Privacy Policy

Last updated: 2026-10-31

This page explains what data the Otaku Galaxy store (مجرة الأوتاكو) — the Android app and the website otakugalaxystore.com — collects, how it is used and stored, and when it is deleted.

The store sells anime merchandise in Iraq, with cash on delivery only.

Data we collect

Account data: your name, Iraqi mobile number, gender (male or female), chosen interface language (Arabic or Kurdish), a profile photo if you add one, and your birthday day and month if you enter them (no year).
Password: never stored as text. We store a one-way hash (bcrypt) from which the password cannot be recovered.
Account requests: when you register or forget your password, we keep what you submit (name, number, gender, and your account level for a password reset) so that store staff can verify it manually over WhatsApp. We send no SMS and no verification codes.
Orders: products, quantities, prices, discounts and totals; the delivery governorate and zone; the full address and contact phone you enter for the order; the order date and its status history.
Your activity in the store: cart, favourites, collections, back-in-stock alerts, reviews (stars, comment and the photos you upload), Galaxy Points and rewards, notifications and whether you read or opened them, and notification preferences.
Device: to send notifications we store your device notification token and its platform (Android or web).
Usage statistics — only when the store turns them on (off by default): the days your account was used and how many times it signed in on each; per-product counters (views, cart adds, shares) that are not linked to anyone; and daily search terms, not linked to any account or device (phone-like numbers are dropped).
Technical data: our servers log incoming requests (IP address, the page or path requested, browser or app information). The IP address is also used momentarily for request limits (abuse prevention) and is not stored in the database.
Website cookies: one encrypted session cookie (HttpOnly) that keeps you signed in, and one that remembers your theme (light or dark). No advertising or third-party tracking cookies.
On your device, in the app: the sign-in token in the device’s secure storage, and your recent searches.

What we do not collect

No payment card or bank details — payment is cash on delivery.
No location from your device, no contacts, no email address.
The Android app asks you for one permission only, notifications; it requests no location, contacts, camera or storage access.

How we use data

To create your account and sign you in, and to verify registration and password-reset requests.
To fulfil and deliver your orders and contact you about them, including store staff contacting you on WhatsApp.
For Galaxy Points, rewards and the birthday discount.
To send the notifications you choose (order status, back in stock, offers…); you can turn them off in settings.
To show your review to others once store staff approve it: the account name you had when you wrote it appears with the stars, comment and photos.
To protect the store from abuse, and for aggregated sales and usage statistics that do not identify you.

Storage and security

Data is kept in the store’s database on its servers and sent over encrypted connections (HTTPS).
Passwords are hashed. Sign-in tokens expire after 7 days and are revoked at once on every device when you change your password or the account is suspended or deleted.
On the website the sign-in token never reaches the browser: it is kept encrypted in a session cookie that pages cannot read.
Profile and review photos must be files you uploaded through the store.
No method of transmission or storage is completely secure, but we apply these measures to protect your data.

How long we keep data

Account data and activity: for as long as the account exists; deleted as soon as the account is deleted.
Orders: kept in full after the account is deleted — including the delivery phone and address — for accounting and legal obligations. The store has not yet set a fixed period after which they are deleted.
Notification delivery records: deleted after 30 days; a device token that has not checked in for 60 days stops being used.
The record of days your account was used, and daily search terms (when statistics are on): 400 days.
Aggregated statistics that do not identify you: kept.
Server logs and backups: no fixed period is configured; data may remain in them until those logs or copies are deleted or overwritten.

Your choices

Edit your name, gender, photo and interface language in settings, and change your password.
Turn each type of notification on or off.
To change your phone number, correct your birthday or ask about your data, contact store staff through the contact links in the app or on the website.
Delete your account at any time from the “Delete account” page (link below) or from settings in the app.

Changes to this policy

When this policy changes, we update this page and the “Last updated” date at the top.

Delete your account

Data we collect

Account data: your name, Iraqi mobile number, gender (male or female), chosen interface language (Arabic or Kurdish), a profile photo if you add one, and your birthday day and month if you enter them (no year).

Password: never stored as text. We store a one-way hash (bcrypt) from which the password cannot be recovered.

Account requests: when you register or forget your password, we keep what you submit (name, number, gender, and your account level for a password reset) so that store staff can verify it manually over WhatsApp. We send no SMS and no verification codes.

Orders: products, quantities, prices, discounts and totals; the delivery governorate and zone; the full address and contact phone you enter for the order; the order date and its status history.

Your activity in the store: cart, favourites, collections, back-in-stock alerts, reviews (stars, comment and the photos you upload), Galaxy Points and rewards, notifications and whether you read or opened them, and notification preferences.

Device: to send notifications we store your device notification token and its platform (Android or web).

Usage statistics — only when the store turns them on (off by default): the days your account was used and how many times it signed in on each; per-product counters (views, cart adds, shares) that are not linked to anyone; and daily search terms, not linked to any account or device (phone-like numbers are dropped).

Technical data: our servers log incoming requests (IP address, the page or path requested, browser or app information). The IP address is also used momentarily for request limits (abuse prevention) and is not stored in the database.

Website cookies: one encrypted session cookie (HttpOnly) that keeps you signed in, and one that remembers your theme (light or dark). No advertising or third-party tracking cookies.

On your device, in the app: the sign-in token in the device’s secure storage, and your recent searches.

How we use data

To create your account and sign you in, and to verify registration and password-reset requests.

To fulfil and deliver your orders and contact you about them, including store staff contacting you on WhatsApp.

For Galaxy Points, rewards and the birthday discount.

To send the notifications you choose (order status, back in stock, offers…); you can turn them off in settings.

To show your review to others once store staff approve it: the account name you had when you wrote it appears with the stars, comment and photos.

To protect the store from abuse, and for aggregated sales and usage statistics that do not identify you.

Storage and security

Data is kept in the store’s database on its servers and sent over encrypted connections (HTTPS).

Passwords are hashed. Sign-in tokens expire after 7 days and are revoked at once on every device when you change your password or the account is suspended or deleted.

On the website the sign-in token never reaches the browser: it is kept encrypted in a session cookie that pages cannot read.

Profile and review photos must be files you uploaded through the store.

No method of transmission or storage is completely secure, but we apply these measures to protect your data.

How long we keep data

Account data and activity: for as long as the account exists; deleted as soon as the account is deleted.

Orders: kept in full after the account is deleted — including the delivery phone and address — for accounting and legal obligations. The store has not yet set a fixed period after which they are deleted.

Notification delivery records: deleted after 30 days; a device token that has not checked in for 60 days stops being used.

The record of days your account was used, and daily search terms (when statistics are on): 400 days.

Aggregated statistics that do not identify you: kept.

Server logs and backups: no fixed period is configured; data may remain in them until those logs or copies are deleted or overwritten.

Your choices

Edit your name, gender, photo and interface language in settings, and change your password.

Turn each type of notification on or off.

To change your phone number, correct your birthday or ask about your data, contact store staff through the contact links in the app or on the website.

Delete your account at any time from the “Delete account” page (link below) or from settings in the app.

Data we collect

What we do not collect

How we use data

Who receives data

Storage and security

How long we keep data

Your choices

Changes to this policy

Data we collect

What we do not collect

How we use data

Who receives data

Storage and security

How long we keep data

Your choices

Changes to this policy