Privacy Policy
Mazad Syria ("we", "us", "the app") respects your privacy. This Privacy Policy explains the personal data we collect, why, how we use and protect it, and the rights you have over your data. It complies with the Apple App Store Review Guidelines and Google Play Developer Program Policies.
1. Data we collect
Account data. When you register we collect your name, email address, optional phone number, and a password (stored as a bcrypt hash — never in plaintext).
Profile data. An optional profile picture, a short bio, and your governorate/city if you set them.
Listing data. Title, description, price, category, condition, images, contact phone (per-ad opt-in), governorate, neighborhood, and — if you drop a pin on the interactive map — an approximate latitude/longitude used only to render your pin.
Camera & photo library. With your explicit permission we access the camera and photo library ONLY when you tap "add photo" while posting an ad or setting a profile picture. We use MediaTypeOptions.Images exclusively: the app does NOT read video or audio and does NOT request microphone permission at all.
Image processing & storage. Photos are resized/compressed on-device before upload and then stored on our servers (MongoDB Atlas) as base64 blobs attached to your listing or profile.
Chat messages & reports. Messages you send in the in-app chat are stored so the recipient can read them. We do NOT generally monitor conversations. A specific conversation is reviewed by our moderation team ONLY when a participant reports it via the in-chat "Report" button, and only for the purpose of responding to that report. Moderation decisions and report records are kept as an audit trail.
In-app purchases. When you buy a "Featured listing" (24 hours / 7 days / 14 days / 30 days), the entire transaction is processed by Apple App Store or Google Play. We never see or store your card number or payment credentials — we only receive the store's transaction identifier (Transaction ID / Purchase Token), the price, and the verification status. We keep these records to activate the feature, to reissue receipts on request, and to resolve disputes.
Technical & security logs. We keep short-lived server logs (IP, request type, status code, timestamp) for service operation, abuse mitigation, and brute-force protection on login. They are automatically deleted after at most 90 days.
What we do NOT collect. No IDFA / GAID. No cross-app/website tracking. No third-party analytics, advertising, or attribution SDKs.
2. How we use your data
- To operate the marketplace (show listings, deliver messages, activate Featured ads).
- To let other users contact you via the phone number you choose to expose per ad (opt-in).
- To keep the platform safe: review reports, apply bans, remove offending content.
- To send essential service notifications (password reset, email verification).
- To verify purchase receipts against Apple / Google servers before granting the Featured status.
We do NOT sell your data. We do NOT profile you for advertising. We do NOT show an App Tracking Transparency (ATT) prompt because we do not track you.
3. Data sharing
- Other users can see your public listings, display name, location details you chose to publish, and (if you enabled it) your contact phone.
- Our moderators see only reports and message threads that were flagged via the in-app "Report" button.
- Apple and Google receive the payment data required to process In-App Purchases (per their respective policies).
- We disclose data to authorities only when compelled by valid legal process.
4. Storage & retention
Data is stored on our servers (MongoDB Atlas) for as long as your account is active. When you delete your account (Profile → Delete account) we perform an irreversible cascade delete within at most 30 days covering: your user record, all your listings, all your favorites, every chat thread you participated in, every report you filed, and every purchase record tied to your account. There is no soft-delete or archive copy.
Technical security logs (IP + timestamps) may be retained up to 90 days after deletion for fraud investigation, then auto-purged.
Where required by tax/accounting law, invoice records may be retained with any direct personal identifiers removed.
5. Your rights
- Access & portability. Contact us for a machine-readable export of your data.
- Correction. Edit your profile and listings from the app at any time.
- Deletion. Profile → Delete account triggers an immediate cascade delete (see Section 4).
- Objection / withdrawal of consent. Stop using the app or delete your account.
6. Children
Mazad Syria is not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will remove it within 24 hours.
7. Security
Passwords are hashed with bcrypt. Session tokens use JWT with signing keys held server-side. All traffic is encrypted with HTTPS (TLS 1.2+). Storage is protected with role-based access control (RBAC).
8. User-generated content & moderation
Per our zero-tolerance policy, Apple App Store Guideline 1.2, and Google Play policies:
- Every ad, profile, and chat thread has a "Report" button.
- Every ad and profile has a "Block user" button that hides their listings and stops them from messaging you.
- We review every report within 24 hours. Offending content is removed; repeat offenders are permanently banned.
- Content depicting or targeting minors, sexual violence, weapons, or illegal goods is escalated to law enforcement.
- Your chats are private and are NOT read by our team unless a report is filed.
9. Third-party services actually used
- Apple App Store In-App Purchase — payment processing on iOS.
- Google Play Billing — payment processing on Android.
- MongoDB Atlas — encrypted database on managed servers.
- Resend / SMTP — transactional emails (password reset, email verification).
We do NOT use Firebase Analytics, Google Analytics, AppsFlyer, Facebook SDK, or any advertising / tracking SDK.
10. Changes to this policy
We will notify you in-app for material changes and require re-acceptance. Continued use after the effective date constitutes acceptance.
11. Publicly hosted copy
A canonical, publicly-reachable copy of this policy lives at https://mazadsyria.app/privacy.en.html and is the URL declared in both the App Store and Google Play listings.
12. Contact
For any inquiry — support, data access, data deletion, abuse reports, payment issues, legal questions — write to support@mazadsyria.app. We reply within 24–48 hours (Sunday to Thursday).
13. First-party product analytics (added in v2.0.0)
To improve the marketplace we operate a first-party analytics system that runs on our own servers. It is subject to your explicit, opt-in, revocable consent (Profile → Privacy & Analytics). Declining does not affect any core functionality of the app.
What we may collect (only after you grant consent): a small set of aggregate behavioural signals — your internal user identifier, a listing identifier when relevant, the platform (ios or android), and the server-side timestamp of the action. Nothing else.
Approved events: app_session_started, listing_viewed, search_performed, listing_shared, phone_clicked. There is no generic event ingestion — the server accepts only these five names.
What we NEVER store in these events: search query text, message text, phone numbers, email addresses, display names, purchase receipts or tokens, IDFA / GAID. No cross-app or cross-website tracking. No third-party analytics or advertising SDKs.
Purpose: product improvement, usage measurement, evaluating listing and feature performance, and internal business analytics (aggregate KPIs, funnels, retention).
Retention: analytics events auto-expire 365 days after the server-recorded timestamp via a MongoDB TTL index on marketing_events.received_at. When you delete your account, all analytics events attributed to you are removed immediately — you do not have to wait for the TTL.
No advertising / no cross-company tracking. We do not sell analytics data. We do not use it for cross-company advertising. We do not show an App Tracking Transparency (ATT) prompt because we do not perform tracking under Apple's definition.
Revoking consent: open Profile → Privacy & Analytics at any time and switch the choice to "Deny". Future events stop being recorded. Historical events remain until they expire under the retention policy or until you delete your account.
Server-authoritative: all consent checks, environment gates, and the master ANALYTICS_ENABLED kill switch live on the server. The client cannot bypass them. Until the activation gate is met the entire pipeline stays disabled — no events are written.