Privacy policy

1. Data we collect

Account: phone number, name, photo (optional), language, country. For Ustahs: trades, city, radius, work photos, ID document (verification only, never public).

Usage: requests, quotes, messages (text, photo, voice), bookings, reviews. Payments happen off the platform: we collect no payment data at all.

Technical: the device’s notification token (for push notifications only); usage events (e.g. search, profile view) counted WITHOUT any identifier, unless you accept usage measurement in Settings › Privacy; location only if you allow it, for distance sorting.

2. Why we use it

To provide the service (client–Ustah matching, notifications) — basis: contract.

For security, fraud prevention and dispute mediation — basis: legitimate interest.

For marketing communications — only with your consent (Settings › Privacy), revocable anytime.

3. Who we share it with

With the Ustah or client involved in a request (name, messages, photos; phone number only when you provide it). Via the “Share with family” link, the link holder sees the request and its status, the work photos, the Ustah’s name and contact details, the amount of their quote, the appointment time, your first name and the name of the person the work is for. Never your phone number. The link works without an account: share it only with people you trust.

With technical processors: Supabase (database and storage, EU), Expo (push notifications), Vercel (website) and Anthropic for automatic message translation and the assistant (only the text sent for translation/questions).

Expo and Anthropic are established in the United States: these transfers outside the European Union rely on the European Commission’s standard contractual clauses. The rest of the data is stored in the European Union.

We do not sell your data.

4. Retention

Account: until deletion. Messages and requests: 3 years after the request closes. Invoices and payments: 10 years (legal obligation). ID document: deleted 30 days after the verification decision. Usage events: 24 months.

5. Your rights

Access, rectification, erasure, restriction, objection and portability — from the app (Settings) or by email at hello@ustah.app. We reply within 30 days. You may complain to the Kosovo Information and Privacy Agency.

If you reside in the European Union, you may also lodge a complaint with the data protection supervisory authority of your own country.

Every email we send carries a one-click unsubscribe link that works without signing in.

6. Security

Data is stored on EU servers, encrypted in transit and at rest; team access is limited and logged. You can enable two-step verification in Settings › Security.

7. Children and changes

The service is not intended for people under 18. Changes to this policy are announced in the app.

Updated: 2026-09-29.

8. Cookies and local storage

Ustah uses no advertising cookies and no third-party analytics. Only the following are stored on your device: your sign-in session (to keep you logged in), your chosen language, and an invite code if you arrived through a referral link — the last is deleted as soon as it is used.

If you accept usage measurement, a random device identifier is added; it is created only then, and deleted as soon as you withdraw your consent.

These are necessary for the service you asked for, so they require no consent. You can clear them at any time from your browser; you will simply need to sign in again.