Privacy Policy

1. About this policy

This Privacy Policy explains how Mayvand Khaliq, an individual doing business as Toshak in California, United States ("Toshak", "we", "us") collects, uses, shares and protects personal information when you use the Toshak apps and the toshakapp.com website (the "Service"), and the choices and rights you have. We are responsible for (the "controller" of) your information.

The short version: we collect what we need to run a community app, we never sell your information, we do not use it for targeted advertising, and you can delete your account at any time.

2. Information you give us

• Account: your name, email address or phone number, and password (stored only in scrambled, "hashed" form). If you use Sign in with Apple or Sign in with Google, we get your name, your email address (or an Apple private relay address if you hide yours) and an account ID from them. We never get your Apple or Google password.
• Profile: display name, @username, photo and other profile photos, a short bio, and the location you choose to show (your city area, your state only, or hidden).
• Communities: the countries, states and cities you join, and any new city you ask for.
• Content: messages in group chats and private messages, voice messages, photos, videos, files, polls and votes, reactions, listings, events and the events you are going to, comments on events (visible to the members of that city), reviews and saved messages.
• Reports, appeals and support: what you report, your reason and any note, appeals and support requests you send us (with your app version and phone type), and our answers.
• Support: messages you send us.
• Invites: if you sign up from someone's invite link, we record who invited you, so they can earn leaderboard points. If you sign up after scanning a business's Toshak QR code, we record which business it was, so we can count how many people each business brought.
• Claiming a business: if you ask to claim or remove a business listing without the code from our letter, we collect your name, role, phone number and, if you give them, your email, the best time to call and a note. Only Toshak's team sees them, we use them only to call you and the business to check, and we delete them 90 days after we decide.
• Location you share: only when you choose to share a place or your current location in a chat. It is sent as a message, so the people in that chat can see it. We do not track your location in the background.

3. Information collected automatically

• Device and log data: device type, operating system, app version, language setting, IP address, and when you use the Service.
• Crash and error reports: when the app runs into an error, it sends us the error message, technical details, your device type and app version, the screen you were on, and your account ID, so we can fix it.
• Online status: when you were last active, used to show "online" and "last seen". You can hide your last seen in Privacy and Security.
• App usage: which part of the app is open (for example chats, events, services or Toshak Nikah), which group chat you have open, and how long the app stays open, so we can count how Toshak is used and keep the chats safe. Toshak's admins can see who is using the app now or used it in the last hour, with that part of the app and group chat. We never record which private conversation you open, and never what you read or type.
• Profile and photo views: when you open someone's profile or photos, we record that you viewed them and when.
• Notifications: a push-notification token for your device if you allow notifications, and a record of which notifications were sent and whether they were delivered.
• Unread and read status of chats, so your badges and counts are right.

We do not use advertising trackers, and we do not track you across other companies' apps or websites. We use your device's location only when you ask us to: "Use my location" when you sign up finds your nearest city on your phone, and we keep only the city you pick; "Send my current location" in a chat sends your current location to that chat as a message. We never collect your location in the background.

• Business QR codes: when someone scans a business's Toshak QR code, our website counts the scan for that business (a number per day). We don't record who scanned it.
• Near me now: if you choose "Near me now" in Events or Services, the app uses your phone's location to show what's near you. It stays on your phone; we don't receive or save it.

4. Purchases

When you buy Toshak Premium, Nikah Gold, a paid event post, a Local ad, a sponsored service or a Featured event, Apple or Google processes the payment. We never see your card or bank details. We (through our purchase-management provider, RevenueCat) receive your Toshak account ID, what you bought, the store transaction ID, and when the subscription started, renews or ends. We use this to turn on what you bought, to help with problems, and for our accounting and tax records.

If your business buys a sponsored ad from us directly, we keep the business contact and billing details needed for that agreement.

5. Sensitive information

Because Toshak is a community for Afghans abroad, the fact that you use it may suggest your national or ethnic origin, and what you post may reveal things like your religion or political views. We treat this as sensitive. We use it only to provide the Service, we never sell it or use it for advertising, and we do not use it to draw conclusions about you. Where the law requires it, we ask for your consent when you sign up, and you can withdraw it by deleting your account.

Private messages are stored on our servers and protected in transit and at rest, but they are not end-to-end encrypted. Our team looks at a private message only when it is reported to us, when we must investigate a safety or legal issue, or when the law requires it.

5A. Toshak Nikah (marriage profiles)

Toshak Nikah is an optional part of Toshak for people looking for marriage. This section applies only if you make a Nikah profile.

• What we collect: your first name, gender, birth year, the city and state from your Toshak city (and that city's approximate coordinates, to work out distances), your answers (marital status, children, education, job, prayer, sect, languages, plans to move and to marry), what you write about yourself and who you are looking for, up to 4 photos, your preferences, who you say "Interested" or "Not for me" to (and any note you send), your matches and the messages (text and voice) you send them, and when you last opened Nikah.
• Sensitive information: your Nikah answers can reveal your religion, beliefs and family situation. We use them only to run Nikah: to show your profile, to match and order profiles, and to keep Nikah safe. We never sell them or use them for advertising.
• Who sees what: other Nikah members (men see women and women see men) see your first name, age, city, answers, what you wrote, whether you are verified, and roughly how far away you are. They do not see your Toshak name, @username, profile picture or chats. Your Nikah photos are private: only a match you choose to share them with can see them, until you stop sharing or the match ends. Messages between matches are seen only by the two of you. People you have a private chat with on Toshak do not see your Nikah profile unless you both turn that setting off. Our team can see Nikah profiles, photos and reports to keep Nikah safe.
• Matching: we order profiles automatically using your preferences, your answers, distance, recent activity and how other members respond (for example how often people say "Interested"). This only decides the order in which you see profiles. It has no legal or similarly significant effect, and you can change your preferences at any time.
• Safety checks: we automatically check what you write for contact details, requests for money and similar signs of scams, and we look at reports. Profiles that look risky may be reviewed by our team, shown less, or removed. A message that asks for money, or (early on) to move to another app, may be shown to the other person with a safety tip, and asking for money flags the sender for review. Every Nikah photo is checked automatically, before any match can see it, for nudity, underwear or swimwear, violence and hate symbols (Amazon Rekognition does this on our behalf; the image is not kept by Amazon). A photo that fails the check is removed from your profile and deleted, and we tell you. This check looks at what is in the photo, not at who you are: it does not identify you or use your face shape.
• Verified badge (face comparison): if you choose to get verified, you take a selfie and we compare it with your Nikah photos to check they show the same person. The comparison is made by Amazon Web Services (Amazon Rekognition) on our behalf, or by our team when the automatic check is unsure or unavailable. This uses biometric information (the shape of your face). We do it only with your consent, which you give in the app right before the check, and only to verify you. We do not create or keep face templates or face measurements: we keep only the result and a similarity score. Your selfie is deleted as soon as the check is decided. We never sell, lease or trade biometric information or use it for anything else.
• Nikah Gold: if you subscribe, Section 4 applies.
• Deleting: you can delete your Nikah profile at any time in Nikah settings. This deletes your Nikah profile, photos, voice messages, preferences, matches and Nikah messages. Deleting your Toshak account also deletes your Nikah profile and its files.

6. How we use information

• To create and protect your account, including sending sign-in codes.
• To run communities, group chats, private messages, services, events, reviews, Premium and other features.
• To keep Toshak safe: review reports, held events and new cities, run the automatic checks on group chats and new events described in Section 7, detect spam, scams, fake accounts and ban evasion, and enforce our Terms and Community Guidelines.
• To send the notifications you chose in Settings, and important messages about your account, purchases or changes to our policies.
• To answer support requests.
• To find and fix errors and to understand, in general terms, how the Service is used so we can improve it.
• To follow the law, and to protect the rights and safety of our members, the public and Toshak.

7. Who can see your information

• Earlier versions of messages: when you edit a message, the people in that chat can see what it said before.
• Private groups: the members of a group can see its member list (names, @usernames and pictures) and everything posted in it.
• Events: members of a city can see who tapped Going on its events (names and pictures).
• Weekly leaderboard: members of a city can see the names and weekly points of its most active members, and last week's top 3 have a medal by their name.
• Automatic translation (on unless you turn it off): the text of messages in another language that you read, including private messages, is sent to OpenAI to be translated into your language. Translations are kept so each message is translated only once. Turn it off any time in Profile → Translate messages.
• Shared event links: when someone shares a link to an event, anyone with the link can see the event's name, time and city (not its address or who organizes it) until it ends or is cancelled.
• Other members: your name, @username, photos, bio, the location you chose to show, your badges, whether you are online or when you were last seen (unless you hide it), and your listings, events and reviews. Anything you post in a group chat can be seen by anyone who joins that community, so treat it as public. Private messages are seen by the people in the conversation.
• Profile and photo views: when you open someone's profile, they can see how many people viewed their profile in the last 30 days, and if they have Premium, who. When you view someone's profile photos, the owner can see who viewed each photo. If you turn on "Browse profiles privately" in Privacy, your visits to profiles and photos are not recorded, and you see only how many people viewed your profile.
• Moderators: Toshak staff and volunteer moderators can see reported content and held messages, the report, and the basic account information needed to review it.
• Automatic safety check: the text and photos of new group-chat messages (including the preview picture of a video and the pictures in a poll), the text of new event comments, and the title, place, price and description of new events, are sent to OpenAI, which tells us whether they may break our rules or look like spam or a scam. Private messages are not sent. OpenAI processes this for us under its business terms, does not use it to train its models, and may keep it for up to 30 days to detect abuse.
• Service providers: the companies in Section 8, which may use your information only to provide their services to us.
• Legal and safety: we may share information if we believe in good faith it is required by law, legal process or a valid government request, or needed to prevent fraud, protect someone's safety, or protect our rights. We report apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC).
• Business changes: if Toshak becomes a company, merges, or is sold, information may be transferred as part of that, and this policy will continue to protect it.

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising.

8. Service providers we use

• Supabase: our database, file storage, sign-in and server functions.
• Expo: delivers push notifications and app updates; Apple (APNs) and Google (FCM) deliver the notifications to your phone.
• Apple and Google: Sign in with Apple and Sign in with Google, and payments through the App Store and Google Play.
• RevenueCat: keeps track of your purchases and subscriptions.
• Amazon Web Services (Amazon Rekognition): compares your selfie with your Nikah photos, only when you ask to be verified (Section 5A), and checks new Nikah photos for content that breaks the photo rules. Amazon does not use these images to train its services and does not keep them after the comparison.
• OpenAI: the automatic safety check on group-chat messages, photos and new events, and automatic translation when you turn it on (Section 7).
• Email and text-message providers: to send sign-in codes and account emails.
• Cloudflare: hosts the toshakapp.com website.
• GIPHY: when you search for a GIF, your search words and your device's IP address go to GIPHY, under GIPHY's privacy policy.
• Google (Google Maps Platform, Places API): when you type an address for an event or service, the text you type and the city you are in are sent through our server to Google to suggest matching places (also when you search for a place to share in a chat). Google sees our server, not your device. Google's privacy policy applies to its handling of this information.
• Photon (by Komoot), using OpenStreetMap data: if Google's suggestions are not available, your app sends the text you type and your city to Photon instead.
• Link previews: when a message contains a link, your app may load that web page to show a preview. The website can see your IP address, as with any visit.

9. How long we keep information

• Account and profile: while your account is open.
• When you delete your account: we delete your profile, profile photos, listings, events, reviews, saved messages and settings within 30 days, and copies in backups within 90 days. If an account is deleted while it is suspended for breaking the rules, we keep only a one-way fingerprint (a hash) of its email address and phone number, so the same person can't avoid the suspension by signing up again; it can't be turned back into the email or number, and it is removed if the suspension is lifted. Messages you sent in group chats and private chats (with their photos, videos, voice messages and files) stay in those chats, shown as from "Deleted account" without your name, @username or picture, so the conversation still makes sense for the other people in it. Delete any messages you do not want to remain before you delete your account.
• When you deactivate your account: we keep your information, hidden from other members, until you sign in again or delete your account.
• Edited messages: earlier versions are kept as long as the message is, and deleted with it.
• Deleted messages: when a message in a group chat is deleted (by you, a moderator or our automatic checks), the chat shows it as deleted, and we keep a copy of its text, photos, videos and voice message for 30 days, seen only by our safety team, so we can review harassment, scams and other abuse. Then the copy and its files are deleted for good. A deleted private message is kept this way only if it was reported.
• Toshak Nikah: your Nikah profile, photos, matches and messages until you delete your Nikah profile or your account (then within 30 days, and from backups within 90 days). Verification selfies: until the check is decided. Messages in a match that has ended are no longer shown to either person, and are kept for safety reviews until one of you deletes their Nikah profile.
• Crash and error reports: 30 days.
• Profile views: 90 days.
• Notification logs: 90 days. Other server logs: up to 12 months.
• Purchases: our record of what you bought is deleted with your account. Apple, Google and RevenueCat keep their own purchase records under their policies.
• Reports, moderation and ban records: up to 2 years after the action, to prevent abuse and ban evasion.
• We keep information longer only when the law requires it, or to settle a dispute or legal claim.

10. Your choices and rights

• In the app you can edit your profile, choose how your location is shown, hide your last seen, control who can message you, choose notifications, block people, delete your own messages, and deactivate or delete your account.
• Depending on where you live, you may have the right to: know and access the personal information we hold about you; correct it; delete it; get a copy in a portable format; object to or restrict some uses; withdraw consent; and not be treated differently for using these rights.
• To make a request, email privacy@toshakapp.com from the email linked to your account (or include the phone number you sign in with). We will confirm it is you before acting and answer within the time the law requires (usually 30 to 45 days). Where the law allows, you may use an authorized agent.
• If you live in the EU, the UK or Switzerland, you can also complain to your local data protection authority.

11. Legal bases (EU, UK and similar laws)

We rely on: (a) contract, to provide the Service and the purchases you asked for; (b) legitimate interests, to keep the Service safe (including the automatic checks), prevent fraud, fix errors and improve it, balanced against your rights; (c) consent, for optional things like notifications and, where required, sensitive information; and (d) legal obligation, where the law requires us to use or keep information.

12. U.S. state privacy rights (including California)

If a U.S. state privacy law applies to us and to you, you have the rights in Section 10. In the last 12 months we collected these categories of personal information: identifiers (name, email, phone number, account IDs, IP address); customer records (contact details); characteristics that may be protected by law (national or ethnic origin, as suggested by membership); commercial information (your Toshak purchases); internet and app activity (including profile views, crash reports and notification logs); audio and visual information (photos, videos and voice messages); general location (the city and state you join or show); precise location, only when you choose to send your current location in a chat; and, if you use Toshak Nikah, sensitive personal information (religious beliefs, marital and family details, and biometric information if you choose to get verified). We collect them for the purposes in Section 6 and share them only as described in Sections 7 and 8.

We do not sell or "share" personal information as California law defines those terms, and we have no actual knowledge of selling or sharing the information of anyone under 16. We use sensitive personal information only for purposes California law allows, so we do not offer a "limit the use" option. We honor Global Privacy Control signals. We will not discriminate against you for using your rights.

13. Children

Toshak is only for people 18 and older. We do not knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we will delete it. If you believe a minor is using Toshak, please tell us at privacy@toshakapp.com.

14. Security

We use reasonable administrative, technical and physical safeguards, including encryption in transit and at rest, access controls, database rules that limit who can see what, and hashed passwords. Photos have hidden location data (EXIF) removed before they are uploaded. No system is completely secure, so we cannot guarantee security. Keep your sign-in details private and tell us right away if you think someone got into your account.

15. International transfers

Toshak is based in the United States, and our service providers may process information in the U.S. and other countries. When we transfer personal information from the EU, the UK or Switzerland, we rely on safeguards approved under those laws, such as the European Commission's Standard Contractual Clauses in our providers' terms.

16. Changes to this policy

We may update this policy. If a change is important, we will tell you in the app or by email before it takes effect. The "Last updated" date at the top shows when it last changed.

17. Contact

Toshak (Mayvand Khaliq), California, United States

Privacy questions and requests: privacy@toshakapp.com