KashiWhat this notice covers
This notice explains what personal data Kashifly processes, why, who it is shared with, and the rights you have. Every technical claim below is also published with its evidence in our transparency page.
Data controller
Categories of personal data
- Account data (email, display name, avatar)
- Subscription status and Stripe customer ID (not card data)
- Trips you save and places you mark as visited
- Photos/videos you upload, their captions and linked city
- Your likes and comments
- Chat preferences and (identity-free) question logs
- Your current location (only with permission; no history kept)
- Device storage (language, open chat, offline map tiles)
Purposes and legal bases
- Performance of a contract: creating your account, providing subscription features, storing the trips you save.
- Your consent: processing your location, uploading photos and videos, keeping chat preferences, recording visited places. You can withdraw consent at any time.
- Legitimate interests: keeping the service secure, preventing abuse, and caching answers so the same question is not generated twice (speed and cost).
- Legal obligation: retaining payment records where tax or accounting law requires it.
What we do not collect
- Analytics or tracking scripts (Google Analytics, Meta pixel, etc.) — none at all
- Advertising, profiling or data sales — none
- Card numbers — never held by us
- Group chat content — end-to-end encrypted, we cannot read it
- Location history — not kept
- Photo EXIF/GPS data — stripped before upload
Sharing and international transfers
Data is shared with the service providers listed below, solely to operate the service. Some of them are located outside your country; transfers rely on adequacy decisions or standard contractual clauses. We do not sell data and do not share it with advertisers.
Service providers
| Supabase | Accounts, database and file storage |
| Railway | Application server |
| Vercel | Website delivery (CDN) |
| Stripe | Payments |
| Google Analytics 4 | Visit analytics (consent-based) |
| Azure OpenAI · Groq · OpenRouter · Cloudflare | Chat and text generation |
| Google Places | Place address, type and photo |
| Tavily | Web search for up-to-date information |
| OpenStreetMap · Overpass · Nominatim | Map data, places and halal/kosher tags |
| OpenFreeMap / MapLibre | Map tiles |
| Wikipedia · Wikidata | City and place images, info cards |
| Aladhan | Prayer times |
| get.geojs.io | IP → country (to pick the interface language) |
Your rights
- Access — obtain a copy of your personal data
- Rectification — correct inaccurate or incomplete data
- Erasure — ask us to delete your data
- Restriction — limit how we process your data
- Objection — object to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdraw consent — at any time, without affecting past processing
- Complain to a supervisory authority
How to exercise your rights
Write to the contact address below. We respond within one month. You can also delete your account from inside the app; deleting it removes your profile, trips, media and chat preferences.
Right to complain
If you are not satisfied with our response, you can complain to the data protection authority in the country where you live or work. — European Data Protection Board — list of national authorities
Cookies and device storage
We use no advertising or tracking cookies. Your device stores only functional data: your language, your open chat, offline map tiles you downloaded, and app hints. None of it leaves your device or reaches an analytics company.
Children
The service is not directed at children under 13 and we do not knowingly collect their data.
Changes
We may update this notice. The date at the top shows the current version; you will be told in the app about any material change.