Delete your account
This page explains how to delete your Kelshi account, which data is removed, and how long it takes.
How to request deletion
If you can sign in, open the Kelshi app, go to Profile, choose Delete Account, and confirm.
- If you cannot sign in, email [email protected] from the address linked to your account, or call +963 94005499, and tell us which account you want deleted. Never send passwords, verification codes, or social sign-in credentials. Kelshi does not infer or guess account ownership from an email address alone.
- We may ask for reasonable proof of identity before we act, so that nobody else can delete your account.
How to contact us
Kelshi LLC, Alnofous Building, Sheikh Daher, Latakia, Syria. Phone: +963 94005499. Email: [email protected].
What data is deleted
A verified deletion request removes or irreversibly de-identifies the data linked to your account in Kelshi's active systems, within the limits described below.
- Account, profile, contact, authentication, session, social-sign-in linkage, device registration, installation, and push-notification identifiers linked to the account. After verified deletion, provider email and provider metadata are removed; where technically required to prevent reassignment of a retired social identity, Kelshi retains only a non-reversible keyed hash of the former provider identifier.
- Listings, images, support messages, reports, reviews, saved items, carts, orders, bookings, delivery details, healthcare requests, prescriptions, and insurance-card images submitted through the account are removed from Kelshi and unlinked from the account. Prescription photos, your profile photo, cover photo and identity-document image, and insurance-card images from your bookings are also deleted from storage; stored photo files of your listings are deleted in a separate clean-up.
- Account-linked precise or coarse location, search and browsing activity, analytics identifiers and events, and synchronized offline state are deleted or irreversibly de-identified. Crash and diagnostic reports sent through Google Firebase Crashlytics are not linked to your account, so they cannot be selected for deletion; they expire after 90 days.
- For report records, direct user and administrator identifiers, names, email addresses, IP addresses, user agents, URLs, metadata, and free text are removed or irreversibly de-identified; only aggregate, non-identifying counters may remain. For audit records, those direct identifiers and free text are removed or irreversibly de-identified; only non-identifying type, status, timestamps, and counters may remain.
Retention, backups, and service providers
Some records may be kept longer where the law requires it, or where they are needed for security, fraud prevention, a dispute, accounting, or a transaction.
- Copies in encrypted backups, short-lived offline queues, or the systems of the service providers listed in our privacy policy can take longer to disappear than active account data; they are removed as those systems are cleared in their normal cycle.
- The retention period for each type of data and the list of service providers are shown below.
How long we keep data
| Account data and linked content | Kept until you delete your account, then removed within 30 days, except what the law requires us to keep. |
|---|---|
| Prescription photos | Deleted 30 days after the order is completed or cancelled. |
| Crash reports | 90 days. |
| Usage analytics and live sessions | 90 days. |
| Push notification token | No longer used and detached from your account when you sign out; deleted when you delete your account, or after 12 months without use. |
| Contact and support messages | 12 months. |
| Account-deletion requests | Completed within 30 days. |
| Imported profile photo | Kept until you replace it or delete your account; included in account deletion within 30 days. |
| Application email-sending records (including password-change notices) | Records become eligible for scheduled deletion 30 days after the application's sending attempt reaches a terminal sent or failed state. Records still referenced by a verification challenge are retained until that reference is removed. When you delete your account, we remove account links and message payloads from its sending records. This period does not describe retention in mail-server logs, mail queues, spam quarantine, backups or your email provider's mailbox. A sent state in the application does not confirm delivery to your inbox. |
Service providers and recipients
| Hosting | Kelshi's own servers store and process the data needed to run the service. |
|---|---|
| Cloudflare | Routes requests to our website through its network and delivers some map resources. It processes connection and request information, such as your IP address and requested URL, to provide these services. Our website also instructs supported browsers to send network-error reports to Cloudflare for connection diagnostics; this is separate from Kelshi's optional usage analytics. |
| Email delivery | Kelshi submits account and security emails through its server's local mail system. Messages are processed by an Imunify Email/Rspamd spam filter running on that server. To deliver a message, your email service provider receives your email address, the message content and delivery information, and handles them under its own terms. |
| Google Firebase Cloud Messaging | Delivers push notifications to your device using its push token. |
| Google Firebase Crashlytics | Receives crash reports from the app, only if you have agreed to analytics. |
| Google Sign-In, Sign in with Apple and Facebook Login (Meta Platforms) | Verify your identity when you choose these sign-in services and, for Google and Facebook, may provide a profile picture. On the website, the Google script loads when its sign-in control appears; the Meta script can load on pressing the Facebook button before its click completes. |
| Maps and place names | OpenStreetMap supplies map tiles (and place-name lookup on the website's provider sign-up page), Google Maps shows embedded maps on some website pages, and your device's built-in geocoding service (Apple or Google) turns coordinates into place names in the app. These services receive your IP address and the map area or coordinates involved. |
| YouTube | Plays a listing's video when the listing includes one. |
| Businesses, providers, and pharmacies | Receive only what is needed for the enquiry, booking, or order you make with them, such as your name, phone number, delivery address, and, for pharmacy orders, your prescription photo. |
| Transfers outside Syria | Google, Apple, Meta, Cloudflare, OpenStreetMap and your email service provider may process data on servers outside Syria under their own privacy terms. |
| No sale of data | We do not sell personal data or share it with advertisers or data brokers, and we disclose data to authorities only when the law requires it. |
Completion and what happens next
The time it takes to complete a deletion request is shown below.
- Once deletion is complete, you can no longer sign in to the deleted account, and it cannot be restored.
Account deletion timeline
We complete verified account-deletion requests within 30 days. The data linked to the account is then removed, except records that the law requires us to keep.