Privacy Policy

1.Data we collect

Most of the following is only requested if you sign in to rate, save or suggest places.

1.1 Account data

• Email address: this identifies your account. You sign in with a code we send to your email, or with your Google or Apple account; there is no password. With Google or Apple we receive only your email address and name, and Apple may let you hide your real address. A sign-in code is deleted once used or within ten minutes.
• Display name and profile photo: if you do not enter a name, the part of your email address before the @ is used as a starting name; you can change it at any time under “Edit profile”.
• Optional details: your country and your visit type (for example: returning expat or tourist).
• Preferences: interface language, display currency, appearance, digit style, and whether notifications are on.
• Participation data: points, level, badges and contribution counts, computed from your activity, plus the time of your last sign-in.

1.2 Content you add

• Reviews: the overall rating and sub-ratings (food, service, cleanliness, value), the text, what you ordered, and the amount paid, party size and visit date if you enter them.
• Photos: those you upload with a review or a suggestion, and your profile photo. Our server re-encodes every photo and removes all of its metadata (EXIF), including GPS coordinates and camera details, before storing it.
• Suggestions: a new place (name, category, map location, address, description, the place’s contact numbers and opening hours), a correction to a place, or a public transport line with its stops.
• Reports: the content reported, the reason, and your note if you write one.
• Interactions: the “Helpful” marks you give reviews, the places you save and the lists you create.

1.3 Location

The app reads your location only after you allow it, only while you are using it, and never in the background. It is used as follows:

• Nearby places, sorting by distance and centring the map: the coordinates are sent with the request to our server to compute the result; they are not stored in your account or in our database.
• Directions and navigation: the start, the destination and any stops are sent to our server, which passes them to an external routing service to compute the route (section 4). We do not store routes.
• Traffic: during a real navigated drive (not in simulation), the app sends, about every ten seconds, a short stretch of the road you are on with the speed measured over it — with no account, device or trip identifier, and no IP address is stored with the sample. These samples show congestion to everyone and are deleted automatically after 30 minutes.
• Suggesting a place or a transit line: the location picker starts at your device’s last known location; what is saved is the location of the place or stop that you set.

You can refuse or withdraw location permission at any time in your device settings; the rest of the app keeps working.

1.4 Search

We store search phrases, normalised, together with how many times they were searched — nothing that links them to you or your device — to show a “most searched” list.

1.5 Notifications

• In-app notifications (such as a suggestion being approved or an event reminder) are stored in your account and deleted automatically after 180 days.
• When push notifications are enabled and you allow them, your device is registered with the notification service we use (Pushbib) together with: your account ID, the push token issued by Apple or Google, a device identifier, the device model, operating system, app version, device language, time zone and country, the times the app is opened, and the account details needed to target notifications (name, language, currency, visit type and level). The device is unlinked from your account when you sign out, and you can turn notifications off in your device settings.

1.6 Technical data

• With every request the app sends its platform (iOS or Android), its version number and the interface language, to answer in your language and to tell you when an update is required.
• To know how many people use the app, each launch records once a one-way hashed code with the date, the platform and the app version. The code comes from an identifier the device’s system gives the app or, in older versions, from the IP address and user agent together with that day’s date. We do not store the identifier or the IP address, the code is not linked to your account, and the record is deleted automatically after 400 days.
• Our website thesyriagate.com uses no cookies. We count its visits the same way: a hashed code from the IP address and user agent together with that day’s date, plus a counter for each page, for the sites that referred visitors and for download clicks. All of it is deleted after 400 days.
• With every sign-in session we store the IP address and the user agent of the software that made the request, to protect the account; each session record is deleted automatically 180 days after it is created.
• Our server keeps technical logs for security and troubleshooting only. They may include the IP address, the time and the full address of a request, including coordinates sent with search or directions requests. These logs are deleted periodically; application logs are deleted after 14 days.

1.7 What we do not collect

We do not collect your contacts, payment details, health data, advertising identifier, or your browsing outside the app. The camera and photo library are used only when you choose to take or attach a photo. If you use voice search on the CarPlay screen, speech is processed by Apple’s speech recognition service and we receive no audio recording.

2.How we use data

• To create your account, sign you in and keep it secure.
• To publish your contributions under your name, compute place ratings, average spend and popular dishes, and award points, levels and badges.
• To review and moderate content, handle reports, and prevent abuse and misuse.
• To provide location-based features, directions and traffic.
• To send notifications about your contributions and events, and general service announcements that we may target by language, visit type, or the governorates where you saved or reviewed places.
• To show the app in your preferred language and currency, and tailor the home screen to your visit type.
• To answer your messages and support requests.

We do not use your data for advertising or to build marketing profiles, and we do not share it with data brokers.

3.What others can see

• Public inside the app: your display name, photo, level, badges, points, contribution counts, join date, your published reviews and photos, and your name as the person who suggested a place once it is approved.
• Never shown to others: your email address, country, visit type, preferences, saved places, lists and reports.
• Our team: authorised moderators see the data needed for moderation and support through a permission-protected dashboard, and their actions are recorded in an audit log that is deleted after one year.

4.External services

We do not sell or rent data to anyone. We rely on the following services for some features; each is governed by its own privacy policy:

The server, database and uploaded photos are hosted on a server we manage at a hosting provider. We may disclose data where the law requires it, or to protect our rights and the safety of users.

5.How long we keep data

6.Deleting your account

You can delete your account from inside the app:

Profile → Privacy & security → Delete account → Delete my account

When you do:

• Your saved places, lists, notifications and profile photo are deleted immediately.
• All sign-in sessions on every device are revoked, notifications stop, and your device is unlinked from your account in the notification service.
• Your email address is replaced with an internal value that does not identify you, so you can later create a new account with the same address.
• Your published reviews, photos and suggestions remain, because other travellers rely on them, but they are shown as “Deleted user” without your photo, and your public profile disappears.
• A deactivated internal account record remains to hold those contributions together; it contains the former display name, country, visit type and points, and is shown to no one.

To remove a specific review or photo, to have that internal record erased as well, or if you cannot access the app, email thesyriagate@gmail.com from the address registered to your account.

7.Your rights and choices

• View and edit your profile in the app: name, photo, country, visit type and preferences.
• Ask us for a copy of your data, or to correct or delete it, or object to a particular use, by emailing us. We confirm that a request comes from the account holder before acting on it.
• Refuse or withdraw location, camera, photo and notification permissions in your device settings.
• Use the app as a guest, without an account.

8.Security

• The app talks to our server over an encrypted connection (HTTPS).
• Session refresh tokens are stored only as hashes (SHA-256); each token is replaced when used, and all of an account’s sessions are revoked if an old token is reused.
• Access to the admin dashboard is limited to authorised moderators with passwords and specific permissions.
• If you notice activity on your account that was not you, email us straight away.

No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

9.Children

The service is not directed to children under 13, and we do not knowingly collect their data. If you learn that a child has given us personal data, email us and we will delete it.

10.Changes to this policy

We may update this policy when the service or legal requirements change. The updated version is published on this page with a new effective date, and we may tell you about significant changes inside the app.

11.Contact us

Operator: Syria Gate / بوابة سوريا.
Email: thesyriagate@gmail.com
Support page: Support