Privacy & Data Safety

Privacy at a Glance

We believe in radical transparency. Here is a summary of how we handle your data, optimized for Google Play and Apple App Store requirements.

Account & Data Deletion

In accordance with Google Play User Data policies, we provide two mandatory pathways for users to delete their accounts and all associated data.

Data Retention Policy

Standard Retention: We retain your personal data only as long as your account is active. Upon deletion, data is removed from production databases within 24 hours.

Legal Retention Exceptions: In compliance with the laws of the Republic of Uzbekistan, we may retain transaction records (booking history) for up to 5 years strictly for tax auditing, fraud prevention, and legal defense. This data is isolated and never used for marketing.

Security Architecture

• Encryption in Transit: All communications between the Lemon Tour app and our servers use TLS 1.3 encryption.
• Data at Rest: Personal data is stored on Supabase (PostgreSQL) using AES-256 volume-level encryption.
• Access Control: We implement Row Level Security (RLS) to ensure users can only access their own data.
• Infrastructure: Hosted on ISO 27001 certified data centers.

Third-Party Partners

We do not sell your data. We share only necessary metadata with the following verified processors:

• Telegram: For passwordless OAuth authentication.
• Supabase: For secure database hosting and storage.
• Sentry: For real-time error tracking and performance monitoring.
• Expo (EAS): For delivering push notification services.

Legal & Contact