English
1. Who is responsible
Darbayn is the service name. The data controller is the individual owner and operator of Darbayn, reachable at o-shobaky@hotmail.com in Amman, Jordan. This notice does not identify a separate registered company or invent a legal entity name.
2. Data we use
- Registration and account: verified email, Firebase user identifier, age confirmation, accepted terms and privacy versions, sessions, and account-security events. Email, adult status, and required consents are necessary for registration.
- Profile and preferences: alias or display name, age, city or location, gender, relationship history, existing children and their count where relevant, future-children preferences, employment, work plan after marriage, height in centimetres, weight in kilograms, a man's living arrangement, written profile fields, visibility choices, and selected hard compatibility requirements.
- Optional profile photo: a sanitized private JPEG representation, review status, visibility choice, and limited moderation and deletion records. Darbayn does not retain the original filename or image metadata in the delivered profile photo.
- Identity review: original images of the complete front and back of a Jordanian ID stored privately in Cloudflare D1, consent version and time, review status and decision, and a server audit record of the decision and deletion.
- Member activity: discovery results, connection-request introductions and status, accepted relationships, saved profiles, blocks, encrypted message envelopes, relationship and message metadata, and member public chat keys. Private decryption keys and backup passphrases remain with members.
- Requests and operations: export, correction and closure requests, case numbers and receipts, fixed audit codes, notices, command receipts, and rate-limit records.
- Security and abuse prevention: Firebase App Check tokens supplied with protected requests and the result of allowing or refusing a request. Firebase App Check uses reCAPTCHA Enterprise in the browser to help Google assess whether a request is likely to be automated abuse. Google may process technical, browser, device, and interaction signals for that security service.
Safety report intake is processed when the in-service control is shown as available. Reports can include the reported account, category, member statement, status, and limited review records. Appeal intake is processed only when an appeal control is explicitly enabled.
3. Why we use it
Darbayn uses data to register and authenticate members, operate profiles, evaluate mutual compatibility, apply visibility choices, support discovery and connection requests, moderate and privately deliver an approved profile photo, operate saved profiles, blocks and encrypted chat, review IDs, process enabled safety reports, support accounts, provide exports, corrections and closure, enforce service rules, and protect the service. A hidden field may be used for compatibility only when a member deliberately chooses it as a hard requirement; it is not displayed merely because it affects compatibility. Height and weight are not used to calculate or display BMI or body labels. Profile and photo data are not used for advertising or marketing. Firebase App Check and reCAPTCHA Enterprise help protect registration and protected service requests from automated abuse, fraud, and misuse.
Darbayn uses an App Check token as a security credential for a protected request. It does not use raw reCAPTCHA Enterprise signals or an App Check token to enrich a profile, decide matching or discovery, or target advertising. This notice does not claim that Darbayn receives a raw reCAPTCHA score, determines the token lifetime, or controls Google’s underlying signal collection.
4. Full Jordanian ID visibility
The original images are transmitted over HTTPS and stored privately in Cloudflare D1. Authorized reviewers sign in with a password to view both sides and record a manual decision; no ID key file or passphrase is required. A server audit record records the decision and deletion. Active ID image rows are deleted after a completed review or withdrawal. Historical encrypted submissions require updated consent and both-side reupload before this processing replaces them. Other members cannot view ID images. Private message encryption and member-held chat keys are unchanged.
An authorized ID reviewer may view the printed information on the front and back only to assess document validity and adult age. Darbayn does not use unrelated printed information to enrich a profile or make discovery or connection decisions. The reviewer must not copy unrelated printed information into notes, logs, profiles, or another system.
5. Processors and processing outside Jordan
Google Firebase Authentication processes account-authentication data. Google Firebase App Check and reCAPTCHA Enterprise process security and abuse-prevention signals and App Check service data. Cloudflare Workers and D1 process application requests and stored service data. These providers may process data outside Jordan according to their infrastructure, contracts, security measures, and published transfer terms. Darbayn does not claim that all data remains in Jordan.
Darbayn does not use these security signals, tokens, or service data for advertising and does not ask a processor to use Darbayn data for unrelated advertising on Darbayn’s behalf. Provider processing is also governed by the provider’s own terms and privacy information.
6. Security and browser storage
Controls include HTTPS, a secure host-only session cookie, CSRF protection, short sessions, access roles, recent reviewer authentication, rate limits, private storage and authenticated delivery of original ID images, private object storage with no public photo URL, authenticated profile-photo delivery through Darbayn, sanitized JPEG photo representations, immediate removal of photo access when removal, rejection or closure begins, browser encryption for message content, member-held private keys, bounded audit records, server-recorded ID decisions and deletion events, and fail-closed readiness gates. Firebase App Check may keep a token cache in the browser so it can request and reuse security tokens. The separate Cookie Notice explains this storage and the _GRECAPTCHA cookie used by Google’s reCAPTCHA service. No security measure removes all risk.
7. Retention
| Data | Period or event |
|---|---|
| Front and back ID images | Only while manual review is pending; deleted after manual approval, rejection, a request for clearer images, or withdrawal. |
| ID consent, decision, destruction records | 24 months. |
| Account, profile, and preferences | Active account lifetime; deleted or anonymized when closure completes. |
| Pending or approved profile photo | Until removal, replacement, rejection, or completed account closure. Access is removed immediately and deletion is queued when one of those events begins. |
| Limited profile-photo moderation receipts | 24 months. |
| Discovery, connection requests, relationships, saved profiles, and blocks | Until the action is removed or completed, or account closure completes. |
| Encrypted direct messages | 180 days from creation or completed account closure, unless a specific documented legal hold applies. |
| Protected audit and closure receipts | 24 months. Rate-limit records are kept no more than 24 hours. |
| App Check tokens and reCAPTCHA Enterprise signals | Darbayn does not add raw signals or token contents to profiles or its D1 retention records. Browser cache and provider-side retention are controlled by the browser and Google’s service settings and terms. |
A documented court order, active complaint, active appeal, or incident response may temporarily preserve a specific Darbayn record. Cloudflare D1 Time Travel may keep deleted material recoverable for up to seven days; a restore triggers reconciliation and re-deletion of expired material.
8. Your rights and requests
Subject to applicable Jordanian law, you may request access, correction, restriction, erasure, objection, consent withdrawal, a portable export where available, or information about a decision. You may complain to a competent Jordanian authority and request breach information where notification is required. Darbayn will not impose an adverse account consequence merely because you make a privacy complaint.
Use authenticated export, correction, and closure controls when available, or email o-shobaky@hotmail.com. Do not email an ID image, password, Firebase token, private key, or encrypted-backup passphrase. We will provide a case number and use a proportionate verification method. This email supports account and privacy requests; it is not an emergency service or active safety-report intake.
9. Breaches and changes
Suspected breaches are contained, assessed, documented, and coordinated with processors. A competent authority and affected people will be notified when required. Material policy changes receive a new version and effective date before new consent is requested. Contact the individual owner and operator of Darbayn at o-shobaky@hotmail.com, Amman, Jordan. Publication does not claim independent legal review or legal-compliance certification.