Privacy Policy
Last updated: 18 August 2026
MAKHOOR (“we”, “us”) operates makhor.shop and the MAKHOOR Android and iOS apps. This policy describes what we collect, why, and how you can delete it. We do not sell personal data and we never process boutique payments.
Who we are
MAKHOOR is a social discovery product for Mukhawar and Abaya. Contact: hello@makhor.shop. Official site: https://makhor.shop.
Data we collect
Account: mobile number (required to sign in), optional name, city and country preference, optional boutique profile if you create one. Social: likes, saves, follows, blocks, and safety reports you submit. Merchant content: photos and short videos you upload, captions, optional prices, boutique contact details you provide (WhatsApp, phone, address, map coordinates). Technical: httpOnly session cookie, IP address and user-agent in server logs, crash diagnostics if Sentry is configured. We do not collect precise GPS from the device; map buttons open an external maps app with the boutique address the merchant entered.
How we use data
To create and keep you signed in, show a relevant feed, let you like/save/follow, let boutiques publish pieces, prevent abuse (rate limits, reports, blocks), and keep the service secure. We send a one-time sign-in code to your number on WhatsApp (not SMS). We do not use your data for advertising networks or third-party tracking.
Legal bases (where GDPR/UAE PDPL apply)
Contract (providing the account and feed), legitimate interests (security, ranking, abuse prevention), and consent where you upload media or send a message to a boutique via WhatsApp/call.
Who we share with
We do not sell data. Processors that host the product: Vercel (app), Neon (Postgres), Cloudflare R2 (media, if enabled), Upstash (rate limits, if enabled), Sentry (crashes, if enabled), Meta (WhatsApp Cloud API, to deliver your sign-in code). When you tap WhatsApp, Call, or Directions, your device opens those apps; that is your action, not a silent share by MAKHOOR. Boutiques see public posts and aggregate tap counts, not your phone number, unless you message them yourself.
Cookies and sessions
We set a first-party httpOnly cookie named makhoor_sid only after you enter the WhatsApp verification code (or the store-reviewer code). It lasts 30 days, is Secure in production, and SameSite=Lax. We also store theme, city, and onboarding flags in local storage on your device. Native apps load https://makhor.shop in a WebView and use the same cookie.
Retention
Account and social graph until you delete the account. WhatsApp sign-in codes expire in 10 minutes and are stored only as hashes. Server logs are rotated by the host. Uploaded media remains while the post or boutique exists.
Account deletion
You can delete your account in the app (Profile) or on the web at the account deletion URL. Deletion removes your user record, sessions, OTP challenges, likes, saves, follows, blocks, and reports you filed. If you own a boutique and no other user is attached, that boutique and its posts are deleted. This cannot be undone.
Children
MAKHOOR is not directed at children under 13 (or 16 where that is the digital-consent age). We do not knowingly collect data from children. Contact us to remove an account opened in error.
Security
Sign-in codes are hashed, single-use, and expire in 10 minutes. We never return the code in an API response. Sessions are random tokens stored as hashes. Uploads are type- and size-checked. APIs are origin-checked and rate-limited. Production requires HTTPS.
International transfers
Processors may store data in the EU, US, or other regions. We choose managed providers with standard contractual clauses or equivalent safeguards where required.
Your rights
Access, correction, deletion, and objection: email hello@makhor.shop or use in-app deletion. You may also complain to your local data protection authority.
Changes
We will update this page when practices change. Continued use after the “Last updated” date means you accept the revised policy.
MAKHOOR · makhor.shop
hello@makhor.shop
Delete account