Privacy Policy

1. Who we are and what this policy covers

Akarat (عقارات) is a digital property marketplace for discovering and publishing property listings in Syria. This policy applies to the Akarat mobile app, akarat.app, the web app at sy.akarat.app, and the support services connected to them.

Akarat is operated and its data is controlled by Leafer Development, registered with the Netherlands Chamber of Commerce under KVK number 87773988. Its website is leaferdevelopment.com. In this policy, “Akarat”, “we”, and “us” refer to Leafer Development.

2. Data we collect

• Account data: your verified email address, verification-code requests, session records, and an optional display name.
• Optional contact data: an unverified phone number you may add to your profile and choose to show on a listing. We never use the phone number for sign-in, verification, or account recovery.
• Marketplace content: listing details, property location, price, specifications, description, photos, videos, amenities, and listing status.
• Property coordinates (optional): a listing owner may drop a map pin on their own property. It is optional at every step, and a listing can be published and shown with its area name alone. The app requests device location once, in the foreground only, and only when you tap “Use my location” inside the map — never at launch, never while browsing, never in the background.
• Listing media metadata: photos are downscaled and re-encoded on your device before upload, then re-encoded on our servers with the EXIF block stripped entirely — including any GPS coordinates embedded by the camera, the device identifier, and the capture time. None of it is stored or served with the image. Videos are transcoded to 720p on the device before upload.
• Activity and communications: favourites, conversations and messages, sent and read timestamps, hall booking requests and date enquiries, notification preferences, and listing counters such as views and saves.
• Last-seen time: we record when your account was last active on the service and show it to the other participant inside a conversation only, so they know when to expect a reply.
• Follows, blocks, and reports: who you follow, who you have muted or blocked, and any report you send about an account or listing, including its reason and text. A report is never disclosed to the reported account; it reaches our moderation team only.
• Saved searches and notifications: the search criteria you choose to save to your account, and the notification history we build for you (a new message, a listing status change, new results for a saved search) together with its read state.
• Support requests: the text and history of your messages to our support team, whether sent by email or from inside the service.
• Operations and security data: IP address, request times, rate-limit and abuse-prevention records, and basic error and diagnostic logs.
• Data kept on your device: language, session token, recent searches, one listing draft, and a limited image cache. Recent searches and the draft stay on the device unless parts are uploaded when you publish.

3. Why we use data

• To create accounts and sign users in with a six-digit code sent by email, and to manage sessions securely.
• To provide search, browsing, publishing, listing management, favourites, and communication between seekers and advertisers.
• To show contact details that a listing owner chooses to make available.
• To review every listing before it is published, assess reports, and apply our content rules to listings and accounts.
• To secure the service, limit abusive traffic, prevent fraud and misuse, and diagnose failures.
• To answer support requests, comply with legal obligations, and enforce the Terms of Use.

Where laws such as the GDPR apply, our legal basis depends on the activity and may include performing our contract with you, our legitimate interests in operating and securing the service, your consent or choice, and legal obligations.

4. When we share data

We do not sell personal data. The app currently contains no third-party advertising, analytics, or crash-reporting SDKs.

We share only what is needed with processors that help operate the service: Brevo for email verification delivery, Hostinger infrastructure for the API, database, and mail, and Cloudflare R2 and Cloudflare Stream for listing media storage and delivery when the cloud media path is used. We may use an equivalent replacement and will update this policy if providers change.

Akarat’s maps are self-hosted on our own servers under akarat.app and built from open OpenStreetMap data. Neither your map browsing nor your location is sent to a third-party map provider.

We may disclose data when law requires it, to protect users and the service, or as part of a transfer of the Akarat business to another operator subject to appropriate continuing safeguards.

5. What other users can see

Active listings are public and include listing content, media, and public advertiser information. A phone number appears only when it has been added to the profile and the owner chooses to show it for that listing.

Every account that publishes a listing has a public profile page showing its display name, the year it joined, its active listings, and counters computed from its activity: listing count, follower count, and average reply time in messages. Those counters are calculated by the system and cannot be edited.

Where an owner has dropped a map pin, it is not published as entered. Seekers see an approximate location only, snapped to a 0.005° grid — roughly half a kilometre — and labelled “Approximate location” in the interface. The exact point stays available to the listing’s own owner and to our moderation team.

Inside a conversation, the other participant can see your last-seen time and when you read their messages. This is not shown to visitors or on public pages.

Messages are available to the two conversation participants, and to our moderation team in the cases described in the next section. Do not send passwords, verification codes, financial details, or anything you do not want shared.

6. Moderation, reports, and blocking

Every new listing, and every edit to a listing’s content, goes through human review before it becomes visible to seekers. Our moderation team sees the full listing, including the exact map pin and the advertiser’s contact details, and may approve it or send it back with a written reason.

Our moderation team can read conversation content when investigating a report, checking suspected misuse, or responding to a legal request. Every such access is written to an internal audit log, and the team can hide a violating message while leaving a visible trace that it did so. The team cannot send messages on your behalf.

A report you send about an account is never disclosed to that account. Blocking is your own control: it stops contact between the two accounts, hides each side’s listings from the other, drops any follow between them, and is never revealed to the blocked account. You can lift it at any time from your blocked-accounts list.

7. Retention and deletion

• A verification code normally expires after five minutes. A session lasts for a rolling 90 days and can be ended by signing out.
• We keep account, listing, favourite, and conversation data while the account exists or for as long as it is needed to provide the service.
• When an account is deleted, we delete the account record, sessions, favourites, owned listings and media, incomplete uploads, saved searches, your notification history, your follows, your block lists, the reports attached to you, and your support correspondence. We remove the owner’s identity and contact details from unavailable snapshots kept for other users.
• The internal audit log of moderation actions (approving or rejecting a listing, restricting an account) is kept after deletion as a platform-safety record. It contains neither your email address nor your phone number.
• A conversation attached to a listing you owned may remain in the other participant’s history in an unavailable state after your identity is removed from the listing. Conversations you started as a buyer are deleted with the account.
• Security logs and backups are kept only for operational, security, and legal needs, then deleted or overwritten through the normal rotation cycle.

8. Your choices and rights

• You can edit your display name, email, optional contact number, and notification preferences in account settings.
• You can remove favourites, delete your listings and media, sign out, and permanently delete your account in the app.
• You can also request deletion outside the app from our Delete Account page. Use the email registered to the account so we can verify ownership.
• Depending on applicable law, you may have rights to access, correct, erase, restrict, object, port data, or complain to the relevant data-protection authority.

9. Security and international transfers

We use HTTPS outside local development, store hashes of session tokens instead of raw tokens on the server, and restrict access to systems and credentials. No transmission or storage method is completely secure, so absolute security cannot be guaranteed.

Our providers may process data in different countries. Where the law requires additional safeguards for international transfers, we use the appropriate available mechanisms.

10. Children, changes, and contact

The service is intended for property seekers and advertisers and is not designed for children. If you believe a child submitted personal data without appropriate supervision, contact us so we can remove it.

We may update this policy when the service, providers, or legal requirements change. We will publish the new version here and revise the date above.

This website currently uses no optional cookies, advertising tools, or analytics, so it does not display a cookie-consent banner. We will ask for the appropriate choice before adding any technology that requires consent.