Privacy Policy

Information you provide directly:

• Account information: name, email address, profile photo, and bio when you register or update your profile.
• Business information: business name, address, phone number, website, hours, and photos when you claim or create a business listing.
• User-generated content: reviews, ratings, marketplace listings, event posts, job postings, service requests, quotes, Q&A posts, community posts, and messages.
• Payment information: billing details submitted during subscription or event ticket checkout (processed by Stripe — we do not store raw card numbers).
• Communications: emails or support messages you send to us.

Information collected automatically:

• Usage data: pages visited, searches performed, features used, timestamps, and click data.
• Device and log data: IP address, browser type, operating system, referring URLs, and crash reports.
• Location data: if you grant permission, your approximate GPS location is used to show nearby listings, marketplace listings, and events. We do not store precise GPS coordinates beyond the current session.
• Cookies and similar technologies: see Section 7 below.

Information from third parties:

• Google OAuth: if you sign in with Google, we receive your name, email address, and profile photo from Google. We do not receive your Google password.
• Google Maps Platform: when a Google-linked listing is viewed, we request current place-photo metadata and media to display attributed Google Maps photos. We do not persist Google photo files or photo resource names.
• Stripe: we receive limited payment-related information such as subscription status, checkout status, payment IDs, refund IDs, and ticket order totals. We do not receive or store raw card numbers.

We use the information we collect to:

• Operate and provide the Platform, including displaying listings, processing bookings, selling event tickets, enabling messaging, and managing subscriptions.
• Personalize your experience — for example, showing relevant listings and events based on your neighborhood or search history.
• Send transactional emails: booking confirmations, event ticket confirmations, refund notices, review notifications, new messages, RSVP updates, application status changes, and billing receipts.
• Send push notifications if you have opted in via your browser or device.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Analyze usage trends to improve the Platform.
• Process referral program tracking.
• Comply with legal obligations.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contractual necessity: to provide the Platform services you have requested (account management, bookings, event ticketing, messaging, subscriptions).
• Legitimate interests: to operate and improve the Platform, prevent fraud, and communicate with you about your use of the service.
• Consent: for push notifications and location access, which you may withdraw at any time.
• Legal obligation: where we are required to process data to comply with applicable law.

We share personal information only as described below:

• Service providers: Neon (database hosting), Vercel (cloud hosting), Stripe (payment processing), Ably (real-time messaging infrastructure), and email delivery providers. These providers process data on our behalf and are contractually required to protect it.
• Other users: your public profile (display name, photo), reviews, marketplace listings, event RSVPs, community posts, and Q&A answers are visible to other Platform users as part of the service.
• Business owners and event organizers: when you book an appointment, submit a service inquiry, RSVP, or buy an event ticket, the relevant owner or organizer receives information needed to fulfill the request, manage attendance, or check you in.
• Legal requirements: we may disclose information if required by law, subpoena, or to protect the rights, property, or safety of Qurba, our users, or others.
• Business transfers: in the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

We request access to your device's location only to enable proximity-based features (nearby listings, marketplace listings, events). Location access is optional — you can use the Platform without it, though some features will be limited. You can revoke location permission at any time in your browser or device settings. We do not share precise location data with third parties or use it for advertising.

With your consent, we may send browser push notifications about messages, bookings, job applications, and other activity on the Platform. You can opt in or out at any time from your Settings page or through your browser's notification settings.

We use the following types of cookies and similar technologies:

• Strictly necessary: session cookies required to authenticate you and maintain your login state (Auth.js).
• Functional: cookies that remember your preferences (e.g., saved filters).
• Analytics: we use Vercel Analytics and Google Analytics 4 (via Google's gtag) to understand how the Platform is used. Google may set cookies and collect usage data subject to Google's privacy policy; you can control cookies in your browser settings.
• Discovery measurement: Explore may use a random browser identifier to measure which listings were shown or opened. We do not store your search text, precise location, or raw IP address with these events.

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in.

We retain your personal information for as long as your account is active or as needed to provide the Platform. Specific retention periods:

• Account data: retained until you delete your account.
• Messages: retained until you delete your account or both parties delete the conversation.
• Reviews and public content: may remain visible after account deletion in anonymized form.
• Payment and billing records: retained for 7 years to comply with financial recordkeeping laws.
• Server logs: retained for up to 90 days.
• Explore discovery impressions and listing clicks: retained for up to 90 days.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your account and associated personal data. You can initiate this directly from Settings → Account → Delete Account, or by emailing us.
• Data portability: request an export of your data in a machine-readable format. Available from Settings → Account → Export My Data.
• Objection / restriction: object to or request restriction of certain processing activities.
• Withdraw consent: where processing is based on consent (push notifications, location), withdraw it at any time.

To exercise any of these rights, contact us at privacy@qurba.app. We will respond within 30 days. We may require identity verification before fulfilling requests.

California residents may have additional rights under the CCPA, including the right to know what personal information is sold or disclosed and the right to opt out of sale. We do not sell personal information.

We implement industry-standard security measures including TLS encryption in transit, encrypted database connections, access controls, and periodic security reviews. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password and to report any suspected unauthorized access immediately.

The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us at privacy@qurba.app and we will promptly delete it.

Qurba is operated from the United States. If you access the Platform from outside the US, your information will be transferred to and processed in the US. For EEA/UK users, we rely on Standard Contractual Clauses or other appropriate safeguards for international data transfers where required.

We may update this Privacy Policy periodically. We will notify you of material changes by posting the revised policy on this page and updating the “Last updated” date. We encourage you to review this page regularly. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are in the EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.