Privacy

What we collect

Email and password (stored as a hash, never in plain text), language and notification settings — when you create an account.

A review's rating, text, photos and videos — if you leave one. Public reviews show a masked author label; your full email is visible only to a moderator handling a report.

Name, phone and message — if you send a request to a business or a "Need help" request. The business (or businesses of that category in your city) sees them in order to contact you.

A service, date and time — if you book a visit. This is visible to the business you booked with, since they need it to provide the service.

A message and business details — if you apply to add or manage a business. Name, phone, channel link and payout details — if you join the partner program; only administrators see them.

Address, phone, hours, prices, photos and description that a business owner enters about their own business — this data is public by design, since that's the point of local discovery.

Location — only when you tap "Near me" or "My location" yourself and allow it in the browser. Coordinates are sent in the search request to calculate distance and are not written to our database.

Anonymous counters of "Call", WhatsApp and "Route" taps on business pages — only the action type and time, nothing about you.

Cookies and browser storage

A single session cookie for sign-in — httpOnly, not accessible to page scripts, valid for 14 days or until you sign out. No advertising, analytics, or third-party tracking cookies are set.

The site may keep in browser storage (localStorage): a draft of your add-business request (until you submit it), a flag that you have seen the dashboard tips and, if you view ads in "New in town", a random identifier for the current day (the zaynii-ad-visitor entry, at most the last three days). This is not a cookie and is not sent to other sites; you can remove it by clearing site data in your browser.

Ad and traffic statistics

For store ads in "New in town" we count approximate statistics: how many times an ad was on screen for at least one second, and how many times the store page was opened or "Call", WhatsApp or "Route" was tapped. We record only the action type, the ad, the day and the browser's random identifier for that day — no IP address, account or device. Repeats from the same browser on the same day, crawlers and owners' free posts are not counted. While paid ads are switched off, these statistics are not collected.

Advertisers see only totals for their own ads, not individual records.

Overall site traffic is measured with Vercel Web Analytics: no cookies, only aggregate page counts, not linked to your account.

Who we share data with

OpenAI — only the text of a search query and a voice recording for speech recognition, and only if AI search is enabled by the service operator; the query is not linked to your account or history, and the recording is not stored on our servers.

Nominatim (OpenStreetMap) — the address text a business owner enters, to verify coordinates.

OpenFreeMap — loading interactive map tiles; no personal data is sent for this.

Resend — your email address and the message text, to send address confirmation, password reset and notifications.

Vercel (hosting and photo/video storage) and Neon (database) process data on our behalf and do not use it for their own purposes. Servers are located outside Tajikistan (Europe, USA).

We do not sell data to third parties. Store ads use only the anonymous statistics described above; there is no targeted advertising based on your data.

Retention and deletion

Passwords are stored only as an irreversible hash (scrypt). A session lasts 14 days, an email confirmation link 24 hours, a password reset link 1 hour.

Ad statistics events with a random browser identifier are kept for 90 days. After that a daily automatic cleanup deletes them and keeps only per-ad, per-day numbers (how many views and taps) without any identifier, for advertiser reports. These totals contain no information about visitors.

Requests to businesses and "Need help" requests are kept while they are needed to contact you and are deleted on request at the address below; bookings are deleted together with your account. Partner details are kept until deleted on request. Tap counters on business pages contain nothing about you.

Ad payment records (amount, term, payment method and document number) are kept with the ad history for reconciliation and disputes. We do not collect card numbers.

Hosting request logs (page address, time, technical request data) are kept by Vercel for a limited time under its own rules; we use them only to find errors and prevent abuse.

A review rejected by moderation is marked deleted and stops being publicly visible, but is kept briefly in case of a repeat report; its photos and videos are deleted.

You can delete your account yourself from the Account section — this is permanent: bookings, favorites and business requests are removed, and reviews you left stay visible, but without an author name. Self-service deletion is unavailable while you manage a business on the site — hand off management first, or email us.

On request at the address below we will tell you what data we hold about you, and correct or delete it unless the law requires us to keep it.

Security

We rate-limit requests and lock an account out after several failed sign-in attempts. This does not guarantee absolute protection, but we apply reasonable measures and respond to incidents.

Children

The service is not intended for anyone under 16. We do not verify age at registration.

Changes to this page

Updates are published here; the date of the last change is shown at the top of the page.

Contact

For questions about your data, write to support.zaynii@gmail.com.