Chya Mazad America
This Privacy Policy explains how the Chya Mazad America mobile app collects, uses, stores, shares, and deletes information. It is operated by Chya Mazad America (“we”, “us”). It applies to the app, the services behind it, and these related web pages.
We collect information you provide, information created as you use the app, and limited device data.
Photos are stored on our file storage with unguessable, randomly generated filenames. They are not listed in any public directory and are not linked from any public index — there is no way to browse or enumerate them.
However, you should know that photos are served over direct URLs without authentication: anyone
who is given the exact, random URL of a photo (for example /storage/uploads/9x…Qz.jpg) can open it,
because sharing listing photos with buyers is the point of the marketplace. We do not add a login check on the
image URL itself.
This applies to your profile photo (avatar) as well: like listing and car photos, it is stored under a random, unlisted filename and served over a direct URL with no authentication check. If you would rather not have a profile photo reachable this way, you can leave it unset or remove it.
We do not collect identity images or customer documents of any kind, so none are stored.
When a listing is rejected or removed for policy reasons (including through the user-reports queue), its photo files are deleted from storage, not just hidden — a takedown removes the images. Your car photos and listing photos are likewise deleted from storage when you delete your account.
Chya Mazad America handles money movements, so it keeps financial records tied to your account:
This data is shown to you in the app, is accessible to authorized staff who service your account, and is retained as described under “Data Retention and Deletion.” We do not process card or bank details in the app — wallet top-ups are arranged manually with our team.
We do not sell your personal information, and we do not use advertising or analytics trackers.
The only third party that receives your data is Google, through Firebase Cloud Messaging (FCM). To deliver push notifications, your device’s push token is sent to and processed by Firebase Cloud Messaging on Google’s infrastructure. This means this data is processed on servers outside Iraq. Beyond delivering notifications through Google in this way, we do not share your personal data with any other third party, except where we are legally required to.
Authorized staff can open a customer’s account view to provide support (for example, to help with a deletion request, a wallet question, or a car’s status). This access is recorded in an activity log so it can be reviewed.
When you delete your account, we erase your personal content — your account record, your listings and their photo files, and your car photo files.
What we keep: financial and accounting records — ledger entries — and car and shipment-tracking history are retained after deletion in anonymised form (detached from your identity and reassigned to a non-personal record). We keep these to meet accounting and legal obligations, not to identify you.
You can delete your Chya Mazad America account in any of these ways:
What we delete: your account and personal profile data, your listings and their photos, and your car photos. What we keep: anonymised financial/accounting records as described above. Timeline: if nothing needs to be settled first, deletion is immediate; if something is outstanding (an unpaid balance, a car in transit, an active listing, or wallet credit), the request is recorded and our team completes it, normally within 30 days.
Chya Mazad America is not intended for anyone under 18. You must be at least 18 years old to use the app. We do not knowingly collect data from children under 18; if we learn that we have, we will delete it.
For any privacy question or data request, contact us: