Privacy Policy

Effective date: August 12, 2026

TahaCourt is a sports-field booking platform in Iraq, available through the mobile app and tahaiq.com. This policy explains what data we collect, why, who we share it with, and how to delete it.

Data we collect

• Account data: name, phone number, and password (stored only as a cryptographic hash). Players optionally: date of birth, height, weight, preferred positions, governorate and city, and a profile photo.
• Venue-owner data: business name and payout account details (Qi Card number or ZainCash wallet number) used to transfer earnings.
• Platform activity: bookings, invitations, teams and friends, match statistics, ratings you give and receive, tournament participation, support messages, and refund requests.
• Payments: processed by licensed payment gateways (Qi Card, ZainCash). We receive and store only the transaction status and amount; the card details you enter at checkout go directly to the payment gateway and never pass through our servers.
• Device data: a push-notification token (Firebase Cloud Messaging), device platform, and IP addresses in security logs.
• Camera and photos: the camera is used only to scan booking QR tickets at the venue gate, and no images are stored. Your photo library is accessed only when you choose a profile picture, a venue picture, or a team logo.
• Location: the app asks for your device location only when you enable the "near me" distance sort. The coordinates are sent to our servers solely to compute venue distances for that request; they are not stored, and there is no background location tracking.

How we use it

• Operating the service: bookings, payments, refunds, owner payouts, ratings, and tournaments.
• Sending verification codes and notifications about your account and bookings.
• Protecting the platform: abuse detection and an audit trail of sensitive operations.
• Answering support messages.

Who we share it with

• Payment gateways (Qi Card, ZainCash) to process payments and refunds.
• A message-delivery provider: your phone number is shared to deliver verification codes over WhatsApp or SMS.
• Google Firebase Cloud Messaging to deliver push notifications to your device.

We do not sell your data, we do not share it with advertising networks, and the app shows no third-party ads.

Retention and deletion

You can delete your account at any time inside the app: Account > Settings > Delete account. Deletion is immediate and irreversible: your personal data is anonymized (name, phone, photo, physical attributes, payout details), all devices are signed out, and push tokens are removed.

If you no longer have the app installed, submit a request on the account deletion page; we verify you control the number and complete the request within at most 30 days.

Security

All traffic is encrypted with TLS, passwords are hashed with Argon2id, and administrative access is role-restricted and audit-logged.

Children

The service is not directed at children under 13, and we do not knowingly collect their data.

Changes to this policy

For material changes we will update this page and announce the change in the app before it takes effect.

Contact

For privacy questions: in the app via Account > Settings > Contact support, or through the support page.