Privacy policy

Who we are

Bolalar shahri is a catalogue of places and events for children in Tashkent: a mobile app and the bolalar-shahri.uz website. The app is published by an individual in Uzbekistan, who processes your data (the operator). Questions and requests: [email protected].

What data we collect

You can browse the catalogue without signing in. To write reviews, save places and set reminders, you sign in with Telegram, Google or Apple. We then store:

• Account: the sign-in identifier, your name and email. Google and Apple provide the email themselves (Apple may give a private relay address). With Telegram you enter your email and confirm it with a code; from Telegram we only take your name and photo.
• We do not ask for or store your phone number.
• Settings: app language, your district and the age range of your children. We do not ask for a child’s name or date of birth.
• Activity in the app: saved places, reviews and ratings, event reminders, “Wrong information?” reports and place suggestions.
• Visit confirmation (optional): a photo of a receipt or payment attached to a review.
• Business owners: a document proving ownership (photo or PDF). It may contain information such as the manager’s name.
• Technical data: a push notification token, device type (Android or iPhone) and app crash reports. Crash reports contain no personal data.
• Analytics: a place page was opened, “Call” or “Route” was tapped, a place was saved. These events are not linked to an account, device or IP address.

Location

Your precise location is never sent to the server: “Nearest” sorting and the map work on the phone itself. Visits are not confirmed by geolocation.

Why we use it

• Signing in and protecting your account: a sign-in code is sent to your email.
• Making reviews, saved places and reminders work. Event reminders are shown by the phone itself.
• Push notifications: the status of your review, new reviews and moderation results for business owners, new events in your district and (if you turn them on) offers from saved places. No notifications are sent between 22:00 and 08:00. You can turn them off in your phone settings.
• Email is only used for sign-in codes and essential messages. We do not send marketing emails.
• Statistics for business owners: how many times a place page was opened and its buttons tapped, without who did it.
• Finding and fixing app errors.

We do not sell your data or share it for advertising. Ratings and review order do not depend on money.

Reviews are public

After moderation, the review text, rating and the child’s age group (for example, “Parent of a 3–6 year old”) are visible to everyone in the app. Your name and email are not shown. Do not include personal data in a review (phone numbers, addresses, other people’s names). Only moderators see receipt photos.

Where data is stored and who receives it

The database and server are located in Uzbekistan. The app uses these services:

• Cloudflare (USA): website and app traffic goes through this network. The encrypted connection is opened on the nearest Cloudflare server (currently Warsaw, Poland), then the request is passed to our server. Cloudflare does not store the data.
• Google Firebase (USA): delivering push notifications (Firebase Cloud Messaging) and crash reports (Crashlytics). On iPhone, notifications are delivered through Apple. Firebase Analytics is not used.
• Amazon Web Services (Frankfurt, Germany): sending emails.
• Telegram, Google or Apple: the sign-in method you choose.
• Anthropic (USA): automatic translation of place and event descriptions into other languages. No user data or reviews are sent.

How long data is kept

• Account, settings, saved places and reviews: until you delete your account.
• Sign-in session: expires after 60 days without use.
• Receipt photo: 30 days.
• Ownership document: deleted 30 days after the decision. The database keeps only the confirmation method, date and the staff member who confirmed it.
• An uploaded file that was never attached to anything: 24 hours.
• Event reminder: deleted after the event.
• Analytics events: 90 days. After that only daily totals remain.
• Push notification token: deleted when you sign out or the token becomes invalid.
• Backups: 14 days.
• Moderation decisions and the staff activity log: indefinitely. They contain no email addresses, sign-in codes or tokens.

Deleting your account

In the app: Profile → “Delete account”. After two confirmations the account is deleted right away: your email and sign-in methods, sessions on all devices, saved places, reminders, push tokens, receipt photos, ownership claims and their documents. If you signed in with Apple, access is also revoked at Apple.

Your reviews, complaints and “Wrong information?” reports are kept but no longer linked to you; ratings don’t change. If you are a business owner, the place stays in the catalogue and your right to manage it is cancelled. Backups keep the data for up to 14 days.

If you cannot sign in to the app, email [email protected].

Your rights

Under the Law of Uzbekistan “On Personal Data”, you have the right to access, correct and delete your data and to withdraw consent to its processing. You change your language, district and children’s ages yourself in Profile. For other requests, email [email protected].

Children

The app is for parents and is used by people over 18. We do not collect data from children: we only store the age range a parent provides.

Security

Connections are encrypted (HTTPS). Apple tokens are stored encrypted in the database. Only staff who need the data for their work can see it, and every action they take is logged. Server logs do not contain emails, sign-in codes or tokens.

Changes

If this policy changes, the new text will be published on this page. We will also announce important changes in the app.

This policy is published in Uzbek, Russian and English. If the versions differ, the Uzbek text prevails.