Privacy Policy for Diwan App

Welcome to Diwan, a food ordering and taxi booking platform in Al-Diwaniyah, Iraq. We respect your privacy and are committed to protecting your personal data. This policy explains what we collect, why, who we share it with, and the choices you have. By using or signing in to the app you agree to this policy.

1. Information We Collect

We collect only what is needed to provide the service:

• Google account: When you sign in, Firebase Authentication provides your name, email address, profile photo and account ID. We never see your Google password, messages, files or contacts.
• Information you enter: Name, phone number, detailed delivery address and order notes.
• Location: Your precise GPS location, with your permission, to set the delivery or pickup point. A driver's location is shared with the customer only while the order or ride is in progress.
• Order and ride data: Restaurant, items and quantities, prices and delivery fee, discount code used, order status, timestamps and estimated arrival time, the reason an order was cancelled (for example cancelled by you or automatically), your order history, and restaurant ratings.
• Partner data (restaurants and drivers): When applying: restaurant and owner name, phone number, food type, the restaurant location (an address you type in) and its map location, restaurant and item photos; for drivers: home location (address) and vehicle details (type and plate number); and the partner account password (stored encrypted).
• Support requests and reports: Your phone number and the description of your issue. When you report a taxi driver: the order number, the driver's details (name, phone and plate number), the reason and any details you write, and your name and phone number. These reports reach the app administration only, for review.
• Notifications: Your device's push token (FCM) if you allow notifications.
• Technical data: Browser, device type and error logs to improve performance.
• On-device storage: We keep your sign-in session, your name and phone for faster future orders, your recent order history, order step times and estimated arrival, and the status of reports you sent. A driver's device also keeps the list of orders the driver chose to "ignore" (it is never sent to anyone and is cleared automatically after three hours).

2. How We Use Your Data

• Create your account, verify identity and keep your session signed in.
• Fulfil food and taxi orders, connect you with restaurants and drivers, and track orders live.
• Calculate delivery fees, distances and estimated times, and show the order time and estimated arrival time.
• Show the order to the nearest available drivers first, in widening ranges (2, then 5, then 10 km from the restaurant or pickup point), and cancel it automatically if no driver accepts it within 20 minutes, or if the restaurant does not accept it within 30 minutes of the driver's acceptance, informing the parties concerned.
• Send notifications about your order status.
• Respond to support requests and resolve issues.
• Prevent fraud and fake orders and keep the platform secure.
• Improve the app and fix bugs.

3. Who We Share Data With

We do not sell or rent your personal data to advertisers or any commercial party. We share it only as follows:

• Restaurants: See your name, phone number, delivery address, order items and amount, for the relevant order only.
• Delivery and taxi drivers: Before accepting an order they see only what they need to assess it (the address, pickup and drop-off or start and destination points, distance, price and order items), without your name or phone number. After accepting, they see your name, phone number and location, for the relevant order only.
• Customers: See the driver's name, phone number, vehicle type and plate, and live location while their order is in progress.
• Google Firebase: Authentication, data storage and notifications (Authentication, Firestore, Cloud Messaging).
• Cloudinary: Hosting of restaurant and item images.
• Mapping services: OpenStreetMap for maps, and routing/geocoding services (such as OSRM and Nominatim); only coordinates are sent (such as the driver's location and the pickup and drop-off points, to draw the route on real roads), never your name or phone.
• Navigation apps: Such as Waze, only when you tap a navigation button; the destination location is passed to them.
• Legal authorities: When required by law or to protect our rights and users' safety.

4. Location Data

• We request location access only when you use ordering, taxi or driver features.
• You can deny or revoke permission at any time in your browser or device settings and enter your address manually.
• We do not track your location in the background after the app is closed.
• A driver's location is sent only during an active ride or order and stops when it ends. While a driver is marked available, the location is used on the device only to work out which nearby orders to show, and is not sent to us.
• The customer sees the driver's location and route on the map only while the order is in progress and, for food orders, after the driver has picked up the order from the restaurant.

5. Google Sign-In and Saved Session

We use Google Sign-In to secure your account. Your session stays saved on your device until you sign out. On sign-out we clear the session and locally saved customer data from your device. You can also revoke the app's access at any time from your Google Account settings (Security → Third-party apps).

6. Retention and Deletion

• We keep your data while your account is active and needed to provide the service, and for a reasonable period afterwards for financial records, dispute resolution and fraud prevention. Cancelled orders (by you or automatically) remain as a record with a "cancelled" status, and are treated like your other orders when you delete your account.
• Delete your account in the app: open "My Account" and tap "Delete my account permanently". You can also delete it from the "Delete Account" page on the app's website (delete-account.html) without opening the app.
• What is deleted immediately: your linked Google sign-in account; your name, phone number, addresses and coordinates in your past orders (the orders remain without identity so restaurants' and drivers' financial records stay intact); and data saved on your device.
• Partners (restaurants and drivers): deleting your account in the app sends a deletion request for your business account; after reviewing it, the administration deletes your registration data, encrypted password, menus and related records.
• What we may keep: support records and anonymised transaction records to the extent required by law or to prevent fraud.

7. Data Security

Data is transmitted between your app and our servers over encrypted connections (HTTPS/TLS) and stored with Google Firebase. We take reasonable measures to protect it from unauthorized access, but no electronic method of transmission or storage is 100% secure, so please keep your account password confidential.

8. Your Rights

• Access: Ask what data we hold about you.
• Correction: Update your data from your account page or via support.
• Deletion: Delete your account and data directly from "My Account → Delete my account permanently" or from the Delete Account page.
• Withdrawal: Turn off location or notifications, or sign out, at any time.

9. Children's Privacy

The app is intended for users over 13. We do not knowingly collect data from children under 13 and will delete it immediately if we learn of it.

10. Data Transfers Outside Iraq

Some of your data is processed on Google servers and the third-party services listed above, which may be located outside Iraq. We choose providers that follow recognised security standards.

11. Changes to This Policy

We may update this policy from time to time; the last-updated date appears at the top. We will notify you of material changes inside the app, and continued use afterwards means you accept them.

12. Contact Us

• Inside the app: My Account → Technical Support.
• Location: Al-Diwaniyah, Iraq.