Privacy Policy

1. Who we are and what this policy covers

This policy applies to the Raqame app for Android (package id com.ak.raqame) and to the raqame.net website, and Raqame (رقمي) is the controller of the personal data it describes. By using the app or the website you agree to this policy. Privacy contact: support@raqame.net or WhatsApp @raqame.

Service providers: our license server is hosted by Cloudflare, and we rely on Google for distribution and purchasing (Google Play), sign-in, and backup (Google Drive) — each processes the data its service needs under its own policy.

A note about the website: the fonts raqame.net pages use to render text are hosted on our own server with the rest of the site, so your browser loads nothing from outside raqame.net to display the pages, and none of its requests reach Google or any other third party. The website uses no tracking cookies and no analytics; your browser keeps the display language you pick in its local storage (localStorage), only to remember it.

2. Data stored on your device (and never leaves it)

Raqame is an offline-first app by design. All of your business data is kept in a local database inside the app's private storage on your device, including: products and inventory, invoices, sales and purchases, customers and suppliers and their balances, accounting entries, users, permissions and the audit log, settings, and product photos.

We at Raqame have no access to this data, and it is never uploaded automatically to any server. The data about your customers, suppliers and employees that you enter stays on your device under your control: you are responsible for it, and since we never access it, we do not process it on your behalf.

3. What is sent over the internet, and why

The app connects to the internet only in a few clearly-defined cases:

3.1 The license server

When you activate, transfer, recover, or periodically revalidate a license, our license server receives:

• Your activation code, or the purchase identifier (the Google Play purchase token when buying through the store).
• A hashed device fingerprint: a SHA-256 digest of a device identifier combined with the app id. It cannot be reversed, does not reveal your identity or location, and is used solely to bind the license to one device and prevent abuse.
• License status and dates (for activation, renewal and transfer).
• Your connection's IP address: it reaches the server as part of any internet connection; we use it to limit repeated attempts and prevent abuse, and it may be recorded in the technical event log for licensing operations, for security purposes only.
• Country: our host (Cloudflare) infers the connection's country from the IP address, and we store only the country code (e.g. JO) on your license record at first activation, to organize support and understand our markets. We store no city or coordinates and do not track your location.
• Support contact details (optional): if you choose to enter them on the license screen — a business or owner name, a phone number and an email address — they are sent with the activation and kept on your license record for one purpose: so our support team can reach you. They are never used for marketing or shared with anyone, and you can edit or delete them at any time from the same license screen; deleting removes them from your device and from our server alike.

The app also contacts the license server periodically — when it is opened and when connectivity returns — sending only the same hashed fingerprint, to check the license status.

No business data (no invoices, products, or customers) is ever sent to the license server.

3.2 Google Play purchases

In-app purchases and subscriptions are processed entirely by Google Play. We never see your card or payment details; we only receive confirmation that a purchase completed and the subscription's status (active, cancelled, expired) so we can activate and renew your license. Payments are governed by the Google Privacy Policy.

3.3 Google Sign-In (optional)

If you choose to sign in with Google, we receive your basic profile (name, email, avatar) for two purposes only: linking your license to your account (so you can release it remotely if your device is lost), and enabling Google Drive backup. Signing in is entirely optional and is not required to use the app.

3.4 Google Drive backup (optional)

If you enable cloud backup, a backup file encrypted with a password you choose (AES-256) is uploaded to a private app area inside your own Google Drive account — not to our servers. We cannot read the backup and we never know its password. Backups live in Drive's hidden app-data area; you can delete them all at any time from Google Drive settings (Settings → Manage apps → Delete hidden app data) or by revoking the app's access to your account. Important: if you forget your backup password, no one — including us — can recover it.

3.5 JoFotara e-invoicing (optional)

If you connect the app to Jordan's national e-invoicing system (JoFotara) by entering your establishment's integration credentials, the app will send your invoice data (seller, buyer where present, line items, amounts and tax) to the Income and Sales Tax Department systems as the scheme requires. This happens only when you enable the service yourself and submit invoices through it. Your credentials are stored encrypted in your device's secure storage.

3.6 The new-device hint (Google Block Store)

Once the app is set up, it stores a small record in Google's Block Store — within your account — holding random internal ids for your company and the app's owner account, your license type (Google Play, code, trial or none), and the time it was written, so that when you move to a new phone the app can point you to your backup and license instead of starting from scratch. It contains no business data and we cannot access it; it travels with your device's Google backup and is erased when you reset the app.

3.7 Messaging support

When you message us on WhatsApp, by email, or on social media, we receive your number, email or account name, the content of your messages and any images or files you attach. We use them only to answer you and provide support, and keep them as long as needed for that and for a record of our dealings with you. Our support team may also add information you give us about your business to your license record (such as your city, type of business, preferred language and how you heard of us, and notes about your requests and follow-up dates). The messaging platforms themselves (such as WhatsApp/Meta) are governed by their own privacy policies. Avoid sending passwords or your customers' data unless necessary.

4. App permissions

5. What we do not do

• No analytics or measurement SDKs (no Firebase Analytics or similar).
• No ads, and no advertising identifiers.
• No automatic crash reporting.
• We never sell, rent, or share your data with third parties for marketing.
• We never collect or track your precise location; we store only the country code, as in section 3.1.

6. Security

Password-protected backups are encrypted with AES-256-GCM using PBKDF2 key derivation. License material and e-invoicing credentials are kept in the operating system's secure storage (Android Keystore). The device fingerprint sent to the license server is hashed and cannot be reversed, and the connection to the license server is encrypted (HTTPS).

7. Data retention and deletion

• Local data: fully under your control — removed by clearing the app's data or uninstalling it.
• Google Drive backups: live in your own account's hidden app-data area; delete them any time from Google Drive settings (Manage apps → Delete hidden app data) or by revoking the app's access.
• License records on our server (with the country, IP addresses in the event log, and support notes): kept for as long as the license is valid and for abuse prevention and dispute resolution. To request their deletion (note: this invalidates the license), email support@raqame.net; we respond within 30 days. The full steps, and what is deleted versus kept, are on the Delete your account and data page.
• Support contact details: you delete them yourself from the license screen ("Delete my contact details"); they are removed immediately from your device and from your license record on our server, and the license itself is unaffected.
• Support messages: we delete what we hold of them at your request, unless the law or an ongoing dispute requires us to keep them.

8. Legal bases for processing

Where the EU General Data Protection Regulation (GDPR), the UK GDPR or a similar law applies, we process your data on these bases:

• Performance of a contract: the activation code, purchase identifier, device fingerprint and license status — to activate, transfer and renew the license you bought, and to verify Google Play purchases.
• Legitimate interests: the IP address and the event log — to keep the service secure and prevent abuse and fraud; the country code and support notes — to organize support and understand our markets. We have weighed these interests against your rights, and you may object to them (section 10).
• Consent: support contact details, Google Sign-In, Google Drive backup and e-invoicing — each of which you turn on yourself and can withdraw at any time, without affecting anything done before.
• Legal obligation: the transaction records the law requires us to keep.

We make no decisions about you with legal or similarly significant effects based solely on automated processing, and we do not profile you.

9. International transfers

We and our service providers (Cloudflare and Google) process data in several countries, including the United States and Jordan, which may not offer the same level of protection as your own. Where data leaves the EU, the UK or Switzerland, we rely on the safeguards these providers offer, such as the European Commission's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework where it applies.

10. Your rights

Depending on the law that applies to you, you have the right to access your data and obtain a copy of it, to correct it, to delete it, to restrict its processing, to receive it in a machine-readable format, to object to processing based on legitimate interests, and to withdraw your consent at any time. To exercise them, write to support@raqame.net or WhatsApp @raqame; we may ask for proof that the license is yours before acting, and we answer within one month (extendable where the law allows). You may also complain to the data protection authority of the country where you live or work.

Your business data itself is on your device and fully under your control: you export and delete it yourself, without needing us.

11. California and other U.S. states

Under the California Consumer Privacy Act as amended (CCPA/CPRA) and similar state laws:

• What we collected in the past 12 months: identifiers (IP address, hashed device fingerprint, email and phone if you entered them, your Google account if you linked it); commercial information (license and purchase records); approximate geolocation at country level only; and network activity (the technical event log). Sources: you, your device and Google Play. Purposes: those in sections 3 and 8.
• We do not sell or "share" your personal information for cross-context behavioral advertising, and have not done so in the past 12 months, and we collect no sensitive personal information. We disclose it only to the service providers named here, for operational purposes.
• Your rights: to know and access what we collected, to correct it, to delete it, and not to be discriminated against for exercising any right. You may send a request yourself or through an authorized agent; we answer within 45 days.

12. Children

Raqame is a business tool for people aged 18 or over and is not directed at children (under 13 in the United States, under 16 in the EU). We do not knowingly collect data from children, and we delete it if we learn we have.

13. Changes to this policy

We may update this policy from time to time. Changes are published on this page with an updated "Last updated" date above; if a change is material we will announce it on this page and through our contact channels, and in the app where possible.

14. Contact

The controller: Raqame (رقمي). For any privacy question or request:support@raqame.net — WhatsApp @raqame