Privacy Policy

1. Who we are

Khrija.ma is a Moroccan social platform for arranging meet-ups between adults in the same city. For the purposes of law 09-08, Khrija.ma is the data controller: we decide what is collected and why. You can reach us at support@khrija.ma.

Processing of personal data in Morocco is declared to the CNDP. Where this policy and a CNDP decision disagree, the CNDP decision applies.

2. What we collect

You give us

• Account details: username, email address and an encrypted password. Passwords are stored hashed and are never readable by us.
• Profile: city, date of birth, gender, smoking and drinking answers, languages, interests, music, sports, work, studies, height, biography and up to five photographs. Everything beyond city and date of birth is optional.
• What you write: Khrija descriptions, direct messages, group chat messages, support tickets and reports.
• Identity documents, only if you choose to get verified. See section 5.

We record automatically

• Technical data: IP address, browser, device type, language and the pages you open, kept for security and abuse prevention.
• Usage data: the Khrijas you join, requests you send and who you have blocked.

We do not buy personal data from third parties, and we do not sell yours to anyone, for any price.

3. Why we use it, and on what basis

We do not use your data for automated decisions that produce legal effects for you, and we do not profile you for advertising.

4. Location

Khrija.ma never publishes your exact location. Your city is the most precise location the site shows, and that is deliberate. A Khrija displays a city and a neighbourhood; the exact meeting point is revealed only to the people the host has personally accepted, and it is the host who writes it.

We do not read GPS coordinates from your device, we do not track you in the background, and there is no map of members. Your city is set once and cannot be changed by you afterwards, which protects everyone from accounts hopping between cities.

5. Identity verification

Verification is optional for browsing, and required to host a Khrija or ask to join one, because the person on the other side deserves to know a real adult stands behind the account.

The check is run by a specialist external provider. Your identity document and selfie go directly to that provider. Khrija.ma never receives, stores or displays your document. What comes back to us is one word: not verified, pending, or verified, plus an opaque reference. No document ever appears on a profile, in a search result, or at a public address.

The provider keeps documents under its own retention policy and under contract with us. Withdrawing your consent removes your verified badge; write to us and we will ask the provider to erase what it holds.

6. Who else sees your data

• Other members, according to your privacy settings. A locked profile, available with Khrija Plus, shows only your name, your username and your verification badge.
• Our providers, each for one job: hosting, email delivery, identity verification, anti-bot protection and payments. They act on our instructions only.
• Moroccan authorities, where a valid legal request obliges us. We check that every request is lawful before we answer.

Some providers operate servers outside Morocco. Where that happens, the transfer is made under the conditions of law 09-08, which requires an adequate level of protection in the destination country and, where applicable, CNDP authorisation.

7. Cookies

We use a small number of first-party cookies and no advertising trackers:

• Session cookie: keeps you signed in. Without it the site cannot work.
• khrija_lang: remembers your language.
• khrija_theme: remembers dark or light.
• khrija_cookies: remembers the choice you made in the cookie notice.

You can clear cookies in your browser at any time. Clearing them signs you out and resets those preferences.

8. How long we keep it

• While your account is open: your account and profile data.
• Messages: until you delete them, or the account is deleted. "Delete for everyone" removes the text for both sides.
• After you delete your account: 30 days, then permanent erasure, except where the law requires us to keep something longer.
• Security and moderation logs: up to 12 months.
• Reports and support tickets: up to 24 months, so repeated behaviour can be recognised.
• Login codes and recovery codes: minutes. They expire and are then erased.

9. Your rights under law 09-08

• Information: to know what we hold and why. This document is part of that.
• Access: to obtain a copy of your personal data.
• Rectification: to have anything inaccurate, incomplete or out of date corrected.
• Objection: to object, on legitimate grounds, to processing, and to withdraw consent where we relied on it.
• Erasure: to have your data deleted when it is no longer needed or was processed unlawfully.

Write to support@khrija.ma from the address on your account. We answer within 30 days. There is no charge unless a request is manifestly excessive or repetitive.

10. Security

Passwords are hashed, the whole site runs over HTTPS, sessions are protected against cross-site request forgery, and administrative access needs two passwords and an authenticator code. Members can turn on two-factor sign-in themselves, by authenticator app or emailed code.

No system is perfect. If a breach is likely to affect your rights, we will tell you and the CNDP without undue delay, and we will say plainly what happened and what to do.

11. Age

Khrija.ma is for adults, 18 and over. We ask for a date of birth at signup for that reason. If we learn that an account belongs to a minor, we close it and erase the data. If you believe a minor is using the platform, tell us at support@khrija.ma.

12. Changes to this policy

When we change anything material we update the date at the top and tell account holders by email or in the app before it takes effect. Continuing to use Khrija.ma after that means you accept the updated policy.

13. Contact and complaints

Questions or requests: support@khrija.ma, or open a ticket from the support page.

If you are not satisfied with our answer, you may lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), the Moroccan data protection authority, at www.cndp.ma.