Privacy policy

Your phone number, which is how you sign in — we send a one-time code to it and never ask you for a password. Your display name, your email if you choose to give one, and the language you prefer.

As a client: the bookings you make, the reviews you write, your loyalty points at each shop, your place on a waitlist, the messages you have turned off, and a note when you miss a booking without cancelling it.

As staff: the shop you work at, your role and what it allows, your working hours, the services you do, your tips and earnings, and a record of what you change in the shop’s records, so the shop can see who did what.

To keep your account safe: the number a sign-in code was sent to and the network address it was asked from, and, when you sign in, that network address and the kind of device. They are deleted 7 days after the code or the sign-in expires, or when your account is erased. If you turn notifications on, the token your phone issues so a message can reach that device.

And a copy of each message we send you, with where it went.

Your data sits in an encrypted PostgreSQL database, with encrypted backups. Production hosting is AWS in Bahrain (me-south-1) once we launch there.

No shop can read another shop’s records. That boundary is enforced by the database itself, not only by the application on top of it, so a mistake in our code cannot open it.

To send a booking confirmation, a reminder or a sign-in code, we pass the message to a messaging provider with your phone number, or to an email provider with your email address. The message says what it is about: your name, the shop, the barber, the service and the time. To deliver a notification to your phone, we pass the device token and the notification to the service your phone already uses.

Our hosting provider holds the encrypted database. When something breaks, the technical details of the error go to an error-reporting service, and a feature-flag service receives an account or shop identifier to decide which features are switched on for it.

That is the whole list. We do not sell personal data, and we do not hand it to anyone for advertising.

You can request deletion from inside the app. We hold the request for 30 days in case it was a mistake and you want the account back. After that we act on it, and you are gone from our production systems within 14 days.

What “gone” means depends on whether anything of yours is part of a shop’s records — a booking, or work you did as staff. If nothing is, the account is deleted outright; of it, only what the last paragraph names stays. If something is, we erase you from it instead: your phone number, your name and your email are removed, your sign-in sessions and notification tokens are destroyed, your place on any waitlist and your message settings are deleted, and what remains is an empty shell with nothing in it that leads back to you.

The shell stays because the shop’s own record of a visit hangs off it — that a visit happened, what was done, what was charged, any points earned and any booking missed. That record is the shop’s book, not yours, and we cannot take it away from them. A review you wrote stays too, without your name. After we have erased you, nothing in that record leads back to you by name, number or email.

Either way, two things are kept as they are. The audit log, which nobody can edit, keeps the actions taken in a shop and the changes made to your account, including a name or email you changed, so the records can be trusted; it holds no network address or device. And the copies of the messages we sent you stay, with the number or address each one went to. If you chose a reason for leaving from the list in the app, that choice is kept too, in the audit log and, if you were erased rather than deleted, with your deletion request.

Write to us and a person will answer.

privacy@app-sukoon.com