Privacy Policy
In short: you sign in with Google only. Rihla receives your name, email address and profile picture, uses them to run your account, and stores them with our backend provider, Supabase. We don't sell your data, show ads or use trackers. You can ask us to delete your account and data at any time by emailing ademth11@gmail.com.
This policy explains how Rihla ("Rihla", "we", "us"), the community travel app for iOS and Android, handles your information. It also covers this website. If you have questions, contact us at ademth11@gmail.com.
1. Signing in
You can browse public travel programs without an account. To publish, vote, save, comment or review, you need an account, and the only way to create one is Sign in with Google. Sign-in is handled by Supabase Auth, the authentication service of our backend provider. Rihla never sees or stores your Google password.
2. Information we receive from Google
When you sign in, we request only the standard openid, email and profile scopes. Google then shares:
- Email address: to identify your account and contact you about it. It is not shown to other users.
- Name: used to create your display name and a suggested username, which you can change.
- Profile picture: shown as your avatar until you upload your own.
- A Google account identifier, used by Supabase Auth to link your sign-ins to the same account.
We don't request access to your contacts, Gmail, Drive, calendar, location or any other Google data.
Rihla's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. Information you create in the app
- Profile: username, display name, avatar, an optional bio and home country. Your profile is public, because creators are shown on their programs.
- Travel programs: titles, descriptions, days, stops, places, routes, checklists, links and photos you add. Drafts stay private until you publish; published programs are public.
- Community activity: votes (and the reason you give for a downvote), saved programs and collections, comments, replies, suggested corrections, reviews, "helpful" marks, and reports you send. Comments, reviews and published content are public. Collections are private unless you make them public. Saves and reports are private. Vote totals are public, and a program's creator can see the votes and downvote reasons on their own programs.
4. How we use your information
- To create and secure your account and keep you signed in.
- To show your profile and the content you publish to other users.
- To run the app's features: search, voting, saving, comments, reviews, corrections and copying programs.
- To moderate reports and keep the community safe.
- To respond when you contact us.
We don't use your information for advertising, we don't build marketing profiles, and we don't use Google user data to train AI models.
5. Where your data is stored
Your account and app data are stored with Supabase, which provides Rihla's database, authentication and file storage. Our Supabase project is hosted in the European Union (Ireland, AWS eu-west-1). Supabase processes the data on our behalf and keeps standard server logs (such as request times and IP addresses) for security and troubleshooting.
On your phone, the app keeps your sign-in session in the device's secure storage (Keychain on iOS, Keystore-backed storage on Android) and caches content so it loads faster. Signing out removes the session.
6. Other services the app uses
- OpenStreetMap: maps are drawn with OpenStreetMap tiles, and place search in the editor sends your search text to OpenStreetMap's Nominatim service. These requests come from your device, so OpenStreetMap receives your IP address, as described in the OSM Foundation Privacy Policy. They don't include your account details.
- Maps apps and links: "Directions" opens Apple Maps or Google Maps, and links in programs open in your browser. Those services have their own privacy policies.
- Cloudflare hosts this website and may log basic request data such as IP addresses.
Rihla does not include advertising, analytics or crash-reporting SDKs.
7. We don't sell your data
We do not sell, rent or trade your personal information, and we don't share it with third parties for their own marketing. We share it only with the service providers above, to run Rihla, or when the law requires it.
8. How long we keep it
We keep your information while your account exists. When your account is deleted, your profile and the content linked to it are removed from our active database and storage, normally within 30 days. Server logs and backups kept by our providers expire on their own schedules.
9. Deleting your account and data
To delete your account and all associated data, email ademth11@gmail.com from the Google email address you use with Rihla, with the subject "Delete my Rihla account". We will confirm and complete the deletion within 30 days. This removes your profile, your programs and drafts, uploaded photos, comments, reviews, votes, saves and collections.
You can also remove Rihla's access to your Google account at any time from your Google Account connections page. That stops future sign-ins but doesn't delete data already in Rihla, so email us too if you want it deleted.
10. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your local data protection authority. You can edit most of your profile in the app; for anything else, email us and we will respond within 30 days.
11. Security
Data is sent over encrypted connections (HTTPS). Access to the database is controlled by row-level security rules, so users can only change their own data and private drafts stay private. No system is perfectly secure, but we work to protect your information and will act promptly if a problem is found.
12. Children
Rihla is not intended for children under 13, or under the minimum age required in your country to consent to data processing (16 in some EU countries). We don't knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
13. Changes to this policy
If we change this policy, we will update the effective date above and, for significant changes, let you know in the app.
14. Contact
Email ademth11@gmail.com with any question or request about your privacy.