سیاسەتی تایبەتمەندی

Privacy Policy

When you open the optional workplace map, map tiles are requested directly from OpenStreetMap and the map library from unpkg. These providers receive network information and the viewed map area. We do not send them your name, phone number or account token. The selected coordinates are stored in your profile only when you submit/save the form.

When social sign-in is enabled, Karama stores provider account ID, available name, verified email and photo link, provider type, and registration/login times. We never receive Google or Apple passwords. Phone numbers are not required at sign-in.

Profiles, uploaded profile photos, requests, messages, complaints, feedback, category suggestions and favorites are stored on Cloudflare. Search coordinates are used on-device; submitting a professional profile sends workplace coordinates for review and publication after approval. Approved professionals' business contact details and portfolio links are public. Apple refresh tokens are encrypted on the server to revoke access when you delete your account; other provider tokens are used for verification and are not retained; application session tokens are stored hashed on the server and encrypted on-device. Browser OAuth flows expire after ten minutes; social sessions expire after thirty days.

In the Android and iOS apps, open Settings → Delete account to permanently remove your account, uploaded photos, requests, messages, feedback, complaints, favorites, and submitted professional profile. Sign in with Apple again if prompted so authorization can be revoked. You may also contact the team in Messages for privacy questions or deletion assistance. Account records remain until deletion. Google/Apple and Cloudflare process data under their own policies.

Provisioned test accounts authenticate with a username and access code. Only a cryptographic digest of the access code is retained in server configuration; it is never embedded in the app. These accounts use the same customer features and deletion process. For abuse prevention, the server stores short-lived hashes derived from network addresses and login attempt counts. Rate-limit records expire after two hours and are removed during subsequent rate-limit cleanup.

For support or privacy requests, email dvstick20@gmail.com. To request deletion without the app, visit Delete your KARAMA account. The app does not use advertising or analytics SDKs. Data is transmitted over HTTPS. Professional profile details are published only after submission and administrator approval; private feedback and messages are available to the administration team.