Privacy policy · Halafoodie

Who we are

Halafoodie runs the Halafoodie app and the website halafoodie.iq: a place to discover restaurants, cafés and sweets shops across Iraq through short videos ("reels") that the venues post themselves, and a map of the places near you.

In this policy "Halafoodie", "we" and "us" mean the Halafoodie team. If you have a question about your data, write to us at info@halafoodie.iq.

The short version

We collect what we need to run Halafoodie: your phone number to sign you in, your profile, what you post, and how you use the feed so we can show you better reels.
We use your location only if you allow it. When the app asks for reels or ads, it rounds your position to about 1 km, and our servers don't store it. The only exact location we keep is the map pin a business places for its venue.
We do not sell your personal data. Ads are chosen on our own servers; advertisers never receive your data.
You can delete your account at any time, in the app or on our website. You have 30 days to change your mind; after that your account is erased.

You can watch reels and browse places without an account. Most of this policy is about what happens once you sign in, but some parts (location, usage, ads) apply to guests too.

Your account

When you create an account we keep:

Your phone number. You sign in with an Iraqi mobile number (+964). We send you a 6-digit code by SMS through our SMS provider, OTPIQ. Your number is never shown to other people.
Your profile: your name, your @handle, and, if you add them, a short bio and a profile photo.
Account details: when the account was created, when it was last active, and whether it is a personal or a business account.

You can change your name, handle, bio and photo at any time in the app (Profile, then Edit profile).

Your location

The app asks for your location only when you use something that needs it, such as "Use my location" during setup, the Near me filter, sorting by distance, the map's locate button, or placing a business's pin. It asks for access only while you use the app, never in the background.
On your phone, your location is used to show nearby places, distances and drive times.
When the app asks for reels or ads, it rounds your position to about 1 km (0.01 degrees), and our servers don't store it: they use it only for that request. The only exact location we keep is the map pin a business places for its venue.
To show you local reels we remember a city for you: the city nearest your rounded position or, when the app doesn't know your position, the city you choose in the app. We do not keep a history of where you have been.
You can turn location off at any time in your phone's settings and choose a city instead.

What you post and do in the app

We store what you create and the actions you take, so the app can show them and keep them in sync:

Reels posted by businesses, with their captions, dish names and prices.
Comments and replies, and the comments you like.
Ratings and reviews: your stars, your review text and the dish you name.
Likes, saves, collections and follows (you follow venues).
Shares: that you shared a reel and how (for example, by copying its link).
"Not for me" choices, which hide reels you don't want to see.
Blocks: the accounts you block. We don't tell them.
Reports you send about a reel, comment, review or ad: the reason and any details you write.

The app asks for access to your camera or your photos only when you take or pick a photo or video. Photos and videos you upload may contain location data saved by your camera; you can turn this off in your camera settings.

Businesses

To become a business on Halafoodie you send an application with:

the venue's name and category,
its city, address and map pin,
its phone and WhatsApp numbers,
its opening hours,
a photo of its trade licence.

The licence photo is stored privately. Only the Halafoodie team can see it, and we use it only to verify the business.

Once a business is approved, its venue page is public: the name, category, address, map pin, phone and WhatsApp numbers, opening hours, logo, cover photo and reels. An approved business appears in the app as its venue, with the venue's name and logo; the owner's personal name and photo are kept but not shown. If an application is rejected, we store the reason and send it to the applicant.

How you use the app

To rank the For You feed and to count views, the app records how reels are used:

An install id. When you install the app it creates a random id for that phone. It does not contain your name or number. We also keep the phone's platform (Android or iPhone) and the app version. When you sign in, the install id is linked to your account.
Viewing events: which reels were shown to you, whether they played, how long you watched and how far, replays, the playback speed, and from which feed or screen (For You, Following, Search, a venue page, the map and so on).
Actions: likes, saves, shares, comments, follows, opening a venue page, tapping Directions, Call or WhatsApp, opening the map, "Not for me" and reports.

We use this to learn which kinds of food and places you like, to rank your feed, to count the views shown on reels, to give venues totals about their reels, and to detect fake views and abuse. The interests we learn fade over time unless you keep showing them, and you can start over at any time in Settings with "Refresh your For You feed".

Detailed viewing events are deleted after three to four months. After that only totals remain, such as a reel's view count. The install id and the interests learned on a phone without an account are deleted after 180 days without use.

Like any online service, our servers receive your device's IP address when the app or the website connects. We use it to deliver the service and to prevent abuse:

For rate limits we keep only a salted hash of it, for about a day.
Our sign-in service keeps its own records of sign-ins, which can include your phone number and IP address, for 30 days.
Our web servers and services keep logs (which can include the IP address, the page or request, and the time) for up to 30 days, for security and troubleshooting.

Our audit log, which records changes to accounts and posts, doesn't keep app users' IP addresses or devices.

Notifications

If you allow notifications, we keep for your phone:

its push token (the address notifications are delivered to),
the app language and app version, the platform and whether notifications are allowed,
the account signed in on it, if any.

We also keep your notification settings (which kinds you want and your quiet hours) and your Activity list in the app. Each item in your Activity list is deleted 90 days after the last activity on it, and delivery records after 30 days. A phone's push token is turned off after 90 days without use and deleted after 180 days.

Notifications are delivered through Expo, then Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iPhone). You can turn notifications off, fully or by kind, in Settings › Notifications or in your phone's settings.

Ads and sponsored content

Venues and other businesses can pay to promote a reel or show a banner. Every paid item is labelled "Sponsored".

Ads are chosen on our own servers, using the city you are in (from your rounded position, the city you chose or the city we remember for you), your food interests learned from your activity (for example grill, seafood, breakfast, cafés or sweets) and, for some ads, your distance from the venue, worked out from your rounded position.
Advertisers never receive your personal data. They see totals only, such as how many times their ad was shown, how many people it reached and how many taps it got.
To count this, we keep for each ad, each day and each person or install: how many times it was served and shown, taps, closes, follows and saves, the city you were in, and the first and last time it was shown to you. These counts are deleted after 13 months. Ads you hide stay hidden until your account (or, for a guest, the install id) is deleted.
Tap an ad's options to see why you are seeing it, to hide it, or to report it.

We do not use outside ad networks or advertising trackers.

What other people can see

Public: your name, @handle, profile photo and bio; your comments; your reviews and ratings, with your name and photo; and everything on a venue page.
Venue owners may be notified, with your name and photo, when you like, save or share their reel, comment on it, follow their venue or rate it.
Other people are notified, with your name and photo, when you reply to or like their comment.
Private: your phone number, your collections, the accounts you block, your notification settings and your viewing history. Your likes, saves and follows count towards public totals but are not shown to other people as a list.

The Halafoodie team can see account details, including phone numbers, when it reviews applications, handles reports and keeps the service safe.

What stays on your phone

Some data never leaves your phone: your app settings (language and appearance), your recent searches, your recently viewed reels and places, the city the app opens on, and a saved copy of the catalogue for use offline. Recent searches and recently viewed are cleared when you sign out.

Our website

The website halafoodie.iq stores one small cookie that remembers the language you chose. It uses no advertising or analytics cookies.

The website's reel videos and some of its cover images are loaded by your browser directly from Cloudflare R2, which then sees your IP address.

On the "Delete your account" page you sign in with your phone number and an SMS code, as in the app. That sign-in is kept in your browser only while you use the page.

Service providers

We use these providers to run Halafoodie. They process data only to provide their service to us:

Contabo hosts our servers and our database, including profile photos, venue photos and licence photos, and the server that prepares reel videos for playback.
Cloudflare (R2) stores and delivers reel videos and their cover images. On our website, your browser loads them from it directly.
OTPIQ sends the SMS sign-in codes. It receives your phone number and the code.
Expo delivers notifications to Google and Apple, and delivers app updates.
Google Firebase Cloud Messaging delivers notifications to Android phones.
Apple Push Notification service delivers notifications to iPhones.
OpenFreeMap provides the map tiles. It sees your IP address and the part of the map you are looking at.
unpkg, a public content network, delivers the map's software to the app. It sees your IP address.

Our servers and these providers may be located outside Iraq.

How long we keep data

Your account and what you post: while your account exists. When it is deleted, as described below.
Audit records (changes to your account and posts, and actions our team takes): kept with your details while your account exists, without your IP address or device; after it is deleted, only without your personal details.
Our sign-in service's records (sign-ins, which can include your phone number and IP address): 30 days.
Detailed viewing events: three to four months.
The list of reels you have already seen: 120 days.
The anonymous install id and the food interests learned on a phone without an account: deleted after 180 days without use. An account's interests fade over time and are deleted with the account.
Ad counts (including the city you were in and the first and last time an ad was shown to you): 13 months.
Ads you hid: until your account is deleted (for guests, until the install id is deleted).
Items in your Activity list: 90 days after the last activity on them. Notification delivery records: 30 days.
Push tokens: turned off after 90 days without use and deleted after 180 days.
Hashed IP addresses for rate limits: about a day.
Web server access logs and service logs (which can include the IP address, the page or request, and the time): up to 30 days.
Backups: up to 30 days.

Deleting your account

You can delete your account at any time:

In the app: Settings → Account → Delete account.
On the website: https://halafoodie.iq/en/delete-account

Right away: your account is closed and you are signed out on all your devices within an hour. Your profile, comments and reviews are hidden. If you own a venue, the venue and its reels come down. A pending business application is withdrawn, and notifications stop.

For 30 days you can change your mind. Sign in again within 30 days and choose to restore your account: everything comes back as it was, unless our team suspended your venue in the meantime.

After 30 days your account is erased for good. We delete your profile, your phone number and sign-in, your sign-in records, your reels, comments, reviews, likes, saves, collections, follows and blocks, the food interests learned for your account and the list of reels you have seen, the ads you hid, your notifications and notification settings, your phones' push tokens, your business applications, your licence photos, and your venue with its photos and reels. Reports you sent are kept without your name, so that our moderation decisions stay explained. Reports other people sent about you or your content are kept for our moderation records, with the details they wrote removed. Totals such as view counts stay, without anything that identifies you. Your viewing data is unlinked from your account and kept only under your phone's anonymous install id until it expires (3–4 months), then only as totals. Your ad counts are kept under an anonymous id until they expire (13 months). We keep only a record that an account was deleted, and the history of moderation decisions without your personal details.

Our backups are kept for up to 30 days, so deleted data disappears from them within 30 days of being erased.

You can also delete your account even if it has been banned (a banned account cannot be restored while the ban lasts).

Your rights

You can ask us at any time to:

give you a copy of the personal data we hold about you,
correct data that is wrong (you can also edit most of it yourself in the app),
delete your data.

Write to info@halafoodie.iq and tell us your phone number or @handle. We may need to confirm that the account is yours before we act.

You can also turn off location or notifications in your settings, and refresh your For You feed at any time.

Children

Halafoodie is not for children under 13. You must be at least 13 years old to create an account. If we learn that an account belongs to someone under 13, we will delete it.

Security

Current versions of the app and the website talk to our servers over encrypted (HTTPS) connections. Licence photos are stored privately, access for our team is limited by role, and actions taken by our team are recorded. No system is perfectly secure, so please keep your phone and SMS codes to yourself.

Changes to this policy

We may update this policy when Halafoodie changes. The date at the top shows the latest version. If a change matters for how we use your data, we will tell you in the app before it applies.

Contact and governing law

Halafoodie, info@halafoodie.iq.

This policy is governed by the laws of Iraq.