Privacy Policy
This document explains what data the "Səbəb yoxsa Bəhanə: Give advice!" mobile app (hereafter — the App) collects, why it collects it, who it is shared with, and how long it is kept.
In plain words: the App does not ask for more than it needs to work. Phone number, address, date of birth, contact list, location — we ask for none of these.
1. Who controls your data
Operator: Muzafferus — individual developer
Contact: salam@muzafferus.az
You can write to this address with any privacy question.
2. What data we collect
2.1 Account data
| Data | Where it comes from | Why it is needed |
|---|---|---|
| Email address | you type it | the only way to sign in; account recovery |
Username (@name) | you choose it | to show you to other users |
| Display name | you type it | shown on your profile |
| Avatar | you pick one from the app's built-in set | profile picture |
| Time zone | from your device | determines which day your streaks are counted in |
| Password | optional — only if you set one yourself | an additional sign-in method |
A password is not required. The App works without one: a 6-digit code is emailed to you.
2.2 Signing in with Google
If you choose to sign in with Google, Google gives us only your account identifier (sub), your email address and (if available) your name. Your Google password, contact list, Drive files and other data never reach us — and we cannot even ask for them.
2.3 Content you create
- Situations you post and the duration you choose for them
- Votes you cast (Reason / Excuse)
- Advice and replies you write
- Stars you give
- Reports and appeals you submit
- Users you block / who block you
- Invite codes
When posting, you can pick an image from the app's own image set. The App does not upload images from your gallery and does not request camera permission.
2.4 Technical data
| Data | Why |
|---|---|
| Session (sign-in) records | so you can see and close sessions on the "Other devices" screen |
| Device name (e.g. "Google Pixel 6") | so you can recognise the device in that list |
| IP address | security: to spot suspicious sign-in attempts |
| Notification token | to send push notifications to your phone |
The IP address is recorded only when it is a validly formatted address. The App does not derive a city, carrier or location from it.
2.5 Data we do not collect
Location · phone number · contact list · camera and gallery · advertising identifier · third-party advertising or tracking tools.
The App contains no ad network and no analytics SDK.
3. An important note about anonymous posts
When posting, you can choose "anonymous". Such a post appears without a name to other users.
Anonymity does not apply to moderators. If a post is reported, the moderator can see who published it. This is deliberate: a feature that hides your name is not there to protect people who break the rules.
4. Who we share data with
We do not sell your data and we do not give it to anyone for advertising. The parties below are the ones necessary for the service to work:
| Who | What they receive | What for |
|---|---|---|
Code delivery service (api.muzafferus.az) | your email address and (if available) your name | to send and verify the 6-digit sign-in code |
| Google Firebase Cloud Messaging | your device's notification token, the notification title and text | to deliver push notifications |
| Google (only if you sign in with Google) | the sign-in request | to verify your identity |
| Hosting provider | all data stored on the server | the server itself |
The notification text is the notification itself — for example "New advice" and the beginning of the advice. That text passes through Google's servers.
Apart from this, we disclose your data only where the law requires it, and only to the extent required, to authorised bodies.
5. How long we keep it
| What | Period |
|---|---|
| Account and content | for as long as the account is active |
| Deleted account | 30 days — you can change your mind and come back within this period; after that it is deleted completely |
| Sign-in codes | 5 minutes (at the service that sends them); the code itself is never stored on our side |
| Sessions | until you sign out or they expire |
| Moderation log | 24 months |
| Notification tokens | until the device uninstalls the app or the token changes |
The moderation log remains even if your account is deleted: the record of who made a decision, when and why cannot be altered or removed. This exists both for your right to appeal and for the accountability of moderators. The log stores the decision itself and the reason for it.
6. About the sign-in code
We never see the 6-digit code emailed to you. A separate service creates, sends and verifies it; we only receive a "correct / not correct" answer. The code is stored neither on our server nor in our logs.
The code expires after 5 minutes. If you enter it wrong 3 times, that address is locked for 15 minutes.
7. Your rights
All of the following are possible from inside the app, without contacting anyone:
- See your data — the profile and settings sections
- Download your archive — Settings → Account and privacy → "Download my data". Your posts, votes, advice and profile data are collected into a single archive
- Correct it — you can change your username, display name and avatar at any time
- Delete your account — Settings → Account and privacy → "Delete account"
- Close sessions — revoke a sign-in on another device
- Stop notifications — withdraw the permission from your device settings
If any of these does not work, or you have a further question, write to salam@muzafferus.az.
8. What happens to a deleted account
When you ask to delete your account:
- The account is deactivated immediately — your profile, posts and advice are no longer visible to others.
- If you sign in with the same email within 30 days, the account is restored.
- After 30 days your account and content are deleted from the database.
What remains after deletion: the entries in the moderation log (24 months, explained above) and the aggregate numbers in other people's voting results — because those are no longer tied to a specific person.
9. Age limit
The App is for users over 18. You confirm this before registering. If we learn that you are under 18, we close the account and delete the data.
10. Security
- If you set a password, it is hashed with
bcrypt— it is stored nowhere in the clear and we cannot see it. - Sign-in tokens are short-lived; the refresh token changes on every use.
- Communication with the server goes over an encrypted channel (HTTPS).
- Sign-in codes, passwords and similar secrets are never written to logs.
That said, no system on the internet is 100% secure. Protecting your email matters for your account's security too — whoever has access to your email can also access your account.
11. Changes to this policy
If we change the policy, we will show the new version in the app. For significant changes we will send a notification. The document is versioned — which version you accepted is recorded.
12. Contact
salam@muzafferus.az