Qava Pass

Privacy Policy

Effective date: September 25, 2026

Qava Pass ("we", "us") operates the Qava Pass mobile application and the qavapass.app website — a monthly coffee pass service for cafés in Baghdad, Iraq. This policy explains what information we collect, why, and the choices you have.

Information we collect

• Account information. Your phone number (used to sign in via SMS verification code), your name, and your date of birth (used for birthday perks).
• Pass and redemption data. Your pass type, its validity dates, the cafés where you redeem drinks, and your redemption and order history. This is the core of the service — it's how cafés verify your pass.
• Payment confirmations. Payments are processed by WAYL, an Iraqi payment gateway, on its own secure checkout page. We store the payment reference, amount, and status so we can activate your pass. We do not collect or store your card numbers, wallet credentials, or bank credentials in the app.
• Location (only while you use Skip the Line). If you choose to order ahead and allow location access, the app uses your device's location while you walk to the café to show your distance and to tell the café to start your drink when you are within about 300 metres. Distances are calculated on your phone. When you arrive, the app sends your approximate position (rounded to roughly 10 metres) to our server once, so it can confirm you are at the café; the server records only the fact and time of your arrival — your coordinates are not stored. Location sharing starts only when you tap to place an order and start walking. On Android it continues while the app is minimised on your way to the café, and a notification stays on screen the whole time it is running; on iPhone it runs only while the app is open. It stops automatically as soon as you arrive or your order is ready, collected or cancelled, when you tap “Stop sharing”, and in any case after 45 minutes. Location is never collected at any other time. You can use Qava Pass without granting location access; only the order-ahead feature needs it.
• Device data. A push-notification token if you enable notifications, and your language preference (English or Arabic).

What we use it for

• Operating your pass: sign-in, QR code generation, redemption verification at partner cafés, and renewal reminders.
• Notifying you when your order is ready or your pass renews (only if you enable notifications).
• Referral rewards, when you share your referral code.
• Keeping the service safe — preventing fraudulent redemptions and abuse.

What we don't do

• We do not sell your personal information to anyone.
• We do not use your data for third-party advertising.
• We do not track your location or store your coordinates. Location is used only during an active Skip the Line order, as described above.

Who can see your data

Staff at a partner café can see your name and pass status only when you scan your QR code at their counter. We use trusted service providers who process data on our behalf and only to run Qava Pass: Supabase (database, authentication, and hosting), WAYL (payment processing — WAYL handles your payment details under its own privacy policy), an SMS provider to deliver your sign-in verification codes, and a push-notification service (together with Apple and Google's notification systems) to deliver notifications you've enabled. We do not sell data to these or any other parties. We share data with authorities only if legally required.

How we protect your data

All data exchanged between the app and our servers is encrypted in transit using industry-standard TLS. Access to your account is protected by one-time SMS verification, and your session credentials are stored securely on your device.

Data retention and deletion

We keep your data while your account is active. You can permanently delete your account and associated personal data at any time from inside the app: Profile → Delete account. You can also request deletion from the web at qavapass.app/delete-account, or by emailing us (below).

Age requirement

Qava Pass is intended for users aged 18 and older and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

Changes

If we change this policy, we'll update this page and the effective date above. Material changes will be announced in the app.

Contact

Questions or requests: support@qavapass.app, on WhatsApp at +964 785 556 3064 — or visit qavapass.app/support.