Privacy Policy
Last updated:
Harakeh is a guide to places and activities in Amman. This policy explains exactly what it knows about you — which is less than you might expect.
The short version
- You can browse every place, search, filter and get directions without an account.
- Harakeh has no analytics, no advertising, no tracking pixels and no crash-reporting SDK.
- Your location is only ever read after you allow it, is held in your browser's memory while the tab is open, and is never sent to our servers or saved anywhere.
- If you create an account, the only thing stored on our side is a list of the places you saved.
- You can delete your account and its data from inside the app at any time.
Who this policy covers
This policy applies to the Harakeh web app and website, operated by [LEGAL OPERATOR NAME REQUIRED]. It covers the app itself and the services listed under "Services we rely on" below.
Harakeh is a directory. It does not take bookings, process payments, sell tickets or handle any money.
What information Harakeh collects
- Account information — only if you choose to sign in
- Sign-in is handled by Clerk, our identity provider. Clerk holds your email address, your name if you supply one, and your profile picture if you signed in with Google. Harakeh's own database never receives your email or your name — it stores only the anonymous user identifier Clerk issues you.
- Your saved places
- When you tap the heart on a place, we store the identifier of that place, the date you saved it, and your Clerk user identifier. That is the entire record. We do not store why you saved it, or anything about how you use the app.
- Your approximate location — only while you are using the map
- If you allow it, the browser gives Harakeh your coordinates and an accuracy figure. They are used in your browser to centre the map and to work out how far places are from you. They are held in memory only: never transmitted to our servers, never written to your device's storage, and discarded the moment you close or reload the page.
- Preferences stored on your device
- Harakeh saves your language choice and whether you have already seen the introduction in your browser's local storage, and the tab you came from in session storage. These stay on your device and are never sent anywhere. Clearing your browser data removes them.
- Technical request information
- Our hosting provider, Cloudflare, records standard request information — IP address, timestamp, the address requested and your browser's user-agent string — as every web server does. We use it only to keep the service running and to investigate abuse.
- Abuse-prevention counters
- To stop one account overloading the service, we keep a short-lived counter of recent requests against your user identifier at Upstash. These counters expire automatically within minutes and contain nothing but a count.
- Account-deletion audit records
- When an account is deleted we store the event type, the time, and a one-way hash of the user identifier computed with a secret key. The hash cannot be turned back into your account, and it exists so we can prove a deletion request was honoured.
What Harakeh does not collect
So that there is no ambiguity, Harakeh does not do any of the following:
- No analytics or usage measurement of any kind, first-party or third-party.
- No advertising, ad identifiers, or sharing of data with advertisers.
- No crash- or error-reporting service.
- No push notifications, and no notification permission request.
- No access to your camera, microphone, photos, files or contacts. The app is served with a browser permissions policy that switches camera, microphone, payment and USB access off outright.
- No search history. Your search text and filter choices never leave your browser — the place data is downloaded to your device and filtered there.
- No location history. Only the single most recent fix exists, and only in memory.
- No selling, renting or trading of personal information. Ever.
Why we collect what we collect
- To make Saved work
- Your account and your saved place list exist so that your list follows you between your phone and your laptop. Without an account there is nothing to store, which is why everything else in the app works signed out.
- To show you what is nearby
- Your location is used to centre the map on you and to sort places by distance. This is the only reason it is ever requested.
- To keep the service available
- Request logs and rate-limit counters exist to detect and stop abuse, and to debug failures.
Where the law requires a legal basis for processing, we rely on your consent for location access and for creating an account, and on our legitimate interest in running a secure and available service for the technical records above.
Location, in detail
Harakeh uses your location to show places and activities near you. Nothing else.
Harakeh does not ask for your location when you open it. The request happens the first time you open the Map tab, and only after you tap the button that explains what it is for. Your browser then shows its own permission prompt, which you can refuse.
If you refuse, the app keeps working. You can browse, search, filter by budget, open any place and get directions exactly as before. The only differences are that the map will not centre on you and the "Nearby You" list falls back to an unsorted selection.
Harakeh will not ask again by itself after a refusal. The map shows a "Try again" button so that asking again is always your decision.
You can withdraw location access at any time from your browser's site settings for Harakeh. There is nothing stored for us to delete, because the coordinates only ever existed in your browser's memory.
One thing worth knowing: the map's imagery comes from OpenFreeMap. Your browser fetches map tiles from them directly, so they can see your IP address and which part of the map you are looking at. They do not receive your coordinates from us.
Services we rely on
Harakeh is built on a small number of external services. Each one only receives what it needs to do its job, and each has its own privacy policy.
- Clerk — accounts and sign-in
- Holds your email address, name and profile picture, and records your sign-in activity and IP address. Used only if you create an account.
- Supabase — database
- Stores the list of place identifiers you saved against your anonymous user identifier. It never receives your email or name.
- Cloudflare — hosting and delivery
- Serves the app and sees standard request information, including your IP address. Cloudflare's bot-protection challenge may also appear on the sign-in screen, where it is used by Clerk.
- Upstash — abuse-prevention counters
- Holds short-lived request counters keyed to your user identifier.
- OpenFreeMap — map imagery
- Your browser requests map tiles directly from OpenFreeMap when the map is open, so it receives your IP address and the area of the map in view.
- Google Fonts — typefaces
- The app's typefaces load from Google's font servers, which receive your IP address as part of that request.
- Google — optional sign-in and directions
- Only involved if you choose to sign in with Google, or when you tap "Get Directions", which opens Google Maps in a new tab. From that point Google's own privacy policy applies.
These companies act as processors for us and are not permitted to use your information for their own purposes. We do not share your information with anyone else, and we do not sell it.
How long information is kept
- Your account and your saved places: until you delete your account. Nothing expires on its own.
- Your location: until you close or reload the page. It is never written down.
- Preferences on your device: until you clear your browser data.
- Abuse-prevention counters: minutes.
- Server request logs: retained by Cloudflare under their own retention schedule, then discarded.
- Account-deletion audit records: kept indefinitely, but they contain only a non-reversible hash, an event type and a timestamp.
Deleting your account and your data
Open Settings from the Saved screen, scroll to "Delete account", and confirm. Harakeh asks you to confirm once on a screen that explains what is about to happen, because the action cannot be undone.
Deleting your account removes:
- Your Clerk account, including your email address, name and profile picture.
- Every saved place linked to your account.
- Your ability to sign back in with that account. Signing in again creates a new, empty one.
Two things survive, and you should know about both:
- The deletion audit record described above, which holds only a non-reversible hash of your user identifier.
- Cloudflare's server request logs, which are not addressable by account and expire on their own schedule.
If you cannot reach the app for any reason, write to [PRIVACY CONTACT EMAIL REQUIRED] and we will delete the account for you.
Your rights
Depending on where you live you may have the right to ask for a copy of your information, to have it corrected, to have it deleted, or to withdraw consent you previously gave. You can exercise most of these yourself:
- A copy of your information: your saved list is visible on the Saved screen; your account details are in Clerk's account screen, reachable from Settings.
- Correction: change your name, email or picture from the same account screen.
- Deletion: Settings, then "Delete account".
- Withdrawing location consent: your browser's site settings for Harakeh.
For anything you cannot do yourself, write to [PRIVACY CONTACT EMAIL REQUIRED]. We will respond as quickly as we reasonably can.
How your information is protected
- Everything is served over HTTPS, with a strict Content-Security-Policy that limits which external services the app is allowed to contact at all.
- Database credentials exist only on the server. Your browser never receives them.
- The database refuses all direct access; every read and write goes through our server after your identity has been verified.
- Every write is checked against the request's origin, and every account is rate-limited.
No service can promise perfect security, and we do not. If we ever discover a breach affecting your information, we will tell you.
Where your information is held
Harakeh is built for Amman, but the services above operate globally and may store or process information on servers outside Jordan, including in the European Union and the United States. Using Harakeh means accepting that your information may be handled in those places.
Children
Harakeh is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, write to us at the address below and we will remove it.
Changes to this policy
If this policy changes, the date at the top changes with it. If a change materially affects what Harakeh collects or how it is used, we will say so in the app rather than relying on you to notice the date. This version is dated 2026-09-18.
Contact
Questions about privacy, or a request about your information: [PRIVACY CONTACT EMAIL REQUIRED].
Harakeh is operated by [LEGAL OPERATOR NAME REQUIRED].