Privacy Policy

Karak Today is based in and operated from the United Arab Emirates. We process personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (“PDPL”). Some of our service providers are located outside the UAE, including in the United States, which means some data is transferred internationally — see Section 4.

Account information (sign-in)

You can sign in using Google OAuth or with a one-time code sent to your email address. We do not create or store passwords. If you sign in with Google, we receive your name, email address, and avatar image from Google. If you sign in with an email code, we collect your email address.

Once you have an account, you can add or edit the following profile fields: username, bio, avatar image, nationality, home emirate, and role (e.g., regular user or Karak Hunter).

Purpose: account creation, authentication, and personalizing your profile.

Legal basis: performance of a contract with you (providing the service you signed up for) and, where you sign in with Google, your consent to share these details with Google during sign-in.

Activity and user-generated content

• Check-ins— the spot you check into, the timestamp, and any rating you give, linked to your account.
• Saved lists— spots and lists you save to your profile.
• Listing submissions and photos (Karak Hunters)— if you’re a Hunter, the spots you submit or curate, including location data and any photos you upload.
• Reports and moderation records— if you report content, or if your content is reviewed, we keep a record of that activity.

Purpose: operating the core features of the app (map, check-ins, saved lists, Hunter contributions, and moderation).

Legal basis: performance of a contract with you, and our legitimate interest in maintaining a trustworthy, well-moderated platform.

Forms (available with or without an account)

• Spot nominations(/nominate) — the spot name, its location, a “must try” recommendation, and an optional email address. Nominations are insert-only: they are not retrievable through our public API and are reviewed manually by our team.
• Newsletter signup— your email address.

Purpose: collecting nominations for new spots, and sending newsletter updates if you sign up.

Legal basis: consent (you choose to submit a nomination or subscribe).

Location data

Karak Today uses geocoding, reverse-geocoding, and places lookups to plot spots on the map and to help you find spots near you. The interactive map itself does not require your location.

Separately, you can choose to enable browser geolocation by tapping a button to show your current position on the map or to see nearby listings. This is optional and only happens when you actively choose to use it.

Purpose: showing spots on the map, finding nearby recommendations, and (if you opt in) showing your position and nearby listings.

Legal basis: consent (for browser geolocation) and legitimate interest (for general geocoding/places features needed to display listings).

We use cookies and similar technologies for:

• Authentication and session management— to keep you signed in and your session secure.
• Analytics (PostHog)— to understand how the app is used, including page views, page-leave events, and general usage patterns.

Analytics cookies are not essential to the core functionality of the app. You can opt out of analytics by enabling “Do Not Track” in your browser, or by blocking or clearing cookies through your browser settings at any time. Note that blocking essential cookies may affect core functionality such as staying signed in.

We use the following third-party service providers (“processors”) to operate Karak Today. Each only receives the data necessary to perform its function:

International data transfers

Some providers — notably PostHog, which is US-hosted — process data outside the UAE. Where we transfer personal data internationally, we rely on the relevant provider’s data protection safeguards (such as standard contractual clauses or equivalent measures) to ensure your data remains protected in line with this policy and applicable law.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

We retain personal data for as long as your account is active, or as needed to provide the service. Specifically:

• Account and profile data is retained until you delete your account.
• Activity data (check-ins, saved lists, ratings) is retained while your account is active and is deleted or anonymized when your account is deleted.
• Hunter submissions and photosmay be retained even after account deletion where they form part of published listings, unless removal is requested and approved — see Section 7.
• Nominations and newsletter emails are retained until no longer needed for their purpose or until you ask us to delete them.
• Analytics, error, and performance logsare retained according to each provider’s standard retention periods, typically ranging from a few months to a couple of years.

Under the UAE PDPL and other applicable laws, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data, subject to Section 7 below.
• Object to or restrict certain processing, including analytics.
• Withdraw consent where processing is based on consent (e.g., newsletter, browser geolocation).

To exercise any of these rights, email hello@karak.today. We may need to verify your identity before acting on a request.

If you signed in with Google, you can also revoke Karak Today’s access to your Google account at any time through your Google account settings. This does not automatically delete the data stored in your Karak Today profile — for that, see Section 7.

You can request deletion of your account and associated personal data via your account settings or by emailing hello@karak.today. Account deletion will remove your profile information, saved lists, and link your check-in history to a deleted account rather than your identity.

Content that has been published as part of the public map or listings (such as Hunter-submitted spots, photos, or ratings that contribute to a Hunter Score) may be retained or anonymized to preserve the integrity of existing listings, unless you specifically request its removal and we are able to accommodate that request.

Karak Today is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a user under 18 has provided us with personal data, please contact us at hello@karak.today and we will take appropriate action.

We take reasonable technical and organizational measures to protect your data, including:

• Row-Level Security (RLS) enabled on our database, so users can only access data they are authorized to see.
• Authenticated uploads— only signed-in users can upload photos and content, and uploads are tied to their account.
• Industry-standard hosting and infrastructure practices through our providers (Vercel, Supabase, Cloudinary).

No system can be guaranteed 100% secure, but we work to protect your information against unauthorized access, alteration, or loss.

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will update the “Effective date” at the top of this page when changes are made. If changes are significant, we will make reasonable efforts to notify users, such as through an in-app notice.

For any questions about this privacy policy or how we handle your data, contact us at hello@karak.today.