Rayyeh — Privacy Policy

Effective date: 26 June 2026

This is the privacy policy for Rayyeh ("the app", "we", "us"), a marketplace
for short-stay rentals, hotels, car rentals, and organized trips operating in
the West Bank. Rayyeh is operated by Laith Amro, an individual operator.

If you have any question about this policy, you can reach us at:
amrlaith05@gmail.com (or update with your support address before launch).

1. What we collect

When you use Rayyeh, we collect:

Information you give us

• Phone number — required for OTP login. Stored in E.164 format.
• First name, last name — required to complete your profile and identify

you to a host you book with.

• Email address — optional, used for receipts and account recovery.
• Profile photo (avatar) — optional, stored as a small JPEG in our database.
• Bio — optional, shown on the profile screen.
• For hosts: about-you text and payout reference (an opaque identifier; we

do not store bank account numbers).

• Listing content — title, description, photos, location coordinates,

amenities, pricing, and availability for the places, cars or trips you list.

Information generated when you use the app

• Booking records — listing, dates, guest count, total, status. Retained

for tax and dispute reasons even after account deletion (see §6).

• Reviews — ratings and comments you write or receive.
• Wishlists — listings you saved.
• Authentication sessions — short-lived access tokens + rotating refresh

tokens. Hashed before storage.

• Notifications — in-app messages from the booking flow.

Information collected automatically

• Approximate location — only used when you tap "use my current location"

to drop a map pin. Not tracked in the background.

• App diagnostics — Apple sends crash reports + performance data to us if

you opt in via iOS Settings. We do not have a separate analytics SDK.

What we do NOT collect

• We do not collect your contacts, browser history, or photos library beyond

the specific photo you pick.

• We do not have any advertising trackers.
• We do not sell your data to anyone, ever.

2. How we use what we collect

We use your information only to:

1. Run the marketplace — match guests to hosts, calculate prices, manage
bookings, send booking notifications.
2. Authenticate you — verify your phone number via one-time SMS code on
sign-in.
3. Communicate with you — send booking-related notifications in-app and
the OTP code by SMS.
4. Comply with the law — keep booking and payment records for the tax and
audit periods required by Palestinian law.
5. Improve the app — read crash reports + diagnostics you've opted in to.

We do not use your data for advertising or for any third-party profiling.

3. Who sees what

• The host of a listing you book sees: your first name, your phone number,

your booking details (dates, guests).

• A guest who books your listing (if you are a host) sees: the booking

reference, your first name, the listing details.

• The Rayyeh operator (Laith Amro) can access all account and booking

records as the database administrator. This access is used only for support
and legal purposes.

• Apple receives the diagnostics + crash data you opt in to.
• Twilio, our SMS provider, receives your phone number to deliver OTP

codes. They do not retain the message body beyond the delivery window.

• Railway, our hosting provider, runs the servers that process and store

your data. They do not have application-level access to your records.

We do not share data with anyone else. We will only release data to law
enforcement or other third parties if compelled by a valid legal order or to
prevent imminent harm.

4. Where your data lives

Your data is stored in a PostgreSQL database hosted by Railway in the
United States. Avatars and listing photos are stored as bytes in the same
database (we do not use a third-party CDN).

5. How we protect it

• Phone numbers are normalized to E.164 and stored as plain text (necessary

for lookup); the OTP code itself is argon2-hashed before storage and
only ever lives for 5 minutes.

• Refresh tokens are argon2-hashed; we never store the raw token.
• Passwords for legacy email accounts are argon2-hashed.
• All app→server traffic uses HTTPS.
• We rate-limit OTP requests per phone (8/hour) and per IP (20/hour) to

reduce abuse.

No system is perfectly secure. If we ever discover a breach affecting your
data, we will notify you within 72 hours of discovery.

6. Account deletion and your rights

You can delete your account at any time from Profile → Personal
information → Delete account.

When you delete your account:

• Your phone, email, name, avatar, and bio are immediately removed.
• Any pending or confirmed bookings you have as a guest are cancelled.
• Any places you list as a host are unlisted.
• All your refresh tokens are revoked (you are signed out everywhere).
• Your wishlists and notifications are deleted.

We retain anonymized booking and payment records for tax and dispute
purposes (Palestinian tax law requires we keep these for 7 years). These
records no longer identify you — your name is gone, your phone is gone, only
the transaction shape remains.

You can also write to us at amrlaith05@gmail.com to:

• Get a copy of the data we hold on you
• Correct anything wrong
• Ask us to stop processing your data

We will respond within 30 days.

7. Children

Rayyeh is not directed at children under 13, and we do not knowingly collect
their information. If you are a parent and discover your child has signed up,
contact us at amrlaith05@gmail.com and we will delete the account.

8. Changes to this policy

If we make a material change to this policy, we will notify you in-app and
update the Effective date above. The previous version remains available on
request.

9. Contact

Operator: Laith Amro (individual)
Email: amrlaith05@gmail.com
App: Rayyeh