1. Overview

This Privacy Policy explains what personal information Madar (مدار) ("we", "us", "the Platform") collects when you use our service, how we use it, who we share it with, and the choices available to you. By using Madar, you consent to the practices described here.

2. Information We Collect

Information you provide directly

• Account details — full name, email address, password (stored as a salted hash, never in plain text), country, and optional phone number with country code.
• Google account information — if you sign in with Google, we receive your Google account ID, name, and email address from Google's OpenID Connect endpoint. We do not receive your Google password.
• Withdrawal destination addresses — the USDT TRC20 or TRX wallet address you provide when requesting a withdrawal.
• Communications — any information you send us when contacting support.

Information collected automatically

• Device and session data — IP address, user agent string, and approximate request timestamps, used for authentication tokens, rate limiting, and fraud prevention.
• Usage data — actions taken within the Platform such as car rentals, mission completions, login streak activity, and referral activity, needed to operate the gamified features of the service.
• Push notification token — a Firebase Cloud Messaging token, if you enable notifications, used solely to deliver in-app notifications to your device.

Information we do not collect

We do not collect biometric data, government ID documents, or precise GPS location. We do not require identity verification (KYC) for standard use of the Platform at this time; this may change if required by future regulatory obligations.

3. How We Use Your Information

• To create and authenticate your account, including issuing and validating bearer session tokens.
• To process deposits and withdrawals and to credit or debit your in-app wallet accurately.
• To operate gamified features: car rentals, missions, login streaks, referral commissions, and leaderboard rankings.
• To detect and prevent fraud, abuse, duplicate accounts, and violations of our Terms of Service.
• To send transactional notifications, such as deposit confirmations or referral activity, through in-app notifications and, where enabled, push notifications.
• To comply with legal obligations applicable to us.

We do not use your personal information to serve third-party advertising, and we do not sell your personal information.

4. Sharing With Third Parties

We share limited information with the following categories of service providers, solely as needed to operate the Platform:

We may also disclose information where required by law, court order, or governmental request, or to protect the rights, property, or safety of Madar, our users, or the public.

5. Cryptocurrency and Blockchain Data

The TRON blockchain is a public, permanent ledger. Any USDT or TRX transaction you send to our platform wallet address is visible to anyone, including the sending address, receiving address, amount, and transaction hash. This visibility is a property of public blockchains generally and is not something we control or can remove.

We store the deposit amount, coin type, transaction ID, and number of confirmations associated with your deposit request in order to credit your wallet and to prevent the same transaction from being credited twice.

6. Data Retention

We retain account and transaction data for as long as your account is active and for a reasonable period afterward to meet accounting, fraud-prevention, and legal obligations. Processed blockchain transaction records are retained permanently as an append-only ledger, since they are the basis for preventing duplicate crediting of the same deposit.

7. Security

Passwords are hashed using bcrypt and are never stored or transmitted in plain text. Session authentication uses randomly generated bearer tokens, stored as SHA-256 hashes, with a limited expiry. All traffic to the Platform is served over HTTPS. While we take reasonable measures to protect your information, no system can be guaranteed to be completely secure, and you should use a strong, unique password for your account.

8. Your Rights

Depending on your jurisdiction, you may have the right to request access to, correction of, or deletion of your personal information, or to object to certain processing. To exercise any of these rights, contact us using the details below. Note that some information, such as blockchain transaction records and data required for legal or fraud-prevention purposes, cannot be deleted even upon request, as described in Section 6.

9. Cookies and Local Storage

Madar uses browser local storage, not third-party advertising cookies, to keep you signed in (storing your session token) and to remember your interface theme preference (light or dark). This data stays in your browser and is not used for cross-site tracking.

10. Children's Privacy

Madar is not directed at, and does not knowingly collect personal information from, individuals under 18 years of age. If we learn that an account belongs to someone under 18, we will take steps to close that account.

11. International Users

Madar is operated with Iraq Standard Time (UTC+3) as its operational timezone and IQD as its sole accounting currency. By using the Platform from outside Iraq, you acknowledge that your information may be processed on servers located in a different jurisdiction from your own.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions about this Privacy Policy, or requests relating to your personal information, can be directed to admin@madar-iraqi.xyz.