Privacy Policy

Last updated: October 2, 2026

This policy explains what personal data the Anaka app and anaka.app use, why, who receives it, and your rights. The controller is El Mehdi El Fakir, c/o Mailboxde.com GmbH, ID 369508, Äussere Weberstr. 57, 02763 Zittau, Germany, privacy@anaka.app.

In short: we collect what is needed to run your account, your bookings and the app. Everything we collect is linked to your account. We don’t sell your data, we don’t show ads, and we don’t track you across other companies’ apps or websites.

1. What we collect

Contact info

• Name, email address and phone number: to create and sign in to your account (also through Google or Apple), to verify your number with a text message code, and to send booking confirmations and reminders. Businesses see them for the bookings you make with them.
• If a business books for you at the counter, it may enter your name and phone number itself. When you later create an account with that verified number, the app asks whether to add those visits to your account.

Location

• Precise location: only if you allow it on your phone, to show businesses near you and how far they are. We use it for the search and don’t keep it on our servers. Our push notification provider (OneSignal) can also receive your phone’s location while you allow location for Anaka.
• Coarse location: the country and city on your profile, which choose the businesses we show you. When you open a business’s page we record the visit with your city and country, so the business can see how many people view its page. OneSignal may also work out your country from your IP address (not for users in the EU and UK).
• You can turn location off at any time in your phone’s settings (or in the app: Account → Privacy & Permissions).

Contacts

• Only for business owners who use “Invite customers”: if you allow it, the app reads your phone’s contacts on the phone itself so you can pick people. Only the people you pick (their name, email or phone number) are sent to us, to send them the invitation by email or text message. Your address book itself is never uploaded.
• People invited this way can stop all invitations with the unsubscribe link in the message.

What you write and share

• Messages you send in the in-app chat (to a business you booked with, or within a business’s team).
• Photos you choose to upload: your profile photo, and a business’s photos. The app only reads the photos you pick.
• Other content: reviews and review replies, booking notes, businesses you save as favorites, and, for businesses, their details, locations, opening hours, services, prices and staff.

Purchases

• Your bookings (business, services, staff member, date, time, status), the payments recorded for them (amount, method such as cash, paid or not) and your loyalty stamps and rewards.
• For business owners: the business plan you subscribe to, its renewals and cancellations. You pay through the App Store or Google Play; we never see or store card numbers.

Identifiers

• User ID: the account id we give you. It is also shared with OneSignal, to send your notifications to your phones. For business plans, RevenueCat receives a separate random id for the business (never your name or email).
• Device ID: the push notification id of your phone (from OneSignal), a random id that keeps a booking you start before signing in, and the device id recorded with a business page visit. We don’t use the advertising identifier (IDFA / Android advertising ID).

Usage data

• Product interaction: the business pages you open (see Coarse location above) and, through OneSignal, when you open the app, for how long, and which notifications you tap. We use this to run the app and to show businesses how their page and notifications perform.
• Your preferences: account type, language, time zone, light or dark mode, and which notifications you want.
• Your password is stored only in a protected (hashed) form.

What we don’t collect

No health, fitness, financial or credit data, no card numbers, no sensitive data, no audio, no browsing history, no search history kept on our servers, and no advertising or crash analytics.

2. Why we use it

• To run your account, the bookings you make, the chat and loyalty cards (contract).
• To send booking confirmations, reminders and the notifications you choose (contract; push notifications only with your permission).
• To verify your phone number and keep accounts safe (legitimate interest).
• To show nearby businesses, only with your consent (consent).
• To give businesses statistics about their page, bookings and customers (legitimate interest).
• To keep records the law requires (legal obligation).

We don’t sell your data, we don’t show advertising, and we don’t use your data to track you across other companies’ apps or websites.

3. Who sees it

• The businesses you book with see your name, phone number, email, bookings, payments, loyalty stamps, messages and reviews for their business. For their customers’ data, businesses are the controller and we process it on their behalf.
• Your reviews are shown on the business’s page with your name.
• Service providers that run Anaka for us, each only for its task:
  • Supabase: database, sign-in and file storage (EU, Ireland).
  • Vercel: this website.
  • OneSignal: push notifications (your user id, your phone’s push id, app sessions and notification taps; location only as described above).
  • RevenueCat: business plan subscriptions (purchase history, linked to a random business id).
  • Resend: emails (confirmations, reminders, invitations).
  • Twilio: text messages (verification codes, invitations).
  • Stripe: card payments, once they are available (card details go to Stripe only; we never see them).
  • Google and Apple: sign-in, if you choose it.
  • Google Play and the Apple App Store: app delivery and business plan payments.

4. How long we keep it

We keep your data while your account exists. When you delete your account, your profile, settings, favorites, chats, notifications and photos are deleted and upcoming bookings are cancelled. Your past visits stay in the businesses’ records without your name, email or phone number (“Deleted customer”). Records the law requires us to keep, such as accounting records, are kept for up to 10 years. Payments for business plans are processed and kept by Apple, Google and RevenueCat, and card payments, once available, by Stripe, under their own privacy policies.

5. Your rights

You can access, correct, download or delete your data, object to or restrict its use, and withdraw consent at any time. Most of it you can change in the app; you can delete your account in Account → Edit Profile → Delete Account, or at anaka.app/deleteAccount. You can turn notifications and location off in the app or in your phone’s settings. For anything else, write to privacy@anaka.app. You can also complain to your data protection authority.

6. Security

Data is encrypted in transit, access is limited to what each person needs (a business only sees its own customers), and passwords are never stored in plain text.

7. Children

Anaka is not meant for children under 16. You must be at least 16 to create an account.

8. Changes

We will tell you in the app before important changes to this policy apply.

Contact

El Mehdi El Fakir · c/o Mailboxde.com GmbH, ID 369508, Äussere Weberstr. 57, 02763 Zittau, Germany · privacy@anaka.app