Privacy Policy

Rahyab Mohajer — Iranian Migrants Club

Last updated: June 2026

1. Introduction

Protecting your privacy is fundamental to Rahyab Mohajer (“Rahyab Mohajer”, “we”, “us”, or “our”). This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have — wherever in the world you live.

Rahyab Mohajer is a Persian-language directory and community platform for Iranian migrants, operated by a private individual based in Hungary (European Union), who acts as the data controller for the personal information described here.

This policy applies to our website, our mobile applications (iOS and Android), and all related services (together, the “Services”). By creating an account or using the Services, you acknowledge that you have read and understood this policy.

2. Information We Collect

We collect only the information needed to operate the Services. Depending on how you use them, this may include the following categories.

Account information

first and last name
email address
password (stored only as a salted bcrypt hash — we never store or see your plain password)
profile picture
Google account basics if you sign in with Google (your name, email, profile picture, and Google account identifier)

Profile and preferences

your self-selected country and city (optional, for regional personalization)
language, theme, and calendar/date-format preferences
records that you accepted our Terms and cookie notice, with the date and time

Content you publish

If you register a business, post a listing, or otherwise contribute content, we process what you submit, which may include:

business name, description, photos, and logo
business contact details: phone number, email, website, and physical/postal address
city, region, and a Google Maps location link
Instagram, Telegram, WhatsApp, and other social media links
reviews, comments, star ratings, and bookmarks
banners, events, and discounts you submit
flight-exchange, travel, hosting, and job posts — including any Telegram or social contact handle you add to them
support tickets and contact-form messages (subject and message body)

Security and authentication data

one-time email verification and password-reset codes (short-lived)
for administrators only: an encrypted two-factor (TOTP) secret and hashed recovery codes
session and refresh tokens that keep you signed in

Technical and usage data

When you use the Services, some information is generated automatically:

IP address — used transiently to protect against abuse, rate-limit requests, and estimate your country; we do not keep a permanent log of your IP
device and browser type, operating system, and language
first-party usage signals such as page/listing views and link clicks, which we count using a daily-rotating, irreversible hash of your IP plus your browser’s user-agent, to understand which content is popular and to improve the Services

Location data

On the mobile app, if you allow it, we read your device location only to determine your country / nearby region — the precise GPS coordinates are used momentarily on your device and are never stored or sent to us; we keep only the resulting country.
On the website, if you tap “detect my location”, your browser’s geolocation is processed entirely in your browser and is not sent to our servers; only a two-letter country code is used.
We may estimate your country from your IP address to pre-select the right region (see “How We Share Your Information”).

Mobile app permissions

The mobile app may request the following permissions, always with your consent, and you can change them at any time in your device settings:

Location (while using the app) — to show nearby businesses and listings; we do not use background location
Camera and photo library — only when you choose to take or select a picture for your profile or a business
Biometrics (Face ID / fingerprint) — an optional lock for the app; your biometric data stays on your device and is never sent to us

We do not access your contacts/phonebook or microphone, and we do not send push notifications.

3. How We Use Your Information

We use personal information to:

create, secure, and manage your account
provide the Services and display the listings and content you and others publish
show region-relevant content and apply location-based filtering
send service (transactional) emails and, with your consent, optional notification emails
protect the Services, prevent fraud and abuse, and keep the platform safe
respond to your support requests and contact messages
translate user content between Persian and English (see “Artificial Intelligence”)
understand which content is useful and improve performance and experience
comply with our legal obligations and enforce our Terms

4. Legal Bases for Processing

Where the EU/UK GDPR (or a similar law) applies, we rely on these legal bases:

Performance of a contract — to create your account and provide the Services you request
Consent — for optional notification emails, optional device permissions (location, camera), and non-essential cookies; you may withdraw consent at any time
Legitimate interests — to secure the platform, prevent abuse, and improve the Services in ways you would reasonably expect
Legal obligation — to comply with applicable law and lawful requests

5. Information You Make Public

Some information you submit is intentionally published and visible to other users and visitors, including:

business name, photos, description, and category
business contact details and social media links (these are blurred for visitors who are not signed in, but become visible after sign-in)
reviews, comments, and ratings (shown with your display name)
the Telegram or social contact handles you add to flight-exchange, travel, hosting, or job posts

Please share only what you are comfortable making public. You are responsible for the content you publish, and you can edit or delete most of it from your dashboard.

6. Sign in with Google

If you choose “Sign in with Google”, Google shares your basic account information with us so we can create or access your account:

name
email address
profile picture
your Google account identifier

We use this only to authenticate you and manage your account. Your use of Google is also governed by Google’s own privacy policy.

7. Email Communications

We send two kinds of email:

Transactional emails — verification codes, password resets, account and submission notices, support replies, and contact-form receipts. These are necessary to operate your account and cannot be unsubscribed from.
Notification emails — optional newsletters and announcements about businesses, events, or discounts, sent only if you opt in. Every notification email includes a one-click unsubscribe link, and you can opt out at any time.

Our email is delivered through our email provider, Hostinger; to send a message, your email address and the message content are processed by Hostinger. Hostinger’s privacy policy is available at https://www.hostinger.com/legal/privacy-policy

8. Cookies, Local Storage, and Similar Technologies

We use a small number of cookies and on-device storage, and no third-party advertising cookies. They fall into these groups:

Essential — keep you signed in (a secure, http-only session/refresh cookie) and keep the app working; these cannot be turned off
Preferences — remember your language, theme, calendar, and view settings (stored in your browser’s local storage or your device)
Consent — remember that you accepted our Terms and cookie notice

You can block or delete cookies in your browser settings, and clear app storage from your device, although some features may then stop working.

Do Not Track / Global Privacy Control: because we do not track you across other companies’ websites for advertising, our behavior does not change based on a browser “Do Not Track” signal. Where required by law, we treat a recognized Global Privacy Control (GPC) signal as a valid request to opt out of any “sale” or “sharing”.

9. Analytics and Advertising

We keep tracking to a minimum:

We do NOT display third-party advertising.
We do NOT use advertising or remarketing networks.
We do NOT use third-party analytics tools such as Google Analytics, and we do NOT sell your personal information.
We use only our own first-party, privacy-respecting analytics — aggregated view/click counts computed from an irreversible daily hash of your IP and your user-agent — solely to understand which content is popular and to improve the Services.

10. How We Share Your Information

We do not sell, rent, or trade your personal information, and we do not share it for cross-context behavioral advertising. We share information only with the service providers (“processors”) that help us run the Services, and only to the extent needed:

Hostinger — website/app hosting and our database, file storage, and email delivery
Google (Sign-in) — to verify your identity when you choose Google login
Google Gemini — to automatically translate user-submitted content between Persian and English (see “Artificial Intelligence”)
Google Maps — when you open a map, your IP and the business location are sent to Google to display it (maps load only when you choose to view them)
Cloudflare Turnstile — bot protection on sign-up, login, password-reset, and contact forms; it may process your IP and browser signals
IP-geolocation providers — to estimate your country from your IP for default region selection
Expo (EAS) — to deliver mobile app updates; the update check sends basic device and app-version information
Operational notifications — we use an internal messaging channel (Discord) to alert our team to new submissions and system events

We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or transfer of the Services (you will be notified of any such change).

Some links you add or open (for example Telegram contact links or external websites) take you to third parties that have their own privacy practices, which we do not control.

11. Artificial Intelligence (Translation)

To offer the platform in both Persian and English, we use artificial intelligence (Google Gemini, a large-language-model service) to automatically translate user-submitted content such as business descriptions, events, discounts, job posts, and reviews. The text of those fields is sent to the AI provider for translation; this provider operates outside the European Union. By submitting content, you acknowledge that it may be processed and translated by AI systems. Please do not include sensitive personal details in free-text fields that you do not want translated.

12. Bot Protection (Cloudflare Turnstile)

To protect our sign-up, login, password-reset, and contact forms from bots and automated abuse, we use Cloudflare Turnstile. To distinguish humans from bots, this service may process information such as your IP address, browser information, and interaction signals. This processing is governed by Cloudflare’s Turnstile Privacy Addendum, available at https://www.cloudflare.com/turnstile-privacy-policy/

13. International Data Transfers

We currently store the core platform data (accounts, content, and uploaded files) on servers located in the European Union. As the platform grows, we may host or replicate data in multiple regions around the world to improve speed and reliability.

In addition, some of our service providers (such as Google, Cloudflare, and Expo) process data on servers outside your country, including in the United States. Whenever personal information is transferred internationally, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses and our providers’ data-protection commitments — to keep your information protected to a standard consistent with this policy and applicable law.

14. Data Retention

We keep personal information only for as long as needed for the purpose it was collected, then delete or anonymize it. In particular:

your account data is kept while your account is active
one-time verification and password-reset codes expire within minutes
sign-in sessions (refresh tokens) expire after about 7 days, or sooner when you log out
if your account is deactivated, the remaining data is permanently deleted after about 1 year
expired or removed listings (businesses, banners, events, discounts) and their photos are purged automatically
temporary uploads that are never attached to content are deleted within about 24 hours
an unsubscribe (suppression) record is kept as long as needed to honor your opt-out

We may retain limited information longer where necessary to meet legal obligations, resolve disputes, prevent abuse, or maintain security and audit records.

15. Data Security

We protect your information with appropriate technical and organizational measures, including:

encryption of data in transit (HTTPS/TLS)
passwords stored only as salted bcrypt hashes
encryption of administrator two-factor secrets at rest
access controls, rate limiting, and bot protection
monitoring for suspicious activity

No method of transmission or storage is completely secure, so we cannot guarantee absolute security; however, we work to protect your information and to respond promptly to any incident.

16. Your Privacy Rights and Choices

Subject to your local law, you have the right to:

access the personal information we hold about you and receive a copy
correct inaccurate or incomplete information
delete your information (the “right to be forgotten”)
restrict or object to certain processing
data portability — receive your data in a portable format
withdraw consent at any time, without affecting prior processing
lodge a complaint with your data-protection authority

You can exercise many of these directly in the app: edit your profile, manage your content, unsubscribe from notification emails, and delete your account (which removes your account and the content you own). For any other request, contact us using the details in “Contact Us”. We will respond within the time required by applicable law (generally within 30 days) and will not discriminate against you for exercising your rights.

Account deletion is available directly in both the app (Profile → Delete Account) and the website (Dashboard → Profile), and takes effect immediately and permanently. Step-by-step guide:

Account & Data Deletion page

17. Region-Specific Privacy Rights

European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are in the EEA, the UK, or Switzerland, you have all the rights listed above under the EU GDPR, the UK GDPR, and the Swiss FADP. You may contact us to exercise them, and you have the right to lodge a complaint with your local supervisory authority. Our data controller is based in Hungary; the lead Hungarian authority is the National Authority for Data Protection and Freedom of Information (NAIH).

California (CCPA/CPRA)

If you are a California resident, the CCPA (as amended by the CPRA) gives you the right to know and access the categories and specific pieces of personal information we collect, to correct it, to delete it, and to opt out of the “sale” or “sharing” of personal information. Over the past 12 months we may have collected the categories described in “Information We Collect” (identifiers, contact details, internet/usage activity, and user content).

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not knowingly sell or share the personal information of consumers under 16. We will not discriminate against you for exercising your rights, and you may use an authorized agent to submit a request. We also honor the Global Privacy Control (GPC) signal.

Other United States States

If you live in a U.S. state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, or others), you have similar rights to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, or certain profiling — none of which we perform. You may also appeal a decision about your request by contacting us.

Canada (PIPEDA)

If you are in Canada, you may access and correct your personal information and withdraw consent, subject to legal limits, and you may complain to the Office of the Privacy Commissioner of Canada.

Brazil (LGPD)

If you are in Brazil, you have rights under the LGPD, including confirmation of processing, access, correction, anonymization or deletion, portability, and information about sharing, and you may contact us to exercise them.

Australia and Other Regions

If you are in Australia or another country with privacy laws, you have the rights granted by your local law, including to access and correct your information and to complain to your local regulator. Wherever you live, you can contact us to exercise the choices described in this policy.

18. Children’s Privacy

The Services are intended for adults (18 years and older) and are not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age in your country). If we learn that we have collected such information without proper consent, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

19. Third-Party Links and Services

The Services may contain links to third-party websites and contact channels (for example Telegram, social networks, business websites, and Google Maps). We are not responsible for the privacy practices or content of those third parties, and we encourage you to review their privacy policies.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you in the app. Your continued use of the Services after a change takes effect means you accept the updated policy.

21. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your privacy rights, you can reach us:

By email: rahyab.website@gmail.com
By email: contact@rahyabmohajer.com
Through the Contact Us section on the Rahyab Mohajer website or app

Rahyab Mohajer is operated by a private individual based in Hungary (European Union), who is the data controller responsible for your personal information.