Privacy Policy

Last updated: 2026-10-27

Chyawan (چیاوان, "Chyawan", "we") is a marketplace app and website for outdoor gear, trips, travel packages and gear rental in the Kurdistan Region of Iraq. Independent stores and tour operators sell through Chyawan. This policy explains what personal data we collect when you use the Chyawan app or website, why we use it, who we share it with, and the choices you have.

1Who we are and how to reach us

Chyawan runs the app, the website and customer support. For any privacy question or request, contact us:

• In the app: Account → Help & contact. Send us a message there.
• Email: [email protected]
• Phone: +964 770 222 2469

2Data you give us

• Account: your mobile phone number (you sign in with a one-time code sent by SMS), your name and, if you choose to add them, your email, profile photo, gender, city, date of birth, interests and app language.
• Delivery addresses: recipient name, phone number, city, area, street, building, floor, a landmark and, if you set it, the address location on the map (latitude and longitude).
• Location: collected only when you set an address location on the map or tap "Use my current location" while adding or editing an address. The app then reads your device's precise location once, with your permission, to place the pin. We save only the point you confirm, with that address, and use it for delivery. The app does not track your location in the background and does not read it at any other time.
• Orders, bookings, rentals and returns: what you buy, book or rent, prices, delivery or pickup details, the names and phone numbers of travellers and the emergency contact you enter for a trip booking, and the reason and photos you add to a return request.
• Refunds and payouts in cash: a refund of a cash-on-delivery order is collected in cash at the Chyawan office, and so are store payouts. We record who the cash was handed to and a receipt note. We no longer ask for bank or wallet account details; account details we already hold from earlier refunds or payouts stay encrypted and are kept only as described in "How long we keep it".
• Photos and files you upload: profile photo, review photos and return photos. Sellers also upload store and product photos and the business documents (such as a licence or ID) sent with a store application.
• Messages: your support tickets and live support chats with Chyawan.
• Reviews and activity: reviews and ratings, wishlist, followed stores, coupons, points and referrals, and content you report.
• Seller accounts: store details and team members, and the record of who collected the store's payouts at the Chyawan office.

3Data collected automatically

• Device and session: IP address, device and app information (user agent), sign-in times and the app language.
• Notifications: if you allow notifications, a push token for your device, its platform (Android or iOS) and language.
• Use of the app: your searches (kept for 90 days) and recently viewed items.

4What we do not collect

• No card or online payment data. At launch every payment is cash on delivery, so we never receive card numbers.
• No background location. The app never reads your location in the background or outside the address screen. Setting a location on an address is optional; you can type the address only.
• No contacts, no advertising ID, and no third-party advertising or analytics trackers.
• Camera: used only when you choose to take a photo, or when a seller scans a ticket QR code at a trip meeting point. Nothing is recorded otherwise.

5Why we use your data

• To create and protect your account and sign you in with an SMS code.
• To process orders, bookings and rentals, deliveries, cancellations, returns and refunds.
• To let you talk to our support team.
• To send notifications about your orders and bookings and, only if you turn them on, offers and news. You can change this at any time in Account → Settings → Notifications.
• To run points, rewards and referrals.
• To keep Chyawan safe: prevent fraud and abuse, limit repeated requests, review reported content and enforce our Terms of Use.
• To keep the financial records the law requires.
• To improve the service, using combined statistics that do not identify you.

6Who we share it with

• The store or tour operator you buy from, book with or rent from receives your name, phone number, delivery address, the order, booking or rental details and the travellers' names and phone numbers. They are independent businesses and may use this data only to serve your order or booking.
• Service providers that work for us: server hosting, file storage, the SMS company that sends sign-in codes and, if notifications are enabled, Google Firebase Cloud Messaging and the Apple Push Notification service. They process data only on our instructions.
• Maps: the address map shows map tiles from OpenStreetMap (openstreetmap.org), so your device loads them from OpenStreetMap's servers, which see your IP address and the map area shown. To suggest the street and neighbourhood of the point you choose, the app may send that point (without your name or phone number) to OpenStreetMap's Nominatim service.
• Authorities, when the laws of Iraq or the Kurdistan Region require it, or to protect the rights and safety of our users and of Chyawan.
• Reviews you post are public in the app with your name.
• We do not sell your personal data.

7How long we keep it

• We keep your data while your account is open.
• When you delete your account, your profile, phone number, email, addresses, devices, sessions, points and store memberships are deleted straight away. Your orders, bookings and reviews are kept without your name or phone number, and payment records are kept, because we need them for accounting, receipts, warranty and refunds.
• If your account joined with an invite code, we keep a one-way code of your number only to stop invite-bonus abuse; it can't be turned back into your number.
• Searches are deleted after 90 days.
• Server backups are overwritten within 14 days.

8Your choices and rights

• See and edit your profile and addresses in the app at any time.
• Turn notifications off in the app or in your phone's settings.
• Delete your account in the app (Account → Settings → Delete account), or ask us through Support in the app. See the account deletion page: chyawan.com/en/delete-account
• Ask us for a copy of your data, or to correct or delete specific data. We answer within 30 days.

9Security

All traffic between the app and our servers is encrypted (HTTPS). Sign-in codes expire quickly, session tokens are stored hashed, account details saved before refunds and payouts moved to cash at the office are encrypted, and staff accounts use two-step sign-in. Only people who need the data for their work can see it. No system is perfectly secure, so please keep your phone and SIM card safe.

10Children

Chyawan is not meant for children under 13, and you must be at least 13 to create an account. If you are under 18, use Chyawan with the permission of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

11Changes to this policy

When we change this policy we update it here and change the date at the top. For important changes we also tell you in the app.

12Applicable law

This policy is governed by the laws of Iraq and the Kurdistan Region of Iraq.