Privacy Policy

Last updated: 2 November 2026

1. Who we are

Khera Wasta (the app com.kherawasta.app and this website) helps people in the Kurdistan Region find craftsmen ("wastas") and contact them directly. It is run by [the legal name of the person or company that runs Khera Wasta, and its address] ("we", "us"). For any question about your data, write to support@kherawasta.com.

2. What we collect

When you use the app, with or without an account

• Your app installation: a random installation ID that the app creates, the platform (Android or iOS) and the app version, and, if you allow notifications, the push ID that Firebase gives your installation.
• How you use the directory: the wasta profiles you open, your searches (the words, city, area and type of work) and your taps on a wasta's WhatsApp or call button. They show wastas and our admin how often profiles are viewed and contacted, and help us spot abuse. The conversation itself happens in WhatsApp or your phone app; we never see or record it.
• Your IP address, which reaches our server with every request. We keep it with contact taps and security records for at most 30 days.
• Location, only when you choose it: when you tap "Use my current location" (the app asks for permission only then) or pick a point on the map, the app uses that point to show the distance to each wasta. As a guest, the point stays on your phone: it is sent with your requests to work out distances and is not stored on our server. The app never tracks your location in the background.

If you create a customer account

• Your name, your mobile number (confirmed with a one-time code sent by WhatsApp or email, never by SMS), your email address if you give one, and your password, which we keep only as a secure hash that nobody can read back.
• Your favorite wastas, the places you save (a point you choose and the name of its area), your reviews and your notification setting.
• Your reviews are public: other users see them with your name.

If you are a wasta

• Our admin creates your account with your name, username, mobile and WhatsApp numbers, email if any, your type of work, city, area, written address and map pin, and your contract with us.
• You add your profile photos, photos of your work, a description, your experience, services, working hours and the areas you serve. Your profile is public while your contract is active.
• Your written address and exact map pin are never shown to customers: they see only your area and a rounded distance.

Crash reports

When the app crashes, Firebase Crashlytics (a Google service) receives a report: the technical details of the error, the app version, the phone model and system version, a Crashlytics installation ID, and when the app was opened. A report never contains your name, phone number, email, location or account.

3. How we use it

• to run the directory: show wastas, their work, reviews and distances, and let you contact them;
• to keep accounts safe: one-time codes, password rules and limits on repeated attempts;
• to send the announcements you allow, and notices about your account (for a wasta, for example, a contract that is about to end);
• to give wastas and our admin statistics, such as profile views and contact attempts, and to detect suspicious activity;
• to find and fix crashes.

We do not use your data for advertising and we do not sell it. The app contains no advertising or analytics trackers.

4. Who else receives data

• Google Firebase Cloud Messaging delivers notifications to your phone, using your installation's push ID.
• Google Firebase Crashlytics receives the crash reports described above.
• Google Maps draws the map in the app when you choose a location. Google receives the map requests from your phone, as its own privacy policy describes.
• Our hosting company, Contabo, runs the server we rent, in [the data-center country: see the Contabo customer panel]. Our database, the photos and our backups are on that server, under our control.
• A WhatsApp and an email sending service will deliver one-time codes and account emails once they are connected [name the providers when they are chosen].
• Authorities, when the law requires it.

Google acts as our service provider for these services. We share nothing else with anyone.

5. How long we keep it

• Account data: while your account is open.
• A deleted customer account: closed at once and erased 30 days later (see Delete account).
• IP addresses and one-time codes: 30 days.
• Records of searches, profile views and contact taps: 24 months. After that only daily totals remain, without any personal data.
• Notifications in your in-app list, and installations that have not been seen: 12 months.
• Backups: encrypted copies of the database and the photos, kept for up to 12 months and then deleted.

6. Your choices and rights

• See and correct your account details in the app.
• Turn announcements off in the app, or notifications off in your phone's settings.
• Refuse the location permission: you can still pick a place on the map, or browse without distances.
• Delete your account: see Delete account.
• Ask us for a copy of your data, or anything else: support@kherawasta.com.

7. Children

Khera Wasta is meant for adults who look for or offer craft services. It is not directed at children under [13 or 16: choose the age], and we do not knowingly collect their data.

8. Security

All connections use HTTPS. Passwords are kept only as secure hashes. Access to our server and our admin panel is restricted and protected, the database cannot be reached from the internet, and backups are encrypted.

9. Changes to this policy

When this policy changes, we update this page and the date at the top, and we announce important changes in the app.

10. Contact

Questions about privacy or your data: support@kherawasta.com.