Qava Pass

Privacy Policy

Effective date: July 21, 2026

Qava Pass ("we", "us") operates the Qava Pass mobile application and the qavapass.app website — a monthly coffee pass service for cafés in Baghdad, Iraq. This policy explains what information we collect, why, and the choices you have.

Information we collect

• Account information. Your phone number (used to sign in via SMS verification code), your name, and your date of birth (used for birthday perks).
• Pass and redemption data. Your pass type, its validity dates, the cafés where you redeem drinks, and your redemption and order history. This is the core of the service — it's how cafés verify your pass.
• Payment confirmations. Payments are made by Qi Card or bank transfer outside the app. We store the confirmation details you submit (such as a transfer reference number) to activate your pass. We do not collect or store your card numbers or bank credentials in the app.
• Device data. A push-notification token if you enable notifications, and your language preference (English or Arabic).

What we use it for

• Operating your pass: sign-in, QR code generation, redemption verification at partner cafés, and renewal reminders.
• Notifying you when your order is ready or your pass renews (only if you enable notifications).
• Referral rewards, when you share your referral code.
• Keeping the service safe — preventing fraudulent redemptions and abuse.

What we don't do

• We do not sell your personal information to anyone.
• We do not use your data for third-party advertising.
• We do not collect your precise location.

Who can see your data

Staff at a partner café can see your name and pass status only when you scan your QR code at their counter. We use trusted service providers who process data on our behalf and only to run Qava Pass: Supabase (database, authentication, and hosting), an SMS provider to deliver your sign-in verification codes, and a push-notification service (together with Apple and Google's notification systems) to deliver notifications you've enabled. We do not sell data to these or any other parties. We share data with authorities only if legally required.

How we protect your data

All data exchanged between the app and our servers is encrypted in transit using industry-standard TLS. Access to your account is protected by one-time SMS verification, and your session credentials are stored securely on your device.

Data retention and deletion

We keep your data while your account is active. You can permanently delete your account and associated personal data at any time from inside the app: Profile → Delete account. You can also request deletion from the web at qavapass.app/delete-account, or by emailing us (below).

Age requirement

Qava Pass is intended for users aged 18 and older and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

Changes

If we change this policy, we'll update this page and the effective date above. Material changes will be announced in the app.

Contact

Questions or requests: support@qavapass.app — or visit qavapass.app/support.