Legal
Privacy Policy
Effective: 21 September 2026 · Last updated: 21 September 2026 · Version: 1.2
What changed in 1.2: we have said plainly what was already true of messages. Every message is deleted 30 days after it is sent — in direct messages, private group chats and community chat alike, photos included. Version 1.1 described this for photos in direct messages only and said messages themselves were kept “until deleted”, which understated how little we keep. We have also made clear that reports go to our moderation team and not to community moderators. Sections 2.4, 4.1, 6 and 9.
What changed in 1.1: wording only. What this policy called an “outing” is now called an activity, which is what the app calls it. No data practice, purpose, recipient or retention period has changed.
This policy explains what personal data Qafila collects, why we collect it, who else can see it, how long we keep it, and what you can ask us to do with it. It covers the Qafila mobile app and the website at qafilaapp.com.
The short version. You need an account to use Qafila, so we hold your email and the profile you create. Most of what we store is content you chose to publish — spots, posts, activities, listings, messages. We ask for your location only to show you what is nearby, and we do not keep a history of where you have been. We do not sell your personal data, and we do not use it for advertising or ad profiling.
1. Who we are
Qafila is operated by Jadoon Tech ("Qafila", "we", "us"). For the purposes of data-protection law we are the controller of the personal data described in this policy.
You can reach us about anything in this policy at jadoontech@outlook.com.
2. What we collect
2.1 Account data
You can create an account with an email address and password, or with Google Sign-In. Authentication is handled by Firebase Authentication.
- Email and password. Your password is set and verified by Firebase Authentication and is stored only as a salted hash. We never receive or store your password in readable form.
- Google Sign-In. If you sign in with Google, we receive your
basic Google profile — name, email address and profile picture. We request only
the
emailandprofilescopes. We do not receive your Google password, contacts, or anything else in your Google account.
2.2 Profile data
What you put on your profile: display name, username, optional biography, profile photo, city and country, the sports you follow, your primary sport, an optional business name if you run a shop, and the year of your first trip.
2.3 Content you create
Qafila is a place to publish things, and what you publish is stored:
- Spots and venues you add or edit, including their coordinates and photos.
- Posts, comments, likes, poll votes, reviews and recommendations.
- Activities, and who has marked themselves as attending.
- Tournaments, teams, entrants and results.
- Marketplace listings and shop profiles.
- Communities you create or join, membership and moderator roles, join requests and invitations.
- Friend requests and connections, and bookmarks.
- Logbook trips, which may include a GPS track if you choose to record or attach one. A track is location data about you, so please treat it as such when deciding whether to save or share a trip.
2.4 Messages
Direct messages, private group chats and community chat, including any images you attach. These are stored on our servers so they can be delivered and shown to you on your devices. They are not end-to-end encrypted. They are encrypted in transit and at rest, and access is restricted by our security rules, but we are technically able to access message content — for example when responding to a report of abuse or where the law requires it. Please do not use Qafila messages for anything you need to be end-to-end encrypted.
Every message is deleted 30 days after it is sent, along with any photo sent with it, in every kind of conversation. It is not an archive and it is not meant to be one — chat in Qafila is for sorting out the plan, and once the outing has happened the thread has done its job. The deletion is automatic and it applies to everyone's copy, including ours. See section 9.
2.5 Location
If you grant location permission, we read your device's location to centre the map, show what is near you, and calculate distances to spots and activities.
We do not store your device location on our servers and we do not build a location history. It is read when the app needs it and held only in memory on your device. The only coordinates we store are the ones attached to content — a spot's location, a venue's location, or a GPS track you deliberately save to a trip.
You can refuse or revoke location permission at any time in your device settings. The app still works; it simply cannot centre on you or sort by distance.
2.6 Photos and files
Photos you pick for a profile, spot, post, listing or message are uploaded to Firebase Storage. We access your photo library only when you actively choose an image, and only the images you select.
2.7 Notifications
If you allow notifications, Firebase Cloud Messaging issues a push token for your device. We store that token against your account so we can send you the notification and remove it when it stops being valid. It identifies a device installation, not you personally.
2.8 Technical and safety data
- Basic technical data needed to serve requests, including IP address, which is processed and logged by our infrastructure providers.
- Reports you file or that are filed about your content, moderator decisions, warnings and the associated audit record.
- Aggregate counts and statistics, such as how many people viewed a venue.
Qafila does not include an advertising SDK, and does not currently include a third-party analytics or crash-reporting SDK. We do not track you across other apps or websites, and we do not use cookies for advertising.
2.9 Data stored on your device
The app keeps small preferences locally on your device — for example which announcements you have already been shown, so you are not shown them twice — along with a cache of images so the app is not constantly re-downloading them. This stays on your device and is removed when you uninstall the app.
3. Device permissions
| Permission | Why we ask | Optional? |
|---|---|---|
| Location (precise or approximate) | Centre the map on you, show nearby spots and activities, sort by distance. | Yes — the app works without it. |
| Photo library | Attach a photo to a profile, spot, post, listing or message. | Yes — only invoked when you pick an image. |
| Save to photos | Save a community's QR card to your camera roll. | Yes — only when you tap save. |
| Notifications | Tell you about messages, replies, invitations and activities. | Yes — you can decline or turn them off later. |
4. How we use it
- To run the service — create and secure your account, show the map and feed, deliver messages, publish what you post, and run communities, activities, tournaments and the marketplace.
- To keep it safe — investigate reports, enforce our Terms, and detect abuse, spam and fraud. Some content is scanned automatically (see below).
- To support you — answer questions you send us.
- To improve Qafila — understand in aggregate which features are used, and fix what is broken.
- To meet legal obligations — respond to valid legal requests and keep records we are required to keep.
4.1 Automated content scanning
Some user-generated content — currently team names and logos, and the name, note and cover image of activities created outside a community — is scanned automatically by a machine-learning model to spot material that breaches our rules.
This scanning does not automatically delete anything and does not automatically restrict your account. Where the model flags something, it opens a row in a queue for our own moderation team, and a person there decides. That queue is ours; it is not visible to community moderators. You are not subject to a decision based solely on automated processing that produces legal or similarly significant effects.
5. Legal bases
Where the EU or UK GDPR applies to you, we rely on:
- Performance of a contract — to provide the service you signed up for: your account, your content, messages, and the features above.
- Legitimate interests — to keep the platform safe and free of abuse, to secure our systems, and to improve the product. We balance these against your rights.
- Consent — for device permissions such as location and notifications. You can withdraw consent at any time in your device settings, without affecting processing carried out before you withdrew it.
- Legal obligation — where we must retain or disclose data.
6. What other people can see
Qafila is a social product, so a lot of what you create is meant to be seen.
- Public by default: your display name, username, profile photo, bio, city and country, your sports, and the spots, posts, comments, reviews, listings, activities and tournaments you publish.
- Visible to a community: posts, chat and polls inside a community are visible to that community. A community can be public to find or private to join by invitation.
- Private between participants: direct messages, subject to section 2.4.
- Visible to our moderation team: content that is reported or flagged, together with the report. Reports go to us, not to the community the content was posted in — a community's own moderators never see who reported what, even in their own community.
A community handle or QR code is designed to be shared, and anything reachable through a public link may be seen, copied or indexed by others. Please think about that before posting precise locations of places you would rather keep quiet, or photographs of other people.
6.1 Scraping is prohibited
Public does not mean free to harvest. Nobody — user or outsider — has our permission to scrape Qafila, to extract the spot, trail, route, venue, marketplace, community or member data in bulk, to harvest the personal data of our users, or to use any of it to train an AI model. That prohibition is set out in full in section 3.1 of the Terms.
We mention it in a privacy policy because it is a privacy protection, not only a commercial one: the profiles, usernames, photographs and posts of our users are the main thing a scraper would be after. We apply rate limits and server-side access rules, we investigate unusual access patterns, and we act on accounts that extract data — including blocking and termination.
If you believe your personal data has been scraped from Qafila, tell us at jadoontech@outlook.com and we will investigate.
7. Who we share it with
We do not sell personal data, we do not share it with advertisers or data brokers, and we do not license it to anyone to train artificial-intelligence models. We share it only with the service providers that make Qafila work, and where the law requires.
| Provider | What it does for us | What it processes |
|---|---|---|
| Google LLC / Google Cloud & Firebase | Authentication, database, file storage, server functions, push notifications, website hosting. | Substantially all account, profile, content and message data. |
| Google Maps Platform | Renders the map and geocodes place names. | Map requests and the coordinates or search terms involved. |
| Cloudflare, Inc. | DNS, and protection in front of our moderation service. | Network-level request data, including IP address. |
| Our content-moderation model | Scans the limited content described in section 4.1. | The text and image being scanned. |
We may also disclose data where we reasonably believe it is necessary to comply with a valid legal request, to enforce our Terms, or to protect the rights, safety or property of our users, the public or Qafila. If Qafila is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction; we will tell you before it becomes subject to a different policy.
8. Where it is stored
Our primary database region is asia-south1 (Mumbai, India). Files, authentication records, push infrastructure and server functions are operated by Google and may be processed in other countries where Google operates.
This means your data may be transferred to, stored in and processed in countries other than the one you live in, and those countries may have different data protection laws. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) as incorporated in our providers' terms.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | Until you ask us to delete your account. |
| Content you publish | Until you delete it, or until your account is deleted. |
| Messages — direct, group and community chat | Automatically deleted 30 days after they are sent. This applies to every conversation in Qafila: one-to-one messages, private group chats, and the chat inside a community. Chat is for arranging the outing, not for keeping a record of it — so it clears itself, from everyone's copy, and you do not have to remember to tidy up. |
| Photos sent in any chat | Automatically deleted 30 days after they are sent, on the same clock as the message that carried them. After that the app shows the image as expired. |
| Push notification tokens | Until the token stops being valid or you sign out of that device. |
| Moderation reports, decisions and audit records | Kept after the underlying content is removed, so that repeat abuse can be recognised and decisions can be reviewed. |
| Aggregate counts and statistics | Kept indefinitely in a form that does not identify you. |
10. Security
Data is encrypted in transit and at rest by our infrastructure providers. Access to production data is restricted to the small number of people who need it, and what each account can read and write is enforced by server-side security rules rather than by the app alone.
No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires it.
11. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and receive a copy;
- correct data that is wrong or incomplete — much of this you can do yourself by editing your profile;
- delete your account and your personal data (see section 12);
- object to, or ask us to restrict, processing based on legitimate interests;
- ask for your data in a portable, machine-readable format;
- withdraw consent for device permissions at any time; and
- complain to your local data protection authority.
To exercise any of these, email jadoontech@outlook.com from the address on your account. We will respond within 30 days. We will not charge you or treat you differently for exercising a right.
12. Deleting your account
Full instructions, including what is kept and why, are on the delete your account page.
To delete your account and the personal data associated with it, email jadoontech@outlook.com from the address on your account with the subject "Delete my account". We will verify the request and action it within 30 days.
What is deleted: your account and sign-in credentials, your profile, your push tokens, your messages, and the content you posted.
What is not deleted:
- Copies of messages you sent that exist in another person's conversation.
- Content that has become part of a shared record — for example a tournament result, or a community that other people are still using — which we may retain in a form that no longer identifies you.
- Moderation and audit records, and anything we are required to keep by law.
- Aggregate statistics that do not identify you.
- Backups, which are overwritten on their normal cycle.
13. Children
Qafila is not intended for children. You must be at least 13 years old to create an account, and at least 16 where your country sets a higher age for consenting to online services. We do not knowingly collect personal data from children below that age. If you believe a child has created an account, email us and we will remove it.
14. Changes to this policy
We will update this policy when the product or the law changes. The effective date at the top always tells you which version is current. If a change materially affects how we handle your personal data, we will give you notice in the app or by email before it takes effect.
15. Contact
Jadoon Tech — Qafila
jadoontech@outlook.com
If you are in the EEA or the UK and are not satisfied with our response, you may complain to your national data protection authority.