Privacy Policy — Mashy
Last updated: 17 October 2026
Mashy is a maps, navigation and traffic app for Iraq. This policy explains what we collect, why, and how we protect it.
1. Location
We use your precise location to show you on the map, calculate routes, give voice guidance and warn about speed limits and hazards.
During navigation the app keeps using your location in the background or with the screen off so guidance isn't interrupted. A persistent notification is shown the whole time, and this stops when navigation ends.
2. Traffic data (optional)
If you agree to "share traffic data", the app sends points of your trip (location, speed, heading, time) while driving to calculate congestion for everyone.
These points carry a random, frequently changing trip id and are not linked to your name, account or phone number.
Raw points are deleted within about an hour; we keep only average road speeds.
With these points the app sends one number for how much the phone shakes while driving; we keep it with the car's speed, per street, for 30 days without linking it to your account, to find dirt and unpaved roads. Nothing else from the phone's sensors is recorded.
While navigating, if you leave the suggested route, the app sends the point and direction of the road you didn't take. We keep it linked to your account for two weeks so the same driver isn't counted twice, use it only to spot closed roads that several drivers avoid, and show it to no one.
You can turn sharing off at any time in Settings.
3. Account and device
The app works without sign-up using an anonymous device account (random id, platform, app version, language).
We may keep an approximate location of your device (rounded to about 1 km) to send notifications for your governorate.
Creating an account is optional, with a phone number and password (or Google and Apple where available), and is needed to order taxis, register as a captain, review places and add businesses. We store the name and the phone number or email you provide; passwords are stored hashed so they cannot be read.
Every account has an invite code. When a friend signs up with yours, you see their first name and the first letter of their second name, and whether they completed a first taxi ride. Your invite link shows your name the same way to whoever opens it.
The security permits you pick in Settings are kept on your phone and sent with route requests, so navigation can take the roads that need them. We keep them with the computed route for up to 3 hours to recalculate it during navigation, and never link them to your account.
Maps you download for offline use are stored on your phone only.
4. Content you add
Reports (type, location, time, direction) are shown to other users without your name.
Reviews are shown with the name in your profile.
Business details and photos you submit are reviewed by our team before publishing.
Car market listings (photos, make, model, year, mileage, price, governorate and description) are shown to everyone, with Mashy's logo on the photos. Your account's phone number shows only to registered users, and we hide any phone number you write in the description from everyone else. A car you remove is deleted with its photos after 30 days, a sold one after 90 days.
Published businesses also appear on our website, mashyiq.com, in the Iraq Guide, and cars on offer on its car market pages; they may show in search engines such as Google. Car pages never show the seller's phone number.
When you promote a business or feature a car, the transfer receipt you send is stored privately and only our staff open it, to confirm the payment. We count how often a promoted business is shown and tapped, per day and in aggregate, and show the figures to its owner, without knowing who saw it.
5. Taxi service
When you order a taxi we store the pickup, destination, route, price and ride times, and the name and phone number you enter.
The captain who accepts your ride sees your name, phone number, pickup and destination; you see his name, photo, phone number, car details and position until the ride ends.
An online captain sends his position every few seconds so we can offer him nearby rides and follow the ride; this stops when he goes offline.
Captains' documents (national ID, driving license, car registration) and transfer receipts are stored privately and only our staff can open them.
We keep the ratings both sides give (the customer's thumbs up or down with the options picked), the reason given for any cancellation, and the captain's wallet history to run the service and for accounting.
Messages between the customer and the captain during a ride are seen by both, may be read by our staff to handle complaints, and are deleted 30 days after the ride ends.
If a ride is cancelled after a captain accepted it, the captain's app keeps sending its location for two hours, even when he goes offline, and the customer's app sends its location if opened during that time. We use this only to detect rides that are cancelled and then completed outside the app.
Payment is cash only; we never ask for or store card details.
6. Notifications
We store a push token (FCM) to send road alerts, the status of your requests and announcements. You can turn them off in your phone settings.
7. Ads
The app shows a banner at the bottom of the screen; it hides during navigation while the car is moving and never appears on the car screen. Google AdMob ads may use your device's advertising id under Google's policy. For paid ads we only count impressions and clicks in aggregate.
We use Meta's (Facebook's) tool to know when the app is installed or opened from our ads: it sends Meta the install and opens, your device's advertising id and the device type, never your location or account. You can turn it off in Settings ("Ad measurement with Facebook"); on iPhone the advertising id is only used if you allow tracking.
8. Third parties
We do not sell your data. We use service providers to run the app: Google (Firebase and AdMob), Meta (ad measurement) and the map tile servers (OpenFreeMap), which receive map download requests. Map data comes from OpenStreetMap.
9. Retention and deletion
Account data is kept while the account exists. You can delete your account in the app (Account → Delete account): the account stops at once, your reviews and saved places are deleted, and your cars leave the car market, then are deleted with their photos after 30 days. We keep your name, number and photo, a captain's documents and details, and taxi ride details for 30 days for safety and to handle complaints, then delete them for good. Past reports, published businesses and the ride and wallet records stay for accounting without any link to you.
10. Security
Data travels encrypted over HTTPS, and access to the admin panel is permission-based and logged.
11. Children
The app is not directed to children under 13.
12. Contact
For any privacy question, contact us using the support details shown in the app.
The same text is in the app.