Privacy Policy

Who we are and what this policy covers

Kelshi is a directory and marketplace for Syria. It helps you find businesses and services, save listings, contact providers, and place orders or bookings, including pharmacy orders and healthcare appointments. This policy applies to all of these features on the website and in the apps.

Account, contact, and sign-in information

We use the information you give us to create and secure your account, keep you signed in, provide support, and put you in touch with the providers you choose.

• Name, email address, phone number, profile photo and details, address, city or area, account identifiers, and sign-in and session records. When you sign up, you choose your city. If you live outside Syria, you can instead choose your country and city of residence from a list of places based on GeoNames data, or type your city's name. In your profile you can also add, if you wish, your first and last name, gender and date of birth; the date of birth must show an age between 18 and 90. Your country and city of residence and these optional details are shown only to you in your account, not on your public profile or listings. Authorised Kelshi staff can see them in the account records and exports used to run the service and to support you, and they are deleted when you delete your account.
• If you sign in with Google, Apple or Facebook, we receive the provider identifier and sign-in credential, together with your name and email address when available. Google and Facebook may also provide a profile-picture link. Kelshi does not guess email ownership from a social identity. After verified account deletion, provider email and metadata are removed; where needed to prevent reassignment of a retired identity, we retain a non-reversible keyed hash of the former provider identifier.
• Facebook Login (Meta Platforms): On iPhone and iPad, Kelshi prepares the Facebook SDK when you choose Continue with Facebook and uses Limited Login. On Android, SDK automatic initialization, automatic app events and advertising-ID collection are disabled. On the website, the Meta SDK starts loading when you press down on Continue with Facebook, before the click completes, or when you activate the button. Meta receives the sign-in request and technical information such as your IP address and device or browser details. We request only public profile and email. On iPhone and iPad, our server verifies the signed token using Meta public signing keys. On Android and the website, our server sends the access token to Meta to validate it and retrieve your profile. We do not store the raw Meta sign-in token in your Kelshi account record. We do not receive your Facebook password, friends or posts, send Kelshi analytics to Meta, or use Facebook Login for advertising or tracking.
• Google Sign-In: When you choose Continue with Google, Google provides its sign-in interface and a signed token, which our server verifies. On the website, when Google sign-in is available, its script loads when its control appears on a sign-in or sign-up page or in the sign-in dialog. Google can therefore receive your IP address and browser details before you choose to sign in.
• Profile photo from Google or Facebook: When a Google or Facebook identity is first attached to your account, and your account has no profile photo or previous imported photo, our server may download the provider picture in a background job. It re-encodes the image to remove metadata and stores a copy as your Kelshi profile photo. It does not replace an existing photo. After a successful import, it does not import another provider photo for that account. You can replace it in your profile; the stored photo is included in account deletion. Apple does not provide a profile picture.
• Profile photos, listing images, support messages, problem reports, reviews, and any other content you choose to submit.
• If you register as a business or service provider, we ask for a photo of an identity document to verify the account. You can also add or replace it later in your profile. It is kept with your account and deleted when you delete your account.

Location and maps

If you allow location access, we use your device's latitude and longitude to show nearby results, calculate distances, open maps, fill in your city or address, and support delivery. Location is optional; you can search by city instead.

• Your coordinates may be kept briefly in your browser's session storage or in the app's settings on your device, and are sent to Kelshi's servers with search, listing, healthcare, delivery, or filter requests.
• To turn coordinates into a place name, the app sends them to the external reverse-geocoding service built into your device (provided by Apple or Google). Maps in the app and on the website load from OpenStreetMap or Google Maps, which receive your IP address and the map area shown.
• The app asks for location only while you are using it. It does not track your location in the background, and you can turn location access off at any time in your device settings.

Orders, bookings, and health information

We process the details needed to run carts, orders, bookings, appointments, pharmacy requests, and related support.

Health-related information is used only to arrange the appointment, test, or pharmacy order you request, and is shared only with the provider or pharmacy that handles it.

• Cart contents, quantities, saved items, the provider or service you choose, booking date and time, traveller names or seats, order notes, and order or booking status.
• Delivery and billing contact details such as name, email, phone, street, city or area, and delivery coordinates.
• Healthcare appointments, selected tests or services, pharmacy products, and prescription images when a product requires a prescription. Because these can reveal information about your health, we treat them as sensitive data.
• Radiology and healthcare booking forms may ask for your birth date, national number, and a photo of your insurance card, together with your name, phone, email, the selected service, and appointment details.
• We use these sensitive details only for the booking or pharmacy order you request. They are sent only to the healthcare provider or pharmacy handling it, and they are kept for the periods listed under “How long we keep data” below.
• You pay for orders and bookings directly to the provider. Kelshi does not process card payments and does not store card details (see “Payments” below).
• When you order a medicine that needs a prescription, you can upload a photo of the prescription. It is shared only with the pharmacy handling your order, used only to fulfil that order, and deleted 30 days after the order is completed or cancelled. You can ask us to delete it sooner.
• Some booking and checkout forms let you enter contact details for someone else, for example the name, phone number, or email of a relative you book an appointment for, or of the person who receives an order. We use those details only to arrange that booking or order and share them only with the provider or pharmacy handling it. Please enter another person's details only if they know you are doing so.

Saved items, search, and analytics

We process your choices and some technical information to provide the features you use, keep you signed in, and fix problems. Optional analytics collection starts only after explicit opt-in and can be disabled afterward; core features do not require analytics consent.

• Saved or favourite items, cart activity, search terms, number of results, filters, categories, listings and providers you view, and taps on contact, map, share, banner, or navigation buttons.
• With analytics on, the website can record the full page URL (including its query string), page path, referrer, campaign parameters, browser user agent, language, text direction, timestamps, error signals, and a session or guest identifier. Kelshi does not retain or persist a raw visitor IP address in analytics records.
• Website page statistics (Cloudflare Web Analytics): kelshi.com is delivered through Cloudflare, which adds its Web Analytics script to website pages for every visitor. This is separate from Kelshi's optional analytics and does not depend on that choice. It sets no cookies, uses no local storage, and does not fingerprint visitors. It measures the page address, referrer, browser and device type, country, and page load timing, and gives us only aggregated statistics, such as visits per page. We use them to see which pages are used and how fast the site loads. The Kelshi apps do not use it.
• With analytics on in the app, an event can include a randomly generated device identifier, app version and build, platform and operating-system version, screen, timestamps, error signals, and whether you received or opened a notification.
• If you allow notifications, Google Firebase Cloud Messaging gives the app a push token so that we can send you notifications. We store the token with your account (or as an anonymous device if you are not signed in), together with a generated device identifier, app version and build, platform, language, and timezone. When you sign out, we stop using the token and detach it from your account; it is deleted when you delete your account, or after 12 months without use. You can turn notifications off in your device settings.
• Analytics events may include a session or guest identifier and, for signed-in app users, an account identifier. Our analytics code removes any field named like an email, phone, password, token, authorization, or secret before sending.
• Analytics transport is off by default. Collection starts only after you opt in and stops as soon as you withdraw that choice.
• Usage sessions (only with your consent): if you turn on “Share usage analytics” in the app's Settings, the app sends a short signal about every 30 seconds while it is open on your screen, never in the background. We use it to count active sessions. The signal carries a random session key that is not your name, the country derived from your IP address (we do not store the IP address itself), your app version and language, and your city only if you have allowed location access. Session records are deleted after 90 days. You can turn this off at any time in Settings.
• Crash reports (only with your consent): the app sends crash reports through Google Firebase Crashlytics. They contain technical data only, such as device model, operating-system version, app version, and the error trace. They are not linked to your account, are used only to fix problems, and are kept for 90 days.

Why we use your information

• To provide and secure accounts, sign-in, profiles, search, saved items, carts, bookings, appointments, orders, delivery, notifications, and support.
• To show nearby or relevant results, calculate distances, name locations, and open the maps or contact options you request.
• To prevent abuse, investigate errors, protect the service, meet legal obligations, and improve reliability and accessibility.
• To measure how features are used, and only if you have turned analytics on.

Storage, retention, and deletion

Data is stored on Kelshi's servers and, depending on the feature, in your browser's local or session storage, or on your device in the app's settings, secure storage, offline cache, and a small analytics queue.

You can delete your account in the app (Profile, then Delete Account) or follow the steps on our Delete Account page. Some records may be kept longer where the law requires it, or where they are needed for security, fraud prevention, or a transaction dispute.

• The retention period for each type of data is listed below.

Service providers and other recipients

We use a small number of service providers to run Kelshi. Each one receives only the data needed for its task and processes it under its own terms.

• They include sign-in with Google, Apple and Facebook (Meta), push notifications and crash reporting from Google Firebase, Cloudflare network services and website page statistics, local email delivery and the recipient’s email provider, map and place-name services, and embedded videos. The full list is below.
• When you contact, book with, or order from a business, provider, or pharmacy, we pass on only the details needed for that request. We do not sell personal data or share it with advertisers.

Security

We use technical and organisational safeguards to protect your data against unauthorised access, loss, alteration, or disclosure. Our apps and website connect to our servers over HTTPS, and protected actions require a signed-in session. No system is perfectly secure.

• Never share verification codes or your password with anyone. Contact info@kelshi.com if you think someone has misused your account.
• Password-change notices: For an active account with an email address, a password change through a reset link, the app or our support team queues a security email containing the time of the change and links to reset your password and contact support. It contains no password and is not marketing.

Your rights and choices

You can ask to access, correct, or delete your personal data, withdraw your consent at any time, and object to processing. You can also turn off device permissions, such as location or notifications, in your browser or device settings.

• Use Profile or Settings to update your details, and the Delete Account page for the deletion steps.
• Send privacy questions and requests to info@kelshi.com. We may need to verify your identity before we act on a request.

Children

Kelshi is intended for adults aged 18 and over.

Changes to this policy

If we change this policy, we will update this page and its effective date. If a change significantly affects how we use your data, we will also tell you in the app or on the website.