Privacy Policy

This policy explains what data Dakish collects when you use the app or website at dakish.app, why we collect it, who we share it with, and what control you have over it. Dakish is a consumer-to-consumer barter marketplace for Lebanon. We keep this policy short and direct — you should be able to read it in one sitting.

1. Who we are

Dakish is operated by Maroun Hashem, an individual based in Lebanon, acting as the data controller. Contact for privacy questions: [email protected].

Dakish is not a registered legal entity as of the effective date. If we incorporate later, this policy will be updated to reflect the new controller.

2. What we collect

Account data

• Email address — for one-time-code sign-in and account identification.
• Name — shown publicly on your profile and listings.
• Handle (@yourhandle) — your unique public identifier.
• Region — one of Lebanon's 8 regions, chosen by you. Used to show relevant listings. We do not collect GPS or device location.
• Optional profile fields — bio, occupation, year of birth, avatar photo. Year of birth is used for age verification only and is never shown publicly.
• Sign-in method identifiers — if you use Google or Apple to sign in, we store the subject ID they provide so we can recognize you next time. We never receive your password.

Content you post

• Listing photos, titles, descriptions, and "wants" text — publicly visible to anyone browsing Dakish.
• Public thread messages — questions and offers you post on other people's listings are publicly visible.
• Private inbox messages — messages exchanged after an offer is accepted are only visible to you and the other party.
• Reviews — after a completed swap, both parties can leave a public review of the other.

ID verification (optional)

If you choose to verify your identity, you upload photos of a government ID. These photos are stored in a private, encrypted bucket, viewable only by our moderation team for verification review, and hard-deleted within 30 days of the decision (approved or rejected). Withdrawing a pending verification also deletes the photos immediately.

Social data

• Follows — who you follow and who follows you (public counts and lists).
• Saved listings / favorites — kept private to you.
• Blocks — kept private to you.

Technical data

• Push notification token (mobile only) — so we can send you notifications.
• Product usage events — anonymized-where-possible events like "listing viewed" or "offer sent," via PostHog EU. Used to improve the product. You can opt out in Settings.
• Error and crash reports — via Sentry, so we can fix bugs. Includes device model, OS version, and the code path that errored. Does not include your listing content or messages.
• IP address and user agent — logged transiently for security (rate limiting, abuse detection). Not stored beyond 30 days.

3. Why we collect it

• Run the marketplace — showing you listings, connecting you with other users, processing offers, running the moderation queue.
• Keep the community safe — verifying identities on request, reviewing reports, blocking abusive accounts, moderating content.
• Communicate with you — sending sign-in codes, notifying you of activity on your listings.
• Improve Dakish — usage analytics tell us which features work and which don't.
• Comply with law — if we ever receive a valid legal request from Lebanese authorities.

4. Who we share it with

We share your data with the third-party providers we need to run the service. Each of them only sees the minimum needed to do their job.

• Railway (EU-West, Amsterdam) — application hosting and database.
• Cloudflare R2 — listing photo storage (public bucket) and ID verification storage (private bucket).
• PostHog (EU Cloud) — product analytics.
• Sentry — error and crash reporting.
• Resend — transactional email delivery (sign-in codes, notifications).
• Expo Push Notifications — mobile push delivery.
• Google and Apple — only if you use their sign-in.

We do not sell your data. We do not share data with advertising networks. Dakish does not integrate any ad-tracking SDK.

5. How long we keep it

• Account data — until you delete your account.
• Listing content — until you delete the listing or your account. Completed swap records are retained for community trust (visible in the other party's trades tab).
• Private messages — until you delete your account.
• ID verification photos — deleted within 30 days of the verification decision, or immediately if you withdraw a pending request.
• IP address / user agent logs — 30 days.
• Analytics events — retained per PostHog's default (currently 7 years, subject to their retention settings).
• Handles from deleted accounts — reserved for 90 days after deletion to prevent immediate impersonation.

6. Your rights

You have the following rights over your data. Most are exercisable directly in the app; for the rest, email [email protected].

• Access — view all your account data in the app under Profile and Settings.
• Correction — edit your name, bio, occupation, region, avatar, and handle in Edit Profile.
• Deletion — delete your account in-app via Settings → Delete Account. This deletes your profile, listings, private messages, follows, and saved items. Completed swap history and reviews you left on other people remain (as anonymous "deleted user" entries) for community trust.
• Portability — email us to request a data export in JSON.
• Block — block any user; they can no longer see or interact with you.
• Analytics opt-out — Settings → Notifications preferences includes an analytics toggle.
• Complaint — if you believe we've mishandled your data, email us first. If you're an EU resident, you also have the right to complain to your national data protection authority.

7. Children

Dakish is not intended for users under 13. If we learn that we have collected data from a child under 13, we delete it. If you believe a child has provided us with data, email [email protected].

8. International users

Dakish targets Lebanon, but users may sign up from anywhere. Data is stored in the EU (Railway EU-West, Cloudflare R2, PostHog EU Cloud). If you access Dakish from outside the EU or Lebanon, you consent to the transfer of your data to these locations.

9. Security

We use industry-standard practices: HTTPS everywhere, hashed refresh tokens with rotation and reuse detection, private buckets for sensitive files, and short-lived signed URLs for admin viewing of verification photos. No system is perfectly secure, but we treat security seriously and will notify affected users within 72 hours of discovering a material breach.

10. Changes to this policy

If we make material changes, we'll notify you via an in-app banner and, where we can, by email. The "Effective" date above always reflects the current version. Continued use of Dakish after the effective date means you accept the updated policy.

11. Governing law

This policy is governed by the laws of the Republic of Lebanon. Disputes will be handled by the competent Lebanese courts, without prejudice to any mandatory consumer-protection rights you may have under the laws of the country where you reside.