Privacy Policy

1. Information we handle

What we receive depends on the features you use. Browsing this policy does not require an account.

Account and profile

Name or display name, email, account/user ID, sign-in provider, profile photo, and profile preferences. Google or Microsoft sign-in supplies the identity/profile information made available through the sign-in flow. Email/password sign-in, where available, is handled through Firebase Authentication.

Orders, payments and delivery

Products and options, amounts, payment method, order references/status, contact details, transaction references, and transfer phone number or InstaPay address when supplied. Screenshots of payment evidence and delivery instructions can also be saved with an order. Physical-product checkout collects delivery details such as recipient name, phone and address; an optional map link may contain precise coordinates.

Game or service fulfillment

Depending on the product: player IDs, gaming usernames, Steam profile links/friend codes, recipient details, and information needed to deliver or activate the purchase. Some activation forms accept third-party account email/password details you submit for fulfillment. These may be included in order records and accessed by the team fulfilling the request. Do not submit unrelated credentials or bank passwords.

Support and AI chat

Messages, attachments you choose to send, timestamps, conversation IDs, ticket details, order references and support status. Basha bot conversations can be archived with account identity, current page/product and relevant order context, and can be handed over to support. AI requests can contain your messages, recent conversation and relevant store/account context.

Reviews, profiles and marketplace activity

Reviews, ratings, uploaded images, seller/buyer messages, seller/dealer application details and transaction information when you use those features. Display name, photo, friend code and available points/profile information may appear in social profile features. Reviews and the content you publish are visible to other users; messages with sellers are available to the participants and store staff handling support.

Technical and security information

IP address as part of network requests, browser/device information, approximate country, language/currency preferences, request timing, and security/rate-limit records. IP lookup services are used for country preferences and abuse checks. Some protection flows compare hashed IP/email values; hashing does not make that information anonymous. Staff notification features in the Android source also contain device/browser details and notification-token handling when enabled.

Checkout card-entry flows use a payment provider rather than a store form for full card numbers or card security codes. Transfer references and uploaded receipts can still contain financial or other personal information. Please crop or redact unrelated information before uploading.

2. How we use information

• Authenticate accounts, restore sessions, and maintain profile settings.
• Process and review purchases, payments, fulfillment, delivery, balances, points and rewards.
• Answer questions through Basha, handle tickets, and provide staff or seller support.
• Display the reviews and profile content associated with the features you use.
• Adapt language/currency suggestions, diagnose technical issues, and prevent fraud, spam, duplicate requests and unauthorized access.
• Send service communications about account access, orders or support through the channels used for that service.

3. Sharing and third-party services

Store staff, sellers and fulfillment participants can receive the information needed for their role in a transaction or support case. The integrations below receive data when the corresponding feature makes a request. Provider policies and settings also affect how they handle that data.

Google / Firebase

Firebase Authentication, Firestore and Realtime Database support accounts, profiles, orders, balances, chats and tickets. Marketplace features also use Firebase services; some media flows use Firebase Storage. Google sign-in processes account identity. Google Privacy Policy.

Microsoft

Microsoft sign-in provides identity information for the account login you initiate. Microsoft Privacy Statement.

Vercel

Hosts the website and server endpoints. Network requests include information such as IP address and request metadata; hosting logs and storage settings are provider-managed.

Groq (Basha AI)

The server forwards AI conversation requests and relevant context to Groq to generate answers. Store chat archives and the AI provider's handling are separate. Provider retention/training settings have not been verified; no "never retained" or "never used for training" promise is made. Avoid sending secrets or unnecessary personal information to the bot. Groq Privacy Policy.

Discord

Staff notification integrations can send order/support information to Discord. A support notification can include your name or email and a message excerpt. Discord Privacy Policy.

ImgBB and image hosting

Selected images, including some payment-proof and chat/review uploads, are uploaded to ImgBB; their URLs are stored or shared with the relevant record. A hosted image URL should not be treated as private: someone with that URL may be able to view it. Not every upload path has the same expiry setting. ImgBB Privacy Policy.

Payments and email

Gumroad is integrated for applicable checkout flows; other payment methods open or use their respective payment services. They process the payment information you give them, and the store receives/submits related order details. Verification email code supports Gmail/Google or Resend, depending on server configuration. The Android staff-tool source also includes EmailJS for outgoing service email. The active email configuration needs confirmation. Gumroad Privacy Policy.

IP lookup and external content

ipapi.co and ipify receive network requests for approximate-country preferences or IP-based abuse checks. Fonts, libraries, images, video embeds, Steam/game-platform lookups and external links contact their hosting services when used, exposing normal network metadata. Following WhatsApp, social or other external links is also subject to that service's policy.

Providers may process information outside your country. Specific hosting regions, transfer arrangements, provider log/backup schedules and the SDKs in the distributed Android build are awaiting confirmation. We do not claim that all data remains in one country.

4. Cookies and local storage

The service and authentication providers use browser/app storage for sign-in sessions, carts, language/currency choices, profile settings, chat state and security controls. Some features can also save recipient or fulfillment preferences on your device when you choose to save them.

Basha uses server-side network/account usage counters and expiring request permissions to limit guest messages and prevent AI abuse. These records use keyed hashes of the network address/account ID and message fingerprints rather than storing raw IP addresses or message text in the quota records. Chat archives are separate. Local storage also remembers exhausted guest access and temporary conversation pauses; signing in uses an account allowance, not an unlimited allowance.

You can sign out and clear site/app storage through your browser or Android settings. This can remove local settings and sign you out, but does not delete server-side accounts, orders, uploaded files or conversation archives. External services can use their own cookies when their content or checkout is loaded.

This policy page itself does not initialize authentication, AI, analytics, advertising, geolocation or upload services.

5. Location, files and Android permissions

Approximate country inferred from the connection is different from precise location. Live-support country handling is not intended to determine your home address. However, Merchant physical-delivery checkout offers a user-initiated current-location action: after browser/device permission, coordinates become a map link and can be included in the order. You can instead enter delivery details or paste a map link manually.

File selection uploads only the file you select for that feature. Notification permission, where a notification feature is enabled, can be managed through browser/Android settings.

The checked-in Android manifest declares Internet access and no native location, camera, microphone, contacts or SMS permission. This is a statement about the reviewed source, not a certification of the APK available elsewhere. Web features and a later app build can have different permission behavior; a new data use must be disclosed before it is introduced.

6. Data security

The production site and identified service endpoints use HTTPS. The code uses Firebase authentication and database access rules, server-side authorization on protected endpoints, request validation, rate limits and server-held credentials for AI and notification integrations. These measures reduce risk; they do not guarantee that every system, hosted upload or provider is secure.

We do not claim end-to-end encryption for support or bot messages. Staff and the relevant providers can process them. Do not send card security codes, bank passwords, one-time login codes or unrelated account credentials in support/AI messages. Raise a privacy or security concern through the contact below.

7. Data retention

Account/profile records, orders and fulfillment records, points/balance history, reviews, chats/tickets and uploaded-file references are stored by the service. Signing out, uninstalling the app, closing a ticket or clearing local storage does not automatically remove those records.

Needs verification: fixed retention periods and scheduled deletion for these categories, activation credentials, notification copies, hosting logs and provider backups have not been confirmed. We therefore do not promise a particular number of days or automatic removal after inactivity.

Some verification codes become invalid after 10 minutes. Code expiry is not proof that every associated security record is deleted at that time. Likewise, an expiry parameter on one image-upload flow does not establish the retention period for all uploads.

For a deletion request, ask which records can be removed and which, if any, must be retained. Any exception for a transaction obligation, dispute, fraud/security record or legal requirement should identify the relevant data, reason and retention period; a blanket indefinite exception is not stated here. The actual exceptions and backup-removal schedule still need confirmation.

8. Request account and data deletion (طلب حذف الحساب والبيانات)

Open the account deletion request page. This public page works without the Android app or signing in. It verifies your account email with a deletion-specific code, records the confirmed request and provides a private status receipt. If the automated request service is unavailable or you cannot access your email, use the support contact below for identity verification and manual handling.

Processing includes account/authentication records, profile data, Berlin Points, reward/decorative item ownership, chats/tickets/bot archives, uploaded files and relevant third-party copies. You lose access to your account's order history and saved delivery details; save any purchase information you need first. Points and decorations do not automatically transfer to a new account. Deletion does not automatically issue a refund, cancel an open order, settle a real-money balance, or delete your separate Google/Microsoft account.

Necessary accounting/legal transaction fields may be retained in a separate minimized record; personal contact details, free text, activation credentials and payment-proof images are removed from the operational record. Minimization is not a guarantee of irreversible anonymization. No final legally verified invoice/transaction retention period is available yet. Any additional personal-data exception needs a documented basis and review/deletion schedule, rather than an invented duration or a blanket indefinite hold.

Request verification codes expire after 10 minutes and five incorrect attempts. Maintenance removes expired verification records and removes a completed request's identity-free status receipt after 30 days. These are operational request periods, not legal invoice-retention periods. Request acceptance, account disabling and partial provider cleanup are not completion; only a verified completed outcome represents processed deletion. Live multi-service validation, provider/backup cleanup, completion time and legal retention requirements remain release checks.

You can initiate a request from this page without signing in, reinstalling the app or making a purchase. Use the same route for access/correction questions or deletion of a specific record.

1. Email berlinteamgoe@gmail.com with the subject Berlin GOE STORE - Account and data deletion request.
2. State that you want your store account and associated personal data deleted. Send from your registered email if possible; otherwise include that address and explain that you cannot access it. An order reference or user ID can help identify the account, but do not send passwords, payment secrets or identity documents in the initial email.
3. If you want only particular data removed, identify it, for example a review, attachment, conversation or saved recipient. Support may need to verify account ownership before making changes.

Email an account deletion request

If an email app does not open, send an email manually to the address above. You can also contact the existing store support number at +20 1060292953 on WhatsApp; WhatsApp receives the messages you send through it.

The email alternative is a manual support request, not an automatic deletion button. Opening an email draft does not submit a request or delete data. Deleting only a login record, disabling an account or deleting the app is not the same as deleting associated account data. Associated data to review includes profile/authentication records, orders/fulfillment credentials, balances, chats/tickets, uploads, public content, marketplace records and notification copies.

Needs verification: the operational ownership-verification process, completion time, full multi-service deletion procedure, necessary retention exceptions and backup/provider cleanup are not yet confirmed. Please request a response identifying the outcome and any retained data. Deleting your store account does not delete your separate Google, Microsoft, gaming, payment or social account.

9. Your choices and children

You can review available account settings, change local language/currency preferences, decline optional location/notification permissions, avoid optional uploads or AI chat, and contact us about your personal information. Some data is required to complete a purchase or provide the feature you request; not providing it can prevent that feature from working.

No child-specific account or verified parental-consent process was identified in the reviewed source. The app's intended audience, age restrictions and Google Play Families applicability need confirmation. A parent or guardian concerned about a child's information can contact us and request review or deletion.

10. Privacy contact and policy changes

This is the store's existing published support contact, not a newly invented privacy address. For account-specific requests, avoid posting personal information publicly.

Updates will be published at this URL with a revised date. A materially different data use may also need a separate in-app disclosure and permission/consent where applicable; this page does not replace those steps.