## 1. Introduction

This policy explains what personal data we collect when you use the Koshk mobile

application, why we collect it, who we share it with, and the choices you have.

By using Koshk, you agree to this policy.

## 2. Information We Collect

### 2.1 Information you give us

| Data | When | Why |

|---|---|---|

| Name | Registration | To identify your account and your orders |

| Mobile number | Registration / login | It is your login identity; we send a one-time code (OTP) to verify it, and use it to contact you about orders |

| Country | Registration | To apply the correct dialling code and service area |

| Delivery addresses — governorate, city, block, street, avenue, building, apartment, and map coordinates (latitude/longitude) | When you add an address | To deliver your order to the right place |

| Order contents, favourites, and promo codes | When you shop | To process and deliver your orders and show your history |

| Messages you send us | When you contact support | To answer you |

### 2.2 Device location

If you grant permission, Koshk reads your device's location **only while the app

is open and in use**, and only to centre the map and pin your delivery address.

We do **not** track your location in the background, and we do not follow your

movements. You can refuse or withdraw this permission at any time in your device

settings — you will simply need to place the map pin manually.

### 2.3 Information collected automatically

- **Crash diagnostics (Firebase Crashlytics).** If the app crashes, we receive a

 technical report — device model, operating system version, app version, and the

 technical state of the app at the moment of the failure — so we can fix the fault.

- **Usage analytics (Google Analytics for Firebase).** We receive aggregated

 statistics about how the app is used, such as which screens are opened and how

 often the app is launched, together with general technical and regional

 information. We use this to improve the app.

- **Notification token.** A token identifying your app installation, so we can send

 you notifications about your orders.

We do **not** use the Advertising Identifier (IDFA), we do **not** track you

across other companies' apps or websites, and we do **not** show third-party ads.

### 2.4 Payment information

Card payments are processed **entirely by our third-party payment provider**

inside a secure payment page. **We never receive, see, or store your card number,

expiry date, or CVV.** We only receive the result of the transaction (success or

failure) and a reference for your order. Cash-on-delivery orders involve no card

data at all.

### 2.5 What we do not collect

We do not access your camera, photo library, contacts, microphone, calendar, or

health data. The app does not request these permissions.

## 3. How We Use Your Information

We use your data to:

- create and secure your account, and verify your number by OTP;

- process, fulfil, and deliver your orders, and support returns or refunds;

- share the details a store or delivery driver needs to complete your order;

- notify you about your order status;

- respond to your support requests;

- detect and prevent fraud and misuse;

- fix crashes and improve the app's performance and content;

- comply with applicable law.

## 4. Who We Share It With

We share your data only as far as necessary, with:

- **Stores/merchants** fulfilling your order — the details required to prepare it;

- **Delivery drivers** — your name, mobile number, and delivery address;

- **Our payment provider** — to process your card payment;

- **Google/Firebase** — as our analytics, crash-reporting, notification, and maps

 service provider;

- **Authorities** — where required by the law of the State of Kuwait, or to protect

 our rights or the safety of others.

**We do not sell your personal data, and we do not share it for advertising.**

## 5. Data Retention

We keep your account data for as long as your account is active. Order records are

kept for as long as needed for accounting, tax, and legal obligations, even after

account deletion. Crash and analytics data is retained by our service provider for

a limited period in line with their standard retention settings.

## 6. Deleting Your Account

You can delete your account at any time from inside the app:

**Profile → Delete Account.** Deleting your account removes your profile, your

saved addresses, and your favourites. Records we must retain by law (such as

invoices for completed orders) are kept as described in section 5.

## 7. Security

Traffic between the app and our servers travels over encrypted HTTPS. Your login

token is stored using the operating system's secure storage (Apple Keychain /

Android Keystore). No system is perfectly secure, but we take reasonable technical

and organisational measures to protect your data.

## 8. Children

Koshk is not directed at children and is not intended for use by anyone under

[[16]] years of age. We do not knowingly collect data from children. If you believe

a child has provided us data, contact us and we will delete it.

## 9. Your Rights

You may request access to, correction of, or deletion of your personal data, or

object to a particular use of it. Contact us using the details in section 11. You

can correct your name and mobile number yourself in the app at any time.

## 10. Changes to This Policy

We may update this policy. We will change the "Last updated" date above and, if the

change is significant, notify you in the app.