone number and details you gave. That is the point of sending it.
• A café’s owner sees numbers about their own café — how many people opened its page, called, asked for directions or saved it — never who.
• Our team sees what is needed to run the service: to answer suggestions and support requests, to review reports, and to understand how the app is used.
• Service providers who process data for us and for no one else: Google draws the map (it receives the map requests your device makes) and runs Firebase Cloud Messaging, which delivers notifications; Apple and Google confirm a sign-in when you use them; an email provider delivers sign-up and password emails; Sentry receives crash reports; and our hosting provider runs the servers and stores photos.

We do not sell your data, and we do not share it with anyone not named above.

Reports and safety

You can report a review, or a person in Who’s here. Reporting also hides them from you at once. Our team reviews every report, normally within 24 hours, and removes content or closes accounts that break our terms.

How long we keep it

• Account details: until you delete your account.
• “I’m here” check-ins: a day after they end.
• Sign-in sessions: until they expire or you sign out.
• Notifications in the app’s inbox: six months.
• Usage statistics: 90 days in detail; after that only which days a phone used the app is kept, for 13 months.
• Push tokens: until the device stops being used or notifications are turned off.
• Server logs: overwritten automatically within days.
• Backups: overwritten after 30 days.
• Reviews, bookings, event sign-ups and job applications are part of a café’s history. After you delete your account they remain without your name or phone number — see below.

Deleting your account

In the app: Profile → Delete my account. It takes effect immediately:

• Your name, email, phone number, password and profile photo are erased.
• Your saved cafés, passport, plans, check-ins, notifications and the people you hid are deleted, and Show me at cafés is turned off.
• Upcoming bookings and event places are cancelled, and job applications nobody has answered yet are withdrawn.
• Bookings, event sign-ups and job applications a café keeps no longer show your name or phone number.
• Every session is signed out, your devices stop receiving notifications, and if you used Sign in with Apple, we tell Apple to disconnect the app.
• Reviews you wrote stay on the café, shown as “Deleted user”.
• Usage statistics are no longer linked to you: they remain only as counts nobody can trace back to you.

Full details, and what to do if you cannot open the app.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to qawadoz@omarmukhtar.me and we will answer within 30 days.

Children

QawaDoz is not meant for children under 13, and we do not knowingly create accounts for them. If you believe a child has an account, write to us and we will remove it.

Café information

The café listings — names, locations, opening hours and amenities — come from OpenStreetMap (Open Database Licence) and Overture Maps, and are corrected by hand and by the cafés themselves. This is public information about businesses, not personal data.

Changes

If this policy changes in a way that affects you, the app will say so before the change takes effect. The date at the top always shows the current version.

Contact

qawadoz@omarmukhtar.me