Qava Pass

Privacy Policy

Effective date: July 4, 2026

Qava Pass ("we", "us") operates the Qava Pass mobile application and the qavapass.app website — a monthly coffee pass service for cafés in Baghdad, Iraq. This policy explains what information we collect, why, and the choices you have.

Information we collect

• Account information. Your phone number (used to sign in via SMS verification code), your name, and your date of birth (used for age-appropriate features and birthday perks).
• Pass and redemption data. Your pass type, its validity dates, the cafés where you redeem drinks, and your redemption and order history. This is the core of the service — it's how cafés verify your pass.
• Payment confirmations. Payments are made by bank or card transfer outside the app. We store the confirmation details you submit (such as a transfer reference) to activate your pass. We do not collect or store your card numbers or bank credentials in the app.
• Device data. A push-notification token if you enable notifications, and your language preference (English or Arabic).

What we use it for

• Operating your pass: sign-in, QR code generation, redemption verification at partner cafés, and renewal reminders.
• Notifying you when your order is ready or your pass renews (only if you enable notifications).
• Referral rewards, when you share your referral code.
• Keeping the service safe — preventing fraudulent redemptions and abuse.

What we don't do

• We do not sell your personal information to anyone.
• We do not use your data for third-party advertising.
• We do not collect your precise location.

Who can see your data

Staff at a partner café can see your name and pass status only when you scan your QR code at their counter. Our infrastructure runs on Supabase (database, authentication, and hosting), which processes data on our behalf. We share data with authorities only if legally required.

Data retention and deletion

We keep your data while your account is active. You can permanently delete your account and associated personal data at any time from inside the app: Profile → Delete account. You can also email us (below) and we will delete your account for you.

Children

Qava Pass is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes

If we change this policy, we'll update this page and the effective date above. Material changes will be announced in the app.

Contact

Questions or requests: support@qavapass.app — or visit qavapass.app/support.