Privacy Policy

1. Operator and contact

This policy applies to the «Birga» mobile app and the https://birgaapp.uz website. The operator of the «Birga» app is Shahzod Ziyodullayev. The operator is responsible for how we use your data. If you have a privacy question or request, write to us:

• Email: privacy@birgaapp.uz — requests for a copy of your data, correction and deletion go to this address
• Telegram: @shahzod_ziyodullayev — for questions

2. What data we collect

We collect only what the app needs to work. You can use the app fully without giving the optional data. We do not collect your contacts or advertising identifier, and we do not use advertising or analytics services.

• Sign-in: if you sign in with Telegram — your phone number and Telegram ID; if you sign in with Google — your Google ID and email
• Profile: first name, last name, date of birth, gender, height, who you are looking for and why, photos, interests, qualities, answers to prompts and your search filters
• Optional: text about yourself, work and education, languages, lifestyle (marital status, children and family plans, smoking, drinking, exercise, pets) and religion
• Location: the point your phone detected or that you picked on the map. Before it is written to the server, it is rounded to a cell of about 1 km — exact coordinates are not stored
• Activity: swipes, matches, messages and reactions, read receipts and online status
• Selfie: used only during the check and not stored (section 9)
• Photo check results: for each photo, the estimated age, gender and inappropriate-content score (section 8)
• Device and technical data: push notification token, app language, version and platform, error reports, IP address and device type in server logs
• Payments: your Birga+ subscription and purchases, your phone number at the time of payment (taken from your account)
• Safety: reports you send and reports about you, blocks and moderation decisions

3. Why we use data and on what basis

We do not sell your data and do not use it for advertising. Each purpose and its basis:

• Dating service — account, profile, feed, matches, chats and notifications. Basis: our contract with you (Terms of Service)
• Safety — fighting fake profiles, inappropriate photos and rule violations, reviewing reports. Basis: contract
• Religion and face matching — basis: your separate consent, which you can withdraw at any time (section 9)
• Payments — activating Birga+ and accounting. Basis: contract and the law on accounting
• App stability — finding and fixing errors. Basis: contract

4. Who sees what

Other users see your profile only inside the app. Moderators and the administrator see only the part they need for their work.

• Other users: your first name (your last name is never shown), age, photos, profile details and city
• Distance: calculated from the approximate cell and shown in the app in whole kilometres, the smallest being «less than 1 km». Nobody sees your exact location
• Religion: visible only if you gave consent
• In Incognito mode, only people you swipe right on can see you. Snooze hides your profile for a while
• Photos are loaded into the app through links that cannot be guessed but are not protected: anyone who obtains a link can open the photo without the app. A deleted photo may stay in device caches for up to 1 day
• Moderators: the reported profile and up to 50 messages before the report — to make a decision. Every view is recorded in an audit log
• Chief administrator: can see account details and conversations, including the text of deleted messages — until it is permanently erased (section 7). Every conversation view is recorded in an audit log

5. Third-party services

The following services receive only the data needed for the stated task. We do not sell your data to anyone.

• Telegram — sign-in with Telegram: gives us your phone number and Telegram ID. Technical messages about server errors also go to the operator's private Telegram chat
• Google — sign-in with Google (ID and email); emails you send to privacy@birgaapp.uz arrive in the operator's Gmail inbox
• Firebase Cloud Messaging (Google) — push notification delivery: device token and generic text; names and message text are not sent
• Payme — payments: order number and amount
• Sentry — error reports: technical data and internal identifiers; names, phone numbers and emails are not sent
• OpenStreetMap Nominatim — place name lookup and city search: coordinates rounded to 1 km or the search text, sent directly from your phone
• OpenFreeMap — map display: your IP address and the area being viewed
• GIPHY — GIFs: the search text is sent through our server, but the GIFs themselves load from GIPHY's servers, so GIPHY sees your IP address
• Expo — app update delivery: app version, platform and IP address
• Cloudflare — the https://birgaapp.uz website, forwarding emails sent to privacy@birgaapp.uz and storing backups
• Contabo — hosting where the server and databases are located

6. Transfers outside Uzbekistan

Our server is located outside Uzbekistan. When you use the app, your data is transferred to and processed in the following places:

• Main server — France (Contabo): all databases and photos
• Backups — Cloudflare R2, European Union jurisdiction: databases encrypted, the copy of photos in private storage
• Error reports — Sentry (a US company), data stored in the European Union
• Sign-in, push and other services — Google, Telegram, Expo, GIPHY, OpenFreeMap and OpenStreetMap on their own servers, mainly in the United States and the European Union

7. Retention periods

Each kind of data is kept only as long as needed and is then deleted automatically. If you delete your account, your profile, photos, matches, conversations and location are deleted immediately — there is no waiting period. Periods:

• Profile, photos, swipes, conversations, photo check results and consent records — while your account exists
• Match with no messages — 24 hours (48 hours if extended once)
• Text of a deleted message — 90 days; if there is an open report concerning either side of the conversation or either side is banned — until the report is closed or the ban is lifted
• In-app notifications — 90 days
• Push delivery log — 30 days
• Rejected photos: inappropriate content — deleted immediately; rejected for age or gender — 30 days (so an administrator can review them); unfinished uploads — 24 hours
• Expired or revoked sign-in tokens — 7 days after expiry
• Telegram sign-in session — 24 hours
• Administrator activity log — indefinitely
• Payment records — 5 years after the end of the payment year (phone number — 1 year after payment)
• Report and ban records — Without your contact details — kept indefinitely, for safety
• Deleted account's internal identifier (with sign-up and deletion dates) — Indefinitely
• Backups — Up to 4 weeks
• Server logs — 14 days
• Error reports — Up to 90 days
• Event queue — 7 days

8. Automated decisions

Some decisions are made automatically by software. It runs on our own server — data is not sent to external artificial intelligence services. If you disagree with a decision, write to privacy@birgaapp.uz — a person will review it.

• Photo check: a photo is rejected if the probability of inappropriate content is 85% or higher, if the estimated age of the main face in it is under 16, or if the people in it are identified as another gender with 80% confidence (no one of the gender in your profile is found)
• Face verification: if the selfie and the photo are not similar enough (similarity threshold 0.45) or you are not recognised in one of your photos that shows a face, the verified badge is not granted
• Verified badge: removed automatically if the verified photo is deleted, a new main photo fails the check, or the face matching consent is withdrawn. Verified women get Birga+ for free, and if the badge is removed, that subscription stops too
• Feed: shows only people who match both sides' filters (gender, age, distance and others); the order depends on distance, shared interests and languages, verified profile, dating intention and questionnaire answers
• Account bans: only by a human decision — there are no automatic bans

9. Religion and face verification

Religion and images of your face are data that need special protection. Showing your religion and matching your face work only with your separate consent. You can withdraw consent at any time in Settings → Privacy & security → Consents.

• Religion is optional. It is shown on your profile and used in filters only if you tick the consent box. If you withdraw consent, your religion is removed from your profile
• During sign-up, everyone takes a short selfie. It is checked in memory — inappropriate content, estimated age and gender, presence of a face — and deleted immediately. This check does not compare your face with your photos
• If you choose verification and give consent, the selfie is compared in memory with your main photo and your other photos that show a face, then deleted immediately
• Neither the selfie nor a face template (a numerical representation of your face) is written to disk or to a database. We keep only: whether you are verified, when, which photo was verified and the model version
• If you change your main photo, the new photo is compared in memory with the verified one. If you withdraw consent, the verified badge is removed
• We record when consent was given and withdrawn, the text version, the app version and the platform — the law requires us to be able to prove consent

10. Your rights

Under the Law «On Personal Data», you have the following rights over data about you. Send your request to privacy@birgaapp.uz. First we verify your identity: the request must come from the email linked to your account or be confirmed through the Telegram account linked to it.

• Access: we reply within 10 days and send you a copy of your data — profile, photos, photo check results, messages you wrote, payments and more
• Correction: you can correct most data yourself in the app (Edit profile); we correct the rest within 3 days of your request
• Deletion: Settings → Danger zone → Delete account, or without the app — through the https://birgaapp.uz/delete-account page
• Withdrawing consent: Settings → Privacy & security → Consents
• Controlling visibility: Incognito, Snooze, online status and read receipts — Settings → Privacy & security
• Complaints: if you are not satisfied with our answer, you can contact the authorised state body for personal data

11. Age limit

«Birga» is only for people aged 18 or over. We ask for your date of birth at sign-up, and a person under 18 cannot create an account. If we find out that a user is under 18, their account will be deleted.

12. Security

To protect your data:

• The connection between the app and the server is encrypted (HTTPS)
• Sign-in tokens are kept in your phone's protected storage
• GPS and other metadata are removed from photos on the server
• Database backups are encrypted
• Changes made by the administrator and conversation views are recorded in an audit log
• If there is a data breach, we will tell the affected users

13. Changes

If we update this policy, the new text will appear in the app and on https://birgaapp.uz, and the date at the top will change. If you need the previous version or have a question, write to privacy@birgaapp.uz.