Last updated: 10 October 2026
This policy explains what information YallaMazad collects and why - so you can bid and buy with confidence.
This page explains what information YallaMazad collects, why, and how it is used. Cash-on-delivery means we never collect your card or bank details.
Your phone number is your primary sign-in identity. You choose a password, which we store hashed, never as plain text. You may optionally add an email address for password reset and win notifications.
We collect your name, governorate/city, district, address, and a landmark, so we and our couriers can deliver items you win.
Photos of auction and store items are uploaded by our team and stored to display listings.
If you ask to return an item, you can attach up to 3 photos of it to your return request. These photos are stored privately: only you and our staff can see them. They stay with the return record, even if you later delete your account.
Every bid you place is recorded permanently and can never be edited or deleted - this is enforced by the database itself.
We retain the order record for every item you win, and update it as delivery progresses (for example when it moves from confirmed to delivered). Every status change is also logged permanently in a separate, append-only history, so the full record of how an order progressed is never lost - together these are our accountability trail for pricing and delivery disputes.
When you check out in the store, we save a copy of your delivery address (city, district, address and landmark) with that checkout, so your order goes to the address you confirmed.
If you request a return, we store your request: the reason you write, any photos you attach, and its status.
We keep a record of your store credit, free deliveries, gift boxes and the prizes you won from them.
Every account has an invite code. If you invite a friend, or a friend invites you, each of you can see the other's first name, the status of the invite and its dates. Nothing else about the other person is shown.
We store the auctions you watch and the notification choices you make, so we only alert you about what you asked for.
When you place a bid, your first name is shown next to that bid in the auction's bid history, where other signed-in users can see it. This is deliberate: a ladder of anonymous codes makes real bidding look fake, and showing real first names is how you can tell you are bidding against real people.
Only your first name is shared this way. Your family name, phone number, email address, and delivery details are never shown to other bidders. If your profile has no name saved, your bids appear under an anonymous per-auction code instead, such as "Bidder #a1f4".
If you enable push notifications, we store a device token on our servers so we can alert you about outbid warnings, auctions ending soon, and order updates. We send these through Google Firebase Cloud Messaging, which delivers to Apple devices through the Apple Push Notification service. We remove the token on a best-effort basis when you sign out, and tokens that stop working (for example after the app is uninstalled) are detected and removed automatically.
If you use Live Activities on iPhone, we also store the tokens Apple gives us for that Live Activity so we can keep it up to date. They are deleted when you delete your account.
We remember your language and light/dark theme choice in a small cookie on your device, so the app opens the way you left it.
We use a third-party error-monitoring service (Sentry) to capture crash reports and technical error details when something goes wrong, so we can fix bugs. We do not attach your name or phone number to these reports. Some server-side error reports include an internal account ID, which we use only to find and fix the problem. This data is used for troubleshooting only, never for marketing.
We send phone verification codes through a WhatsApp/SMS delivery processor (OTPIQ), which delivers them through WhatsApp (Meta) or mobile carriers. If OTPIQ is unavailable, we may send the code as a text message through a backup provider (Twilio). Our verification-message logs keep a hashed fingerprint of the phone number (not the readable number) to detect abuse. If you added an email, we may send account and order emails - such as "you won" or delivery updates - through an email delivery processor (Resend).
We may collect the IP address used at signup and at sign-in to prevent banned users from returning. When collected, this information is kept separately, restricted to admin review, and used only to flag accounts that may share a network with a banned account for manual review - never to block anyone automatically.
We recognise many people in Iraq share networks, such as mobile carrier networks, so this is a review signal, not an automatic penalty.
A sign-in IP address kept for fraud and ban-evasion review is deleted automatically once it has not been seen for 180 days. Sign-in logs kept by our authentication system also contain IP addresses; they are erased within 24 hours of deleting your account. The Delete Your Account page explains the rest.
Staff can look up your account using the email address you provided, through an internal admin-only search tool - used for support and to review accounts that may be evading a ban.
If you send feedback, a support chat message, or a ban appeal from the app, it is stored together with your account and can be read by staff to respond to you and improve the app.
If you left your WhatsApp number (and, optionally, your name) on our coming-soon page, we keep it to message you on launch day and to match it to your account when you sign up, for example to give you a launch gift if we offer one. On that page we also keep a scrambled (hashed) form of your network address to count visits and limit abuse, and we set a small cookie for one year so the same visit is not counted twice. We do not keep the address itself.
To operate auctions and the store, verify identity, arrange delivery and returns, manage your wallet and gift boxes, prevent fraud and abuse, send you notifications about your bids and orders, contact you by phone or WhatsApp about your order or delivery (including sending your order receipt), respond to support requests, and meet our legal obligations.
We do not sell your personal information. We do not show ads, and we do not track you across other apps or websites. We share your delivery details (name, address, phone) with the courier fulfilling your order.
Service processors that handle data on our behalf are: Supabase (database, sign-in and file storage), Vercel (hosting), Sentry (error monitoring), Google Firebase Cloud Messaging and Apple Push Notification service (push notifications), OTPIQ (verification codes by WhatsApp or SMS) with Twilio as a backup, and Resend (email). We may disclose information if required by law.
You can review and update your profile from Account > Profile. You can turn off push notifications on your device. You can delete your account yourself from Account > Settings, or ask Support to delete it if you can't sign in.
You can delete your account yourself at any time. Your name, phone number, city, district, address and landmark are erased, your devices and watchlist are removed, and the sign-in records our login system kept for you are deleted within 24 hours.
Your bids, orders, return requests (with their reason and photos), support messages, and wallet, gift box and invite records are kept, linked only to an anonymized account record. Unused credit and unopened gift boxes are lost. Verification-message logs keep a hashed fingerprint of your phone number (not the readable number), and these logs are kept after deletion. A sign-in IP address kept for fraud review is deleted with your account, unless the account had been banned; then it is deleted automatically no later than 180 days after it was last seen.
The Delete Your Account page has the full list.
YallaMazad is for people who are 18 or older. We do not knowingly collect information from anyone under 18.
We use industry-standard access controls to restrict who can read or write your data, and passwords are stored hashed. No online service can guarantee complete security.
We may update this policy from time to time. The date at the top of this page shows when it was last revised.
Questions about this policy? Visit the Support page.