Legal

Privacy Policy

Effective 29 October 2026 · Version 1.0

This policy explains what QiMAP collects, why, who it is shared with and the choices you have. It applies to the QiMAP app for Android and iOS (package iq.qimap.app), the QiMAP mini app inside the SuperQi wallet, and the website qi-map.com (together, “QiMAP” or the “Service”).

1. Who we are

QiMAP is a product of Qi Card (International Smart Card), developed and operated by Enjaz LLC, Baghdad, Iraq. Enjaz LLC is the controller of the personal data described here. For anything about this policy or your data, write to hello@qi-map.com.

2. In short

  • You sign in with your phone number; we send a one-time code by SMS. We do not ask for a password.
  • We use your location only while you use the app and during an active trip, to show where you are, find places near you, plan routes and guide you. You can turn it off at any time in your phone's settings.
  • We do not sell your data, we show no advertising, and the app contains no third-party analytics or advertising SDKs.
  • Your data is processed on servers we run on Amazon Web Services in Frankfurt, Germany.
  • You can delete your account from inside the app (You → Delete account) at any time.

3. What we collect

CategoryWhatWhen
Account Phone number, the one-time sign-in codes (kept only until they expire), an optional display name, your language choice. When you sign in or edit your profile.
Device A random installation identifier created by the app, platform (Android/iOS), device brand and model, OS version, app version, locale, and — only if you allow notifications — a push notification token. When you sign in and when the app starts.
Location Your precise location (GPS and network), speed and heading. During a trip the app sends periodic position updates so the server can track progress, recompute the route and estimate traffic. On Android a trip runs a foreground service so guidance continues while the screen is off or another app is open. Only while the app is in use and during an active trip, and only after you grant the location permission.
Trips Destination, mode (car, motorcycle, on foot), start and end time, distance and the route that was driven. When you start a trip. A list of your trips is kept on your phone and on our servers.
Searches The text you search for, the language, the map area the search was made in, and which result you opened (used to rank results better). When you search.
Contributions Road reports (type, position snapped to the road, road name, time), suggested places and corrections, ratings and reviews (with the name you choose to type, if any), photos you upload and the feedback you send us. When you choose to contribute. Camera and photo-library access are requested only at that moment.
Saved places & preferences Favourites, Home and Work, recent places, map layers, theme, voice and sound settings. Favourites and Home/Work are stored on our servers so they follow your account; recents and settings stay on your phone.
Messages Notifications we send you (shown in the app's inbox) and feedback you send us. When notifications are issued or you send feedback.
Technical logs IP address, request time, requested endpoint, app version and user agent, error traces. Logs are used for security and operations and are not joined to your profile for any other purpose. With every request to our servers (app, mini app and website).

Voice guidance. Spoken instructions are produced on our servers from the text of the instruction (for example “in 500 metres, turn right”) and played in the app. No microphone access is used or requested.

Inside SuperQi. When you open QiMAP as a mini app inside the SuperQi wallet, the wallet passes QiMAP a signed identity (your SuperQi user identifier and phone number) so you do not sign in again. The wallet itself is governed by Qi Card's own privacy policy.

The website. qi-map.com sets no cookies and loads no third-party scripts. It remembers your language choice in your browser's local storage. The “Developers” search demo sends what you type to our search service.

4. How we use it

  • To provide the Service — sign you in, show the map around you, search, plan and guide routes, keep your saved places and trips, show road reports and alerts, send the notifications you opt in to.
  • To improve the map — your reports, suggested places, reviews and photos update QiMAP for everyone; anonymised trip positions help estimate traffic and travel times.
  • To improve search — which results are opened for a query helps rank results.
  • To keep the Service safe — detect abuse, rate-limit, debug failures, secure accounts.
  • To comply with the law and respond to lawful requests.

We rely on your consent for location, camera and photo-library access and for notifications (each can be withdrawn in your phone's settings), on the contract between us for providing the Service, and on our legitimate interest in a secure, reliable and improving map for the rest. We do not use your data for automated decisions with legal effect, and we do not profile you for advertising.

5. Who we share it with

We share personal data only with the parties below, and only as far as needed:

  • Amazon Web Services (Frankfurt region) hosts our servers, databases, storage and content delivery; Amazon SNS delivers the SMS sign-in codes; Amazon Polly produces the voice clips. AWS processes data on our instructions.
  • Mobile network operators receive your phone number to deliver the SMS code.
  • Traffic data provider (Mapbox). When the traffic layer is on, your device loads live traffic tiles directly from Mapbox, which therefore receives your IP address and the map tiles you request (the area you are looking at). Turn the layer off in Layers → Traffic to stop this.
  • Qi Card, as the owner of QiMAP, receives the identity hand-over described above when you use the mini app and may receive aggregated, non-identifying usage statistics.
  • Other users see your public contributions as described in section 6.
  • Authorities when the law requires it, and a successor if QiMAP is transferred to another operator, under this policy.

We do not sell personal data, we do not share it with data brokers or advertisers, and we do not use third-party analytics, attribution or advertising SDKs in the app or on the website.

6. Public contributions

Road reports are shown to other users as pins on the map without your name or phone number. Suggested places, corrections and photos become part of the map once reviewed and carry no personal attribution. Reviews are shown with the name you type in the review form; leave it empty to post anonymously. Do not include personal data about yourself or others in a review, a photo or a report.

7. How long we keep it

  • Account, device and saved-place data: until you delete your account or sign out the device (device records are removed at sign-out).
  • One-time sign-in codes: until they expire, minutes after being sent.
  • Trips and position updates: trip summaries stay with your account; detailed positions are kept for a limited time for traffic estimation and then aggregated or deleted.
  • Road reports: expire automatically after a type-specific period (hours to days); places, reviews and photos remain as part of the map.
  • Technical logs: a limited period for security and operations, then deleted.

When you delete your account we delete or anonymise the data linked to it. Contributions already merged into the map (places, photos, reports) remain, without any link to you.

8. Your choices and rights

  • Permissions. Location, camera, photos and notifications are each requested when first needed and can be withdrawn in your phone's settings. Without location the map still works; nearby search and guidance need it.
  • Traffic layer. Layers → Traffic turns the third-party traffic tiles on or off.
  • Sign out (You → Sign out) removes this device from your account.
  • Delete account (You → Delete account) deletes your account and the data linked to it, as described in section 7 — step by step, with what is deleted and what is kept, at qi-map.com/delete-account.
  • Access, correction, portability, objection. Email hello@qi-map.com from a channel that lets us verify you are the account holder; we answer within 30 days.

9. Security

All traffic between the app, the website and our servers is encrypted (TLS). Sign-in tokens are stored in the phone's secure keychain or keystore. Access to production systems is restricted and logged, secrets are kept in a managed vault, and we review changes for security before release. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

10. Children

QiMAP is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

11. Where data is stored

Our servers run in Amazon Web Services' Frankfurt (Germany) region, so your data is stored outside Iraq. Traffic tiles are served by Mapbox from its own infrastructure. We use providers that apply strong contractual and technical safeguards.

12. Changes to this policy

We will post any change on this page with a new effective date and version, and, for material changes, tell you in the app before they take effect. Continued use after the effective date means you accept the updated policy.

13. Contact

Enjaz LLC · Baghdad, Iraq · hello@qi-map.com

This policy is also available in Arabic at qi-map.com/ar/privacy.