Privacy Policy

Last updated: April 2026 · Effective: April 2026

Tajarib ("we", "us", "our") is a tourism and exploration mobile application built and operated in the Sultanate of Oman. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the Oman Personal Data Protection Law (PDPL), issued under Royal Decree No. 6/2022 and its Executive Regulations (Ministerial Decision No. 34/2024), as well as Apple's App Store Guidelines.

1Data Controller

The data controller responsible for your personal data is:

As required by Article 20 of the PDPL, our designated Data Protection Officer can be reached at the email address above.

2Data We Collect

We collect the following categories of personal data when you use Tajarib:

Account Information

• Email address (for authentication and account recovery)
• Display name (chosen by you)
• Profile avatar selection

Location Data

• Your device's location when you use the "Near Me" feature or check into places
• Location is accessed only when the app is in use and only with your explicit permission
• We do not track your location in the background

Photos & Camera

• Camera access for bingo challenge photo verification (camera-only, no gallery access for verification)
• Camera and photo library access for community posts and reviews
• Photos you upload are stored on our servers

Usage Data

• Places you visit, save, and review
• Routes you follow
• XP points, badges, streaks, and bingo progress
• Community posts and interactions

Device Information

• Device type and operating system version (for app compatibility)
• App version
• Language preference

3How We Use Your Data

We process your data for the following purposes:

• Providing the service: Account creation, authentication, displaying nearby places, tracking your exploration progress
• Personalization: Showing relevant places, remembering your saved items, and displaying your achievements
• Community features: Displaying your posts, reviews, and profile to other users
• App improvement: Understanding how features are used to improve the experience
• Safety: Preventing abuse, enforcing community guidelines, and processing reports
• Communication: Sending account-related notifications (password resets, security alerts)

4Legal Basis for Processing

Under the Oman PDPL, the lawful basis for processing personal data is your explicit consent, which you provide when:

• Creating your account and agreeing to this Privacy Policy
• Granting location permission through your device settings
• Granting camera or photo library permission
• Choosing to post content in the community feed

Your consent is voluntary. You may withdraw it at any time (see Section 7).

5Data Sharing & Third Parties

We use the following third-party services to operate Tajarib:

• Supabase (Database & Authentication): Stores your account data, app data, and handles sign-in. Supabase servers process your data according to their privacy policy.
• Supabase Storage: Hosts photos you upload (community posts, reviews, bingo verifications).
• MapLibre / OpenFreeMap: Powers the map experience. Your approximate location may be sent to tile servers to load map data — no personal identifiers are transmitted.
• Apple (App Store & Sign-In): If you use Apple Sign-In, Apple shares limited information with us per your choice (email or relay email).

We do not share your data with advertisers, data brokers, or any party not listed above.

6Cross-Border Data Transfers

Our infrastructure provider (Supabase) may process data on servers located outside the Sultanate of Oman. As required by Article 23 of the PDPL and Article 37 of the Executive Regulations:

• We obtain your express consent for any transfer of personal data outside Oman
• We ensure the receiving party maintains data protection standards no less than those required by Omani law
• Your data is encrypted in transit and at rest

By creating an account and using Tajarib, you consent to this transfer. You may withdraw this consent at any time by deleting your account.

7Your Rights Under the PDPL

Under the Oman Personal Data Protection Law, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Deletion: Request erasure of your personal data
• Right to Data Portability: Request transfer of your data to another controller
• Right to Withdraw Consent: Withdraw your consent at any time, which also means you can request that we stop processing your data
• Right to Block Processing: Request that we temporarily stop processing your data while a request is being handled

To exercise any of these rights, contact us at privacy@tajarib.app. We will respond within 45 days as required by the Executive Regulations.

8Account Deletion

You can delete your account at any time from within the app (Settings → Delete Account). When you delete your account:

• Your profile, display name, and avatar are removed
• Your community posts are anonymized or removed
• Your photos are deleted from our storage
• Your exploration data (XP, badges, streaks) is permanently erased
• Your email is removed from our authentication system

This process is irreversible. Some anonymized, aggregated data (such as place visit counts) may be retained for statistical purposes where it can no longer identify you.

9Data Retention

We retain your personal data only for as long as necessary to provide the service:

• Active accounts: Data is retained while your account is active
• Deleted accounts: Data is erased within 30 days of account deletion
• Community content: Removed or anonymized upon account deletion
• Server logs: Automatically purged after 90 days

10Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data is encrypted in transit (TLS/SSL) and at rest
• Authentication is handled through Supabase Auth with industry-standard security
• Row-Level Security (RLS) policies ensure users can only access their own data
• Photos are stored in access-controlled storage buckets
• We conduct periodic security reviews of our codebase

11Data Breach Notification

In the event of a data breach that may threaten your rights, we will:

• Notify the Ministry of Transport, Communications and Information Technology (MTCIT) within 72 hours
• Notify you within the same timeframe if the breach poses serious risk to you
• Maintain a breach record available to the Ministry upon request

12Children's Data

Tajarib is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately at privacy@tajarib.app and we will delete it promptly.

For users between 13 and 18, parental or guardian consent is required as stipulated by the PDPL Executive Regulations regarding children's data processing.

13Cookies & Tracking

The Tajarib mobile app does not use cookies or tracking technologies. We do not use any third-party analytics SDKs that track users across apps. We do not participate in any advertising networks.

14Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or via email before the changes take effect. Continued use of the app after changes constitutes acceptance of the updated policy.

15Complaints & Regulatory Authority

If you are unsatisfied with how we handle your data, you may file a complaint with:

16Contact Us

For any questions about this Privacy Policy or your personal data, reach us at:

© 2026 Tajarib · Sultanate of Oman · All rights reserved.