Privacy Policy
Effective date: 27 October 2026
This Privacy Policy explains how Qalasi (“Qalasi”, “we”, “us”, or “our”) collects, uses, shares, and protects your information when you use the Qalasi mobile app and this website (together, the “Service”). Qalasi is operated by Javid Rzayev, an individual based in Germany, who is the data controller for the personal data described here. If you have questions, contact us at hello@qalasi.com.
By using the Service you agree to this Policy. If you do not agree, please do not use the Service.
On this page
1. Information we collect
- Account information. When you sign in with Apple or Google we receive a unique account identifier, your name, and your email address (which may be an Apple private-relay address if you choose “Hide My Email”). We do not receive your Apple or Google password. Qalasi has no email/password login.
- Location data. With your permission, the app accesses your device’s location to centre the map, set your starting point, build routes, and provide live guidance. Location is used while you are using the app (“when in use”); we do not track your location in the background.
- Routes you create or save. When you generate or save a route we store its start and destination names, distance, estimated duration, the route line (an encoded polyline), and the scenic stops along it (their names and coordinates), linked to your account. If you rename a route, or file routes into lists, we also store the names you choose for them.
- Your settings. Your choices in Profile - the app language, whether the screen stays on, how many scenic stops a route may hold and how many to aim for, how scenic a route may be, the kinds of places to route through, and the search area for scenic places - and the travel mode you last used are stored with your account so a new device inherits them. We also store whether and when you accepted our Terms of Service.
- Routes you share. If you choose to share a route, we store a copy of those same route details under a short random link id. The route is viewable only by people who open the link in the signed-in Qalasi app; shared links expire after 30 days and you can unshare a route at any time. A shared copy carries no name or email address, and the account it belongs to is never shown to anyone opening the link. It is removed when you unshare it or delete your account. If you add a link to a share card, we also store the card picture with its title (a city name), the scenic stops reached, distance, time and travel mode under that link. Anyone with the link can see the card on qalasi.com and in link previews while the link is active, without the app. The card shows no exact location and is removed together with the link.
- Search input. Text you type into the search and city fields is sent to Google to return place suggestions.
- Technical data. Basic information necessary to operate the Service, such as app version and device type, and standard server logs (e.g. IP address, timestamps) generated by our providers for security and reliability.
- Data stored on your device. The app keeps some data locally on your phone so it works smoothly: your sign-in session (in the device’s secure storage), your settings, and the last map position you viewed. If you turn on Offline mode, it also keeps copies of your saved routes and lists, and details of their stops, until you turn Offline mode off or sign out. This data stays on your device, is not used for tracking, and is removed when you uninstall the app.
We do not knowingly collect contacts, photos, health data, browsing history, or advertising identifiers, and we do not use the Service to track you across other apps or websites.
2. How we use your information
- To create and manage your account and authenticate you.
- To compute scenic routes on foot, by bike or by car (including step-free walking routes), show the map, and provide turn-by-turn guidance.
- To save and display your favourite routes and let you share routes you choose to share.
- To operate, secure, debug, and improve the Service.
- To comply with legal obligations.
3. Legal bases (EEA/UK users)
Where the GDPR or UK GDPR applies, we process personal data on these bases: performance of a contract (Art. 6(1)(b) GDPR - providing the app you asked for), your consent (Art. 6(1)(a) GDPR - device location access, which you can withdraw at any time in system settings without affecting earlier processing), legitimate interests (Art. 6(1)(f) GDPR - keeping the Service secure, preventing abuse, and finding and fixing errors), and legal obligation (Art. 6(1)(c) GDPR) where required.
An Apple or Google sign-in is required to use the app; without it we cannot provide the Service. Location access is optional, but without it features such as starting from your current position and live guidance are unavailable.
We do not use automated decision-making, including profiling, that has legal or similarly significant effects on you.
4. How your information is shared
We do not sell your personal data and we do not share it for advertising. We use a small number of service providers (processors) strictly to run the Service:
- Google Maps Platform (Google Ireland/LLC) - map tiles, place search, and walking, cycling and driving directions. Coordinates and search text are sent to Google to return results. Google’s handling is governed by its own terms and privacy policy.
- Supabase - authentication, database hosting and server functions for your account and saved routes, protected by row-level security so each user can access only their own data.
- openrouteservice (HeiGIT gGmbH, Germany) - step-free walking routes when you choose Stroller or Wheelchair. Only the coordinates of the start, stops and destination and the instruction language are sent, through our Supabase server - never your name, email or account.
- Apple / Google Sign-In - identity providers used only when you choose to sign in.
- Expo (Expo Application Services) - delivers app updates. When the app starts it asks Expo's servers whether an update is available, sending the app version, platform, and a random installation identifier. It is not linked to your account and is not used to track you.
- Cloudflare - hosts this website and routes our hello@qalasi.com email. As our hosting provider it processes standard request data (such as your IP address) to serve pages securely.
We may also disclose information if required by law, to protect rights and safety, or as part of a business transfer, in which case we will notify you.
5. International transfers
Our providers may process data in countries outside your own, including the United States. Where required, such transfers rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses).
6. Data retention
We keep account information, settings, and saved routes for as long as your account is active. A shared route copy stays stored after its link expires, until you unshare the route or delete your account. Device location used for routing is processed transiently to fulfil your request and is not retained by us as a location history. When you delete your account, your account record, saved routes, and shared routes are deleted (see below). Server logs kept by our providers for security and reliability are retained for short periods (typically no more than 30 days) and then deleted automatically; provider backups are removed on routine cycles.
7. Your rights and choices
- Delete your account in-app: Profile → Delete account permanently removes your account and all saved routes. The same steps, and what exactly is removed, are set out at qalasi.com/delete-account.
- Delete individual routes any time from Favorites.
- Location permission can be granted or revoked in your device settings at any time.
- Depending on your region you may have rights to access, correct, export, restrict, or object to processing of your personal data. To exercise these, email hello@qalasi.com. You may withdraw any consent at any time, and you may lodge a complaint with a data-protection supervisory authority, in particular in the EU member state where you live or work or where you believe an infringement occurred.
8. Security
Data is encrypted in transit (HTTPS/TLS). Authentication tokens are stored in the device’s secure storage. Access to your stored routes is restricted to your account by row-level security. No method of transmission or storage is perfectly secure, but we work to protect your information.
9. Children
The Service is intended for adults and is not directed to anyone under 18, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
10. Cookies
The Qalasi app does not use advertising cookies or trackers. This website serves only the assets needed to display the page and does not set marketing cookies.
11. Changes to this Policy
We may update this Policy from time to time. We will revise the “Effective date” above and, for material changes, provide additional notice where appropriate.
12. Contact
Qalasi · Javid Rzayev (Germany) · hello@qalasi.com
Qalasi