Tijarat waitlist privacy notice

This notice covers the pre-launch early-access app only. It does not cover a brokerage account because joining this waitlist does not create one.

What we collect

We use your email through Supabase Auth as the only OTP verification factor. Before that code, you provide your full name, phone number, a manually selected Pakistan city (or Other), and whether you already have a PSX brokerage account. The phone number is normalized but is not phone-OTP verified. The waitlist also stores an internal user ID, promotional priority position, language and consent version, first native-app-open time, referral status, rank events, and limited sanitized source metadata. Invite tokens are random and stored only as cryptographic hashes.

What we do not collect

The waitlist does not request CNIC images or numbers, a selfie or biometric, bank/card details, phone contacts, GPS or device-location permission, brokerage account numbers, balances, orders, investment preferences, portfolio data, or payment information.

Why we use the data

We use it to authenticate you, preserve your position, understand broad waitlist demand, attribute one first-touch invite, prevent duplicate or abusive awards, show privacy-safe invite activity, support account deletion, and keep non-identifying security and audit evidence. City and the existing-broker answer do not change rank or eligibility.

Providers and access

Supabase provides authentication, database, and server functions. Vercel hosts the invite and legal pages. Only the public Supabase anon key is present in clients; trusted service credentials remain server-side. Name, phone, city and brokerage-account answer are not written to Auth metadata, invite URLs or public snapshots. A referrer sees only their qualified friend count and privacy-safe status—not an invitee's email, name, phone, city, brokerage answer or position.

Retention and deletion

You can delete your account in the app or on the public deletion page. Authentication, profile and raw member details are removed. Qualified referral history may retain a non-reversible HMAC tombstone and non-PII arithmetic so deleting one account cannot corrupt another member's position or the append-only audit trail. An HMAC-only phone-usage tombstone also remains so deletion and rejoining cannot bypass the duplicate-phone rule.

Your choices

You may log out, change language, stop sharing, or delete the account. Operational IP/device information is used as a bounded abuse signal; a shared household network is never the sole reason to reject a referral.