Legal

Privacy Policy

Last updated: 30 September 2026

This policy explains what information Ashlonk collects when you use the Ashlonk app and this website, how that information is used and protected, and the rights you hold. It is written to honour the laws of the Republic of Iraq — above all the constitutional guarantees of personal privacy and confidentiality of correspondence — and to keep one house rule: your conversations belong to you, not to us.

01Who we are

Ashlonk is an Iraqi messaging service operated by the Ashlonk team from Baghdad, Republic of Iraq. In this policy, "the Service" means the Ashlonk mobile app together with the website ashlonk.com, and "we" means the operator of Ashlonk, the party responsible for the personal data described here. For any question, request or complaint about this policy, write to support@ashlonk.com.

02The Iraqi law this policy follows

We designed the Service and this policy around the legal framework in force in the Republic of Iraq, including:

  • The Constitution of the Republic of Iraq (2005) — Article 17 (First): every individual has the right to personal privacy; and Article 40: the freedom and confidentiality of communication and correspondence — postal, telegraphic, electronic and telephonic — are guaranteed and may not be monitored, wiretapped or disclosed except for legal and security necessity and by a judicial decision.
  • The Civil Code No. 40 of 1951 — the general rules of contract and civil liability that govern our relationship with you.
  • The Electronic Signature and Electronic Transactions Law No. 78 of 2012 — the validity of electronic consent and contracting, and the confidentiality duties of providers of electronic services.
  • The Penal Code No. 111 of 1969 — in particular Articles 437 and 438 on the criminal protection of secrets and of private and family life.
  • The Consumer Protection Law No. 1 of 2010 — your rights as a user of a service offered in Iraq.
  • The applicable regulations of the Communications and Media Commission (CMC), the Iraqi regulator of telecommunications and media services.

Iraq has, at the date of this policy, no comprehensive personal-data-protection statute. Wherever our practice goes beyond what current Iraqi law strictly requires, we follow accepted international practice — above all the principle of data minimisation: we collect the least we can, not the most we could.

03The information we collect

We collect only what the Service needs to work:

  • Account data. Your phone number, the display name you choose, and — only if you add them — a profile photo and a short "about" line.
  • Contact discovery. If, and only if, you grant the contacts permission, we process the phone numbers in your address book transiently to tell you which of your contacts already use Ashlonk. These numbers are used for matching, are not used to build marketing profiles, and are never sold or shared.
  • Messages and calls. Every personal message and call is end-to-end encrypted. We cannot read your messages or listen to your calls, and we do not keep their content once delivered (see section 5).
  • Media and files. Photos, files and voice notes travel and rest encrypted until they are delivered to the recipient.
  • Technical and diagnostic data. Device model, operating-system version, app version, app language, connection type, transient IP addresses needed to route your connection, and crash reports. We keep this to the minimum needed to keep the Service fast and stable.
  • Support correspondence. Whatever you choose to send us when you contact support.

04What we never do

  • We do not sell, rent or trade your personal data — to anyone, ever.
  • Ashlonk carries no advertising, so no advertising profile of you exists.
  • We do not track you across other apps or websites.
  • We cannot read your messages or hear your calls; end-to-end encryption removes that ability by design.
  • We do not collect voiceprints or any biometric data.
  • We do not collect your location. A location you choose to send inside a chat is end-to-end encrypted like any other message.

05End-to-end encryption

Every personal message and call is sealed with keys that exist only on your device and the devices of the people you write to. Our servers relay ciphertext they cannot open. A message that cannot be delivered immediately waits in encrypted form for up to 30 days and is then deleted; once delivered, it is removed from our servers.

This is how we give technical force to Article 40 of the Constitution: the confidentiality of your correspondence is not a promise we ask you to trust — it is a property of the system.

06Why we process your data

We process the limited data above on the following grounds, and for the following purposes only:

  • To perform our contract with you — delivering your messages and calls, maintaining your account, and running the Service you signed up for.
  • With your consent — for optional features such as contact discovery or a profile photo. Electronic consent is valid and binding under Law No. 78 of 2012, and you may withdraw it at any time — for example by revoking the contacts permission in your phone settings.
  • To meet our legal obligations under the laws of Iraq in force.
  • To protect the Service and its users — security, preventing spam, fraud and abuse, and diagnosing failures.

07Sharing and disclosure

We share personal data only in these narrow cases:

  • Technical service providers — for example hosting or SMS verification — who receive only the minimum necessary and are bound by contractual confidentiality obligations.
  • A legal successor, if the Service is ever transferred or reorganised; the successor remains bound by this policy.
  • Iraqi public authorities — only when disclosure is required by a binding judicial decision issued in accordance with Article 40 of the Constitution and the Code of Criminal Procedure No. 23 of 1971. We review the legality of every request before responding.

Even under a valid judicial order, end-to-end encrypted content is something we do not possess and cannot produce. Only the limited account data we actually hold could ever be disclosed.

08How long we keep data

  • Account data — for as long as your account exists.
  • Account deletion — delete your account inside the app (Settings → Account → Delete account). Your account data is erased from our active systems within 30 days and from backups within 90 days at most.
  • Undelivered messages — at most 30 days, then deleted.
  • Operational and diagnostic logs — at most 12 months.
  • Support correspondence — at most 24 months.

We keep data longer only where Iraqi law or a binding judicial order requires it.

09How we protect data

We apply technical and organisational safeguards appropriate to a private messenger: encryption in transit and at rest, strict access controls on the least-privilege principle, monitored infrastructure, and confidentiality obligations on everyone who works on Ashlonk — consistent with the duties of providers of electronic services under Law No. 78 of 2012. No system is perfectly secure; if you believe you have found a vulnerability, please report it at once to security@ashlonk.com.

10Your rights

You may, at any time:

  • Ask what data we hold about you and receive a copy of it.
  • Correct inaccurate account data — most of it directly inside the app.
  • Delete your account and the data linked to it.
  • Withdraw any consent you gave, with effect for the future.
  • Object to, or ask us to restrict, a specific processing operation.
  • Complain — first to us at support@ashlonk.com; you may also raise the matter with the Communications and Media Commission or bring it before the competent Iraqi courts.

Nothing in this policy diminishes your constitutional right to privacy under Article 17 or your right to claim compensation for unlawful harm under the Civil Code No. 40 of 1951 (Articles 202–205).

11Children

The Service is not directed at children under 13, and they may not create accounts. Users aged 13 to 17 need the consent of a parent or guardian, because full contractual capacity in Iraq begins at 18 completed years (Articles 97 and 106 of the Civil Code), with due regard to the Care of Minors Law No. 78 of 1980. If we receive reliable notice that an account belongs to a child under 13, we will delete it.

12Where your data lives

Our servers may be located inside or outside Iraq. Wherever data is stored, it receives the protections of this policy, remains end-to-end encrypted in the case of message and call content, and is covered by contractual safeguards with any processor involved.

13This website

The ashlonk.com website is fully static and script-free: it sets no cookies, runs no analytics and embeds no trackers. The web server may keep short-lived standard access logs (IP address and browser type) strictly for security purposes.

14Changes to this policy

When we change this policy we will publish the new version here with an updated date, and announce material changes inside the app a reasonable time before they take effect. Continuing to use the Service after that date constitutes acceptance of the updated policy to the extent permitted by Iraqi law.

15Contact

Ashlonk — Baghdad, Republic of Iraq. Email: support@ashlonk.com. This policy is issued in Arabic and English; in case of any divergence, the Arabic text prevails.