This Privacy Policy explains what information the Smore mobile application (“Smore”, “the app”, “we”, “us”)
collects, why we collect it, how we use and protect it, and the choices you have. It applies to the Smore app for
Android and iOS and to the Smore backend service at api.smore.krd.
By creating an account or using the app, you agree to this policy. If you do not agree, please do not use the app.
1. What Smore does
Smore lets customers browse suppliers and their product catalogues, view offers and promotions, and choose to receive notifications about suppliers and product categories they are interested in. The app is free to use and contains no paid, premium, or subscription-only content.
2. Information we collect
2.1 Information you give us
| Data | When it is collected | Why |
|---|---|---|
| Phone number | Registration, sign-in, password reset | To identify your account and send a one-time verification code (OTP) by SMS |
| Full name | Registration; editable in your profile | To personalise your account |
| Username | Registration; editable in your profile | To display and identify your account |
| Password | Registration, sign-in, password reset | To secure your account. Passwords are transmitted over HTTPS and stored only in hashed form on our servers. We never store your password in the app in readable form. |
| Preferred city (optional) | Registration or profile editing | To show suppliers and offers relevant to your area |
2.2 Information generated by your use of the app
- Suppliers and categories you follow — so we can send you the notifications you asked for.
- Notification settings — your on/off preferences for the types of notifications you receive.
- Active sessions — so you can review where your account is signed in and sign out of other devices.
- Language preference — English, Arabic, or Kurdish (Sorani). Stored on your device only.
2.3 Device and push notification data
To deliver push notifications, the app uses OneSignal. When you sign in (or continue as a guest) and allow notifications, we collect and send to our servers:
- a push subscription identifier issued by OneSignal for your device installation, and
- your platform (
androidorios).
OneSignal may additionally collect standard device information (such as device model, operating system version, language, time zone, and IP address) in order to deliver notifications. See OneSignal’s Privacy Policy.
2.4 What we do not collect
- No precise or background location. The app does not request GPS or location permissions. The only location-related data is the city you optionally choose yourself.
- No payment or financial information. The app contains no purchases and no billing integration.
- No access to your contacts, photos, camera, microphone, files, SMS messages, or call logs.
- No advertising identifiers, and we do not use the app for advertising or ad targeting.
- No sensitive categories such as health, biometric, religious, or political data.
3. Guest mode
You can browse the app without registering by choosing “Continue as guest”. In guest mode we do not collect your name, phone number, or password. A guest session token and, if you allow notifications, a push subscription identifier are still created so the app can function.
4. How we use your information
- To create, authenticate, and maintain your account.
- To verify your phone number by SMS one-time code.
- To show you suppliers, catalogues, and offers, filtered by your preferred city where applicable.
- To send push notifications about the suppliers and categories you have chosen to follow.
- To keep the service secure, prevent abuse, and diagnose technical problems.
- To comply with legal obligations.
We do not use your information for automated decision-making that has a legal effect on you, and we do not sell your personal data.
5. Sharing your information
We do not sell or rent your personal data. We share it only in these cases:
- Service providers who process data on our behalf and under contract, limited to what they need:
- OneSignal — push notification delivery.
- Our SMS gateway provider — sending verification codes to your phone number.
- Our hosting provider — operating the Smore servers.
- Legal requirements — where we are required by applicable law, court order, or a lawful request from a competent authority.
- Protection of rights — where necessary to investigate, prevent, or act on suspected fraud, security issues, or violations of our terms.
- Business transfer — if Smore is involved in a merger, acquisition, or sale of assets, your data may be transferred, subject to this policy.
Because our providers operate internationally, your data may be processed on servers outside your country. We take reasonable steps to ensure it remains protected to the standard described in this policy.
6. Data security
- All communication between the app and our servers uses HTTPS/TLS encryption.
- Your session and refresh tokens are stored in the device’s encrypted secure storage (Keychain on
iOS, Keystore-backed
EncryptedSharedPreferenceson Android), not in plain files. - Passwords are stored on our servers only as salted hashes.
- Access to production data is restricted to authorised personnel.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.
7. How long we keep your data
We keep your account data for as long as your account is active. If you delete your account, your personal data is permanently deleted from our production systems, except where we must retain limited records to comply with legal obligations or resolve disputes. Routine backups are rotated and expire within a limited period.
8. Your rights and choices
- Access and update — view and edit your name, username, and preferred city from the Profile screen in the app.
- Delete your account — you can permanently delete your account and its associated personal data directly in the app, from Profile → Delete account. This action cannot be undone. You may also request deletion by contacting us at the address below.
- Control notifications — turn notification types on or off in Profile → Notification settings, unfollow any supplier or category at any time, or revoke the notification permission entirely in your device’s system settings.
- Sign out of other devices — review and revoke active sessions from the app.
- Withdraw consent, object, restrict, or port your data — contact us and we will respond within a reasonable period and in accordance with applicable law.
9. Children’s privacy
Smore is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Third-party links
The app may link to external websites or contact details published by suppliers (for example a website or phone number). We do not control those third parties and are not responsible for their privacy practices. Please review their policies before providing information to them.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top of this page always shows the current version. For significant changes we will provide notice in the app or by other appropriate means. Continuing to use the app after a change takes effect means you accept the updated policy.
12. Contact us
For any question, request, or complaint about this policy or your personal data: