Privacy Policy

• We collect what the service needs: your email, your profile, and what you post.
• We do not track your location, sell your data, or show advertising.
• We count what people do on the service (never what they write or search for) to improve it.
• You can download your data and delete your account in Settings.
• Details follow. Rayeq is responsible for your data. Contact: [email protected].

Information you give us:

• Your email address and a password (stored only as a salted hash by our sign-in provider), or your Google account's email and name if you sign in with Google.
• Your profile: username, name, optional bio, preferred language, optional city, interests.
• What you post: opinions, comments, lists, saves, follows, blocks, reports, appeals and suggestions you send, and places or products you add.
• Your settings and the version of these documents you accepted, and when.

Information created as you use the service:

• Notifications for you.
• A short-lived counter keyed by a scrambled form of your network address, to limit abuse (the address itself is not stored).
• Technical logs and error reports that we scrub of personal data, kept briefly.

We do not collect your precise location, contacts, or advertising identifiers. Places have locations; people do not.

• To run the service: show your content, personalise what you see (for example opinions from people you follow), send you in-app notifications, and let people find you and your lists.
• To keep it safe: rate limits, spam checks, reports, moderation and appeals.
• To understand and improve it, using counts of events such as "opinion published", never the content.
• To meet legal duties.

We do not sell your data and we do not use it to profile you for advertising.

We use only essential cookies: your sign-in session and your language choice. They are needed for the service to work, so there is nothing to opt out of and no cookie banner. We do not use advertising or cross-site tracking cookies.

We keep our own simple event counts (for example, that someone saved a place) and nothing from them can hold what you wrote, searched for, or where you are. We respect the Do Not Track and Global Privacy Control signals from your browser: if either is on, we record nothing. Events are deleted after 180 days.

Your profile, opinions, comments, public lists and follows are public by design: anyone can see them, including people who are not signed in, and search engines can index detailed opinions. Saves are private and only counted when many people save the same thing. Private lists are visible only to you; unlisted lists to people with the link.

Blocking someone stops interaction between you, but it does not hide public content from them.

We do not share your information with anyone else except the providers below, and where the law or a valid legal request requires it.

• **Nearby.** Your position is read only when you press "Use my location". We use it once to find places, round it to about a kilometre, and do not store it.
• **Drafting help.** When you press "Suggest tags from my text", the text you wrote is sent to an AI service (Cloudflare Workers AI) to find matching tags. It is not saved by us. Do not use it for text you would not want a service provider to process.
• **Business owners.** A person who asks to claim a place gives us a phone number and a note on how to confirm it. Only the person and our administrators see them. Details an approved owner publishes (website, phone, opening hours) and their replies are public.
• **Shared collections and questions.** People you invite can see a private collection you share with them. Questions you ask and suggestions you make are public.

We use a small number of providers to run the service. They process data on our instructions:

• Cloudflare: hosting, delivery, security and the Turnstile check that appears only when we suspect abuse.
• Supabase: our database and sign-in.
• An email provider: confirmation and security emails.
• Geoapify, when you search for a place by name: the text you type in that search box is sent to them to suggest places.
• Google, if you choose to sign in with Google.
• Sentry, for error reports with personal data removed, if enabled.

These providers may process data outside Egypt; see International transfers.

Data is encrypted in transit and at rest by our providers. Access to administration is limited, logged and requires a role; sign-in cookies cannot be read by page scripts; and our database refuses access that is not yours. Backups are encrypted. No system is perfectly secure; if something affecting you goes wrong, we will tell you and the authorities as the law requires.

• Your account and what you posted: until you delete your account.
• When you ask to delete your account, it is hidden from everyone at once and we keep it for 30 days so you can change your mind. After that it is deleted permanently. You can choose to delete immediately instead.
• After deletion we keep: moderation records that no longer identify you; places and products you added, without your name; anonymous event counts; and your username (nothing else) for 90 days so nobody else can pass as you.
• Encrypted backups are replaced within 35 days; deleted data disappears from them as they age out.
• Technical logs and error reports: kept briefly and scrubbed of personal data.
• Records we must keep by law: as long as the law requires.

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020) and similar laws, you can:

• Get a copy of your data: Settings, then Download my data.
• Correct it: edit your profile and your posts at any time.
• Delete it: Settings, then Delete my account.
• Object to or ask us to limit how we use it, and withdraw consent.
• Complain to the data protection authority.

To use a right we cannot offer in Settings, write to [email protected]. We answer within 30 days.

The service is not for people under 16. If we learn that someone under 16 has an account, we delete it.

Our providers run services in several countries. When data leaves Egypt we rely on the safeguards the law requires, such as the provider's contractual commitments and security measures.

If we change this policy in a way that matters, we will tell you before it takes effect. The version number at the top changes whenever the text does.

Rayeq, privacy questions and requests: [email protected].