سياسة الخصوصية

What we collect, and why

Express Mall is a grocery delivery store serving Aleppo, Syria. We collect the minimum needed to fulfill your order:

• Name, phone number, and delivery address — to process, deliver, and communicate about your order. Your phone number is your identifier; ordering does not require an account.
• Optional account (app only) — if you choose to create one, we store your name, phone number, password (hashed; nobody, including us, can read it) and saved addresses, so your orders and addresses follow you to any device.
• Email for account verification (entirely optional) — if you choose to verify your account, we store your email address and use it for one thing only: sending you the verification code, and a password-reset code if you forget your password. No marketing is ever sent to it.
• Order history — linked to your phone number, for reordering, tracking, and as the store's business record.
• Device identifier and push token (app only) — to send order status notifications and pre-fill your details on future orders.

What we do not collect: no email, no geolocation, no contacts, and no payment data — payment is cash on delivery only. No ads, no marketing trackers or analytics, and we never sell your data.

Storage and access

• Data is stored with our infrastructure provider Supabase on EU servers (Frankfurt); all connections are encrypted (TLS).
• Only store staff can access order data (drivers see only their assigned orders).
• App notifications are delivered via Expo / Firebase Cloud Messaging — only the device token and notification text pass through them. No advertising or marketing third parties.
• Account verification codes are sent through an email delivery service (Resend) — only your email address and the message text pass through it.

Deleting your data

• In the app: Account → “Delete my data” — unlinks your device, deletes the push token, and clears all on-device data, immediately. If you have an account, the same button (“Delete my account and data”) permanently deletes the account and its saved addresses from our servers.
• To delete your full order history, contact us (WhatsApp or phone — listed in the app and website) and we will erase it within a few working days.

Other notes

• The service is not directed at children under 13.
• Material changes to this policy will be announced on this page before they take effect.