Dumbi

Privacy Policy

Last updated: 26 October 2026

This Privacy Policy explains how we collect, use, and protect your personal data when you use the Dumbi mobile application on iPhone and Android ("App"). Dumbi is operated by the independent developer of Dumbi, based in Dubai, United Arab Emirates ("we", "us", or "our"), who is the data controller for the personal data processed through the App.

This Policy should be read alongside our Terms and Conditions, which together form the agreement between you and us. Both documents apply to your use of the App.

We are committed to protecting your privacy. We have designed Dumbi to collect only the data that helps us provide, secure, and improve the App, to store it securely, and to give you clear control over it.

1. Who We Are

1.1 Dumbi is operated by the independent developer of Dumbi, based in Dubai, United Arab Emirates, who is the data controller for personal data processed through the App.

1.2 You can contact us about anything in this Policy, or to exercise your data protection rights, by email at [email protected].

2. What Personal Data We Collect

2.1 We collect the following categories of personal data:

(a) Account information — your email address, username, and profile details (biography, pronouns, profile photograph).

(b) Date of birth (age verification) — when you create an account, we ask for your date of birth to confirm that you meet our minimum age requirement of 16. Your date of birth is stored privately in your account and is not shown to other users. See Section 11 (Children's Privacy).

(c) Authentication data — data provided through email and password registration, Sign in with Apple (iPhone), or Google Sign-In. For Apple and Google sign-in, we receive a unique identifier and, where you permit it, your email address and name from the provider. Your name is used only to suggest a username when you create your account; it is stored with your sign-in details and is never shown to other users.

(d) User-generated content — reviews, ratings (taste, portion, presentation), comments on other users' reviews, photographs you suggest for restaurants, restaurant listings you add (including the location you pin on the map), Hidden Gems selections, users you follow, and any custom biryani style names you create.

(e) Precise location data — your device's precise location, only when you grant permission and only while you are using the App. It is used on your device to show nearby restaurants, to show your position on the map, and to show a "You're Here" prompt when you are at a restaurant listed in the App. We do not store your precise coordinates (latitude and longitude) on our servers. When you add a restaurant, the point you place on the map becomes that restaurant's public location, and your device's built-in map service (Apple on iPhone, Google on Android) is used to look up its street address and the city and country it is in.

(f) Location information (city and country) — the city and country that you choose to provide. You may optionally enter these when you create your account, or add or change them at any time in your profile settings; you can also skip them or leave them blank. You decide whether your city is shown on your public profile ("Show My City"). This information also helps us understand where Dumbi is being adopted geographically. We derive this only from what you type — we do not calculate it from your device's location. You can edit or remove it at any time in Settings, and it is deleted when you delete your account.

(g) Points and achievement data — your cumulative points score and unlocked achievements.

(h) Interaction data — records of your likes, comments, Hidden Gems selections, users you follow, and users you have blocked.

(i) Content moderation data — reports you submit about other users or content, and reports submitted about you or your content. This includes the identity of the reporter and the user or content being reported. Our servers process each report and notify our moderation team by email (see Section 5).

(j) Device and platform information — operating system, device type, and app version, used to make sure the App functions correctly.

(k) Push notification data — when notifications are enabled, we store a Firebase Cloud Messaging (FCM) token used to deliver notifications to your device, a per-install device identifier generated on your device and stored securely on it (in the iOS Keychain on iPhone), the platform name, app version, and your per-type notification preferences (likes, comments). These are used solely to deliver notifications about activity on your reviews and are deleted when you delete your account or sign out.

(l) Crash and performance diagnostic data — when the App crashes or experiences a performance issue, we collect diagnostic data via Firebase Crashlytics and Firebase Performance Monitoring, including device type, operating system version, app version, the stack trace of the crash, and timing data for app startup, screen rendering, and network requests. This data is associated with a pseudonymous Firebase Installation ID — not with your account, email, or username — and is used solely to identify and fix bugs and performance problems.

(m) Product usage data — we collect pseudonymous data about how the App is used via Firebase Analytics, including session duration, screens you view, key actions you take in the App (such as submitting a review or marking a Hidden Gem), and aggregate device and country information. This data is associated with a Firebase-generated installation identifier — not your name, email, or precise location — and is used to understand how people use the App so we can improve it. We do not enable Firebase Analytics' advertising features or share this data with advertisers.

(n) App integrity data — to protect our servers from abuse, the App may use Firebase App Check, which asks Apple (App Attest) or Google (Play Integrity) to confirm that requests come from a genuine copy of the App on a genuine device. This check does not identify you.

2.2 Our website and waitlist. Our website, dumbiapp.com, is hosted by Cloudflare, which processes standard technical data (such as your IP address and browser type) to deliver the site and protect it from attacks. If you join our waitlist, we collect the email address you enter and store it with MailerLite, our email service provider, solely to tell you about Dumbi's launch and major updates. Every email includes an unsubscribe link, and you can ask us to delete your waitlist email at any time by contacting [email protected]. The legal basis is your consent (GDPR Article 6(1)(a)). The website does not use advertising or tracking cookies.

3. What We Do Not Collect

3.1 We deliberately do not collect or store:

3.2 We do not use third-party advertising networks. We do not place cookies or equivalent tracking technologies in the App. We do not engage in cross-app tracking that would require an Apple App Tracking Transparency prompt. The diagnostic and product-usage data we collect through Firebase, and the push notification data we use to deliver notifications to your device, are described in Section 2.1, and the reasons for each are set out in Section 4.

4. How We Use Your Data and Why

4.1 We use your personal data only for the purposes listed below. Where data protection laws such as the EU or UK General Data Protection Regulation ("GDPR") apply to you, we also state the legal basis we rely on for each purpose.

(a) To create and manage your account. What: storing your email, username, profile, and authentication credentials. Legal basis: performance of our contract with you (GDPR Article 6(1)(b)). We need this data to provide you with the App under our Terms.

(b) To display your reviews, ratings, and profile to other users. What: making your User Content visible in the App community in accordance with your visibility settings. Legal basis: performance of our contract with you (Article 6(1)(b)). The community features are the core service you signed up for. This includes who you follow and who follows you: other signed-in users can see the Followers and Following lists on your profile.

(c) To process your interactions with other users and content. What: recording likes, comments, Hidden Gems, users you follow, and blocks. Legal basis: performance of our contract with you (Article 6(1)(b)).

(d) To show you nearby biryani restaurants. What: accessing your device's precise location while you are using the App. Legal basis: your consent (Article 6(1)(a)). You can grant or refuse location permission at any time through your device settings, and you can withdraw consent at any time. Withdrawing consent will not affect processing we carried out before you withdrew it.

(e) To display your location on your profile and understand regional adoption. What: showing the optional city and country you choose to provide on your public profile (if you allow it), and using city and country data in aggregate to understand where Dumbi is being adopted. Legal basis: performance of our contract with you for displaying the profile you build (Article 6(1)(b)); and our legitimate interests for aggregate geographic analysis (Article 6(1)(f)). This data is optional and minimal (city and country only), is not shared with third parties, and you can edit or delete it at any time.

(f) To operate the points system and achievements. What: calculating points based on your contributions and unlocking achievements. Legal basis: performance of our contract with you (Article 6(1)(b)).

(g) To moderate content and enforce community standards. What: reviewing reports, applying automated content filters (profanity, hate speech, links), and acting on violations. Our servers process report data and notify our moderation team by email. Legal basis: our legitimate interests (Article 6(1)(f)). We have a legitimate interest in keeping the App safe, civil, and useful for all users. Moderation is essential to running a community platform, we only process the minimum data needed, and you have the right to object (see Section 8).

(h) To prevent fraud and abuse of the points system. What: investigating suspected fake reviews, coordinated liking schemes, or other fraudulent activity. Legal basis: our legitimate interests (Article 6(1)(f)). We have a legitimate interest in maintaining the integrity of the community and protecting honest users from being drowned out by manipulation.

(i) To respond to your support enquiries. What: handling emails you send us and replying to you. Legal basis: our legitimate interests (Article 6(1)(f)).

(j) To send essential service emails. What: password reset emails and similar account-related messages, sent by Firebase Authentication on our behalf. Legal basis: performance of our contract with you (Article 6(1)(b)).

(k) To comply with legal obligations. What: responding to lawful requests from law enforcement, regulators, or courts. Legal basis: legal obligation (Article 6(1)(c)).

(l) To deliver push notifications about activity on your reviews. What: storing a Firebase Cloud Messaging token and your notification preferences, and sending notifications when other users like or comment on your reviews. Legal basis: your consent (Article 6(1)(a)). You can withdraw consent at any time by turning off notifications in the App's Settings screen or in your device settings. Withdrawal will not affect notifications already sent.

(m) To identify and fix crashes and performance issues. What: receiving crash reports and performance traces via Firebase Crashlytics and Firebase Performance Monitoring. Legal basis: our legitimate interests (Article 6(1)(f)) in making sure the App works reliably for everyone. This data is associated only with a pseudonymous Firebase Installation ID and is not used for any profiling or decision-making about you.

(n) To understand and improve App usage. What: collecting session, screen-view, and key-action data via Firebase Analytics, in aggregate, to understand how people use the App and inform product decisions. Legal basis: our legitimate interests (Article 6(1)(f)). This data is associated only with a Firebase Installation ID, is not linked to your account, and is not shared with advertisers. You have the right to object (see Section 8).

(o) To verify your age and enforce our minimum age requirement. What: collecting your date of birth when you create an account to confirm you are at least 16. Legal basis: our legitimate interests (Article 6(1)(f)) in making sure the App is used only by people who meet our minimum age requirement and in protecting children from a community platform that is not intended for them. Your date of birth is stored privately and is not shown to other users.

(p) To protect the App from abuse. What: confirming through Firebase App Check that requests come from a genuine copy of the App. Legal basis: our legitimate interests (Article 6(1)(f)) in keeping our service and our users' data secure.

4.2 We do not use your personal data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects on you.

5. Who We Share Your Data With

5.1 We do not sell your personal data. We do not share your data with advertisers, data brokers, or marketers.

5.2 We share your data only with the following service providers, who process it on our behalf under contractual safeguards:

(a) Google LLC — Firebase platform. Firebase provides the infrastructure for the App, including:

Google processes your data as our service provider under contractual safeguards (Google's data processing terms and Standard Contractual Clauses where applicable). Google's privacy policy: https://policies.google.com/privacy.

(b) Resend (email delivery). When a report is submitted, the report details (including the usernames of the reporter and of the reported user, the reason, and any details written by the reporter) are sent to our moderation inbox through Resend, an email delivery service. Resend does not use this data for any other purpose. Resend's privacy policy is available at resend.com.

(c) Google LLC — Google Sign-In, Android location and map services. If you choose to sign in with Google, Google processes your authentication data. On Android, your location is provided by Google Play services, and the street address of a restaurant you add is looked up through your device's built-in Google geocoding service. See https://policies.google.com/privacy.

(d) Apple Inc. — Sign in with Apple, Apple Maps, App Attest, and Apple Push Notification service (iPhone). If you choose to sign in with Apple, Apple processes your authentication data. Apple Maps (MapKit) displays the map on iPhone and is used to look up the street address of a restaurant you add. The Apple Push Notification service (APNs) delivers the notifications we send through Firebase Cloud Messaging to your iPhone. Apple's privacy policy: https://www.apple.com/legal/privacy.

(e) CARTO (map images on Android). On Android, the map is drawn with the open-source MapLibre library using map images (tiles) provided by CARTO. To load them, your device requests the map area you are viewing from CARTO's servers, which receive your device's IP address as part of any internet request. CARTO does not receive your account information. CARTO's privacy policy is available at carto.com.

(f) Cloudflare and MailerLite (website and waitlist). Cloudflare hosts our website, and MailerLite stores waitlist email addresses and sends our launch emails (see Section 2.2).

5.3 Our server functions run on Google Cloud infrastructure and process your data server-side. In particular:

5.4 We may disclose your data where required by law, to respond to lawful requests from regulators or courts, or where necessary to protect our rights, safety, or property or that of our users or the public.

5.5 If Dumbi is ever involved in a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. In that case we will notify you and ensure the acquirer is bound by privacy commitments at least as protective as those in this Policy.

6. International Data Transfers

6.1 Our service providers, including Google LLC (Firebase) and Apple Inc., process data on servers located outside the United Arab Emirates and outside your own country, including in the United States and the European Economic Area.

6.2 Where your personal data is transferred to another country, we rely on the safeguards offered by our service providers and recognised under applicable data protection law, such as Standard Contractual Clauses (and, for UK users, the UK International Data Transfer Addendum), or transfers to countries recognised as providing an adequate level of protection.

6.3 You can request more information about the safeguards in place for a specific transfer by contacting us at [email protected].

7. How Long We Keep Your Data

7.1 We keep your personal data for as long as your account remains active.

7.2 If you delete your account, we delete your personal data straight away — usually within minutes, and in any case within 30 days — except for:

(a) Data we are legally required to retain, for the minimum period required by the relevant law.

(b) Data required to resolve disputes, enforce our Terms, or defend legal claims, for the duration of any applicable limitation period.

(c) Anonymised or aggregated data — such as a restaurant's average rating, which may have been influenced by your reviews. Once this data can no longer be used to identify you, we may retain it indefinitely.

7.3 Residual copies of your data may persist for a limited additional period in routine backups before being overwritten in the ordinary course of our backup cycle. These backups are not actively used and are overwritten on a rolling basis.

7.4 Reports submitted to our moderation team (including reports you submitted and reports about you) are kept for as long as reasonably necessary to investigate them, take appropriate action, and defend against any related claims.

8. Your Rights

8.1 Depending on where you live, data protection laws — including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where they apply to you, the EU and UK GDPR — give you rights over your personal data. We offer the following rights to all users:

(a) The right of access — to request a copy of the personal data we hold about you.

(b) The right to rectification — to ask us to correct inaccurate or incomplete data. You can also edit most of your profile directly in the App.

(c) The right to erasure — the "right to be forgotten". You can delete your account directly through the App's Settings screen, at dumbiapp.com/delete-account, or by contacting us.

(d) The right to restrict processing — to ask us to limit how we use your data in certain circumstances.

(e) The right to data portability — to receive your data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.

(f) The right to object — to object to processing based on our legitimate interests (Section 4.1(e), (g), (h), (i), (m), (n), (o) and (p)). If you object, we will stop processing unless we have compelling legitimate grounds that override your rights.

(g) Rights in relation to automated decision-making and profiling — we do not carry out automated decision-making that produces legal or similarly significant effects on you, but you have the right to be informed if that changes.

(h) The right to withdraw consent — where our processing is based on your consent (for example, access to your device location, or push notifications), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent. You can withdraw location consent through your device's settings, and push notification consent through the App's Settings screen (turning off Likes or Comments notifications) or your device's settings (turning off notifications for the App entirely).

8.2 To exercise any of these rights, email us at [email protected]. We will respond within one month. In complex cases we may extend this by up to two further months, and we will let you know if we do.

8.3 We do not charge a fee for handling your request unless it is manifestly unfounded or excessive.

9. How to Delete Your Account

9.1 You can delete your account directly in the App:

9.2 Deletion cannot be reversed. Please see Section 16 of our Terms and Conditions for full details of what is deleted.

9.3 If you can't use the App, you can request account deletion at dumbiapp.com/delete-account or by emailing [email protected] from the email address on your account.

10. Security

10.1 We take the security of your personal data seriously. The measures we have in place include:

10.2 No online service is ever completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant data protection authorities where required by law, and we will notify you without undue delay where the breach is likely to result in a high risk to you.

11. Children's Privacy

11.1 Dumbi is not intended for children under the age of 16. You must be at least 16 to use the App.

11.2 When you create an account, we ask for your date of birth to confirm that you are at least 16. If the date of birth you provide indicates that you are under 16, we do not create a profile, and the sign-in account that was just created is deleted straight away. We do not keep the details of that attempt.

11.3 We do not knowingly collect personal data from anyone under 16. If we discover or reasonably believe that a user is under 16, we will suspend or terminate the account and delete all associated personal data.

11.4 If you are a parent or guardian and you believe your child has provided us with personal data, please contact us at [email protected] and we will take steps to delete it.

12. Changes to This Policy

12.1 We may update this Policy from time to time. When we do, we will:

12.2 Your continued use of the App after the changes take effect constitutes your acceptance of the updated Policy. If you do not agree, you should stop using the App and delete your account.

13. Complaints

13.1 If you have a complaint about how we handle your personal data, please contact us first at [email protected]. We will investigate and respond.

13.2 If you are not satisfied with our response, you may have the right to lodge a complaint with the data protection authority in the country where you live or work — for example, the UAE Data Office, the UK Information Commissioner's Office (ico.org.uk), or the supervisory authority of your EU member state.

14. Contact Us

14.1 For any questions about this Policy, or to exercise your data protection rights, email [email protected].

14.2 We aim to respond to all enquiries within 5 working days, and to formal data protection requests within one month.