# Privacy Policy — Geo Nabaa
**Last updated: 19 August 2026**
Geo Nabaa ("the app", "we", "us") is a community application for geologists, geology students, and earth-science enthusiasts in Iraq and the wider Arabic-speaking world. This policy explains what information the app collects, why we collect it, who we share it with, and the choices you have.
By creating an account or using Geo Nabaa, you agree to this policy.
**Developer:** Ali Hashim
**Contact email:** amxdillw@gmail.com
**Application:** Geo Nabaa (Android package `com.nabba.geoapp`)
---
## 1. Information we collect
### 1.1 Information you give us when you create an account
- **Phone number** — used as your account identifier and how you sign in. We do not send SMS messages and we do not use your phone number for marketing.
- **Password** — stored only as a cryptographic hash by our authentication provider. We never store or see your password in readable form.
- **Security question and answer** — you choose a security question at sign-up so you can recover your account without SMS or email. Your answer is stored only as a SHA-256 hash and is never readable by us or by the app.
- **Display name** — the name shown next to your content.
- **Governorate** — the Iraqi governorate you select from a list. This is information you choose yourself. It is **not** device location, and the app never requests GPS or location permission.
- **Profile picture** — optional, uploaded by you.
### 1.2 Content you create in the app
Questions, answers, articles, comments, votes, bookmarks, uploaded images, and content reports. Content you post publicly (questions, answers, articles, and the display name and profile picture attached to them) is visible to other users of the app, including users who are not signed in.
### 1.3 Photos and camera
The app asks for access to your photo library or camera **only** when you choose to attach an image — a profile picture or an image inside an article or question. We access only the specific images you pick. We do not scan, browse, or upload your photo library.
### 1.4 Device and technical information
- **Push notification token** — a token issued by Firebase Cloud Messaging so we can deliver notifications to your device (for example, when someone answers your question). It is deleted when you delete your account.
- **Locally stored data** — your session and a cache of recently viewed content are stored on your own device so the app works on a slow or interrupted connection. This data stays on your device and is cleared when you log out or uninstall the app.
### 1.5 What we do not collect
- We do not collect your device location, GPS coordinates, or precise location of any kind.
- We do not collect your contacts, call logs, SMS messages, or calendar.
- We do not use advertising identifiers and we do not show ads.
- We do not use third-party analytics or tracking SDKs.
- We do not sell your personal information to anyone, and we never have.
- We do not collect payment information — the app is free and contains no purchases.
---
## 2. How we use your information
We use the information above only to:
- create your account, sign you in, and keep your session active;
- let you recover your account through the security question if you forget your password;
- display your content, display name, and profile picture alongside what you post;
- send you notifications about activity related to you, such as replies to your questions;
- maintain your reputation score and profile;
- review reported content, enforce our community rules, and suspend accounts that break them;
- keep the service secure, prevent abuse, and fix problems in the app.
We do not use your information for advertising, profiling, or automated decision-making.
---
## 3. How your information is shared
We share your information only with the service providers required to run the app:
| Service provider | Purpose | What it processes |
|---|---|---|
| **Supabase** (supabase.com) | Hosting, database, authentication, and file storage | Account data, your content, and uploaded images |
| **Google Firebase Cloud Messaging** | Delivering push notifications | Push notification token and the notification content |
These providers process data on our behalf under their own security and privacy commitments. We do not sell, rent, or trade your personal information, and we do not share it with advertisers or data brokers.
We may disclose information if we are legally required to do so, or where it is necessary to protect the safety of our users or the integrity of the service.
**Administrators.** Our moderators use a separate internal application connected to the same database. They can view reported content, approve or remove content, and suspend accounts. They cannot read your password or your security answer, because both are stored only as hashes.
---
## 4. Data retention and deleting your account
Your account data is kept for as long as your account exists.
You can delete your account at any time from **Profile → Settings → Delete account** inside the app. You may also request deletion by emailing amxdillw@gmail.com from the account you wish to delete.
**When you delete your account:**
- **Permanently erased:** your login credentials and password hash, your profile, your security question and its hashed answer, your bookmarks, your notifications, your push notification tokens, and every profile picture you uploaded.
- **Kept but fully anonymized:** questions, answers, articles, votes, and reports you created are detached from you — the link to your identity is removed, so the content remains for the community's benefit with nothing that points back to you. It is no longer personal data and cannot be traced to your account.
Deletion is permanent and cannot be undone. Backups are purged on our provider's ordinary backup cycle, within 30 days.
---
## 5. Security
- Passwords are hashed by our authentication provider and are never stored in readable form.
- Security answers are stored only as SHA-256 hashes, in a separate table that the app has no permission to read.
- All communication between the app and our servers uses encrypted HTTPS/TLS connections.
- Access to data is enforced at the database level with row-level security policies, so users can only read and write what they are entitled to.
No system is perfectly secure, but we take these measures seriously and work to protect your information.
---
## 6. Children's privacy
Geo Nabaa is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has created an account, please contact us at amxdillw@gmail.com and we will delete it.
---
## 7. Your rights
You may at any time:
- **access** the personal information in your profile, from inside the app;
- **correct** your display name, governorate, and profile picture from Profile → Edit profile;
- **change** your phone number and password from the app's settings;
- **delete** your account and personal data, as described in section 4;
- **turn off notifications** from your device's system settings.
For any request about your data, contact amxdillw@gmail.com. We respond within 30 days.
---
## 8. International users
The app is operated from Iraq and our service providers store data on servers that may be located in other countries. By using the app you consent to your information being processed in those locations, under the safeguards described in this policy.
---
## 9. Changes to this policy
We may update this policy as the app changes. When we do, we will update the "Last updated" date at the top of this page, and we will notify you in the app if the changes are significant. Continuing to use the app after a change means you accept the updated policy.
---
## 10. Contact us
Questions about this policy or your data:
**Email:** amxdillw@gmail.com
**Developer:** Ali Hashim — Geo Nabaa