Rayeh Privacy Policy
Last updated: 15 October 2026
This Privacy Policy explains how Rayeh collects, uses, discloses and retains personal information when you use rayeh.to and the Rayeh iOS application (together, the “Service”).
Privacy and support contact: [email protected]
In this policy, “Rayeh”, “we”, “us” and “our” mean the operator identified above. Where applicable data-protection law uses the term, the operator is the data controller for the personal information described here.
1. What Rayeh does
Rayeh connects people who want to send documents with travellers already taking a compatible route. Participants may arrange a free transfer or agree compensation directly. Rayeh is an intermediary, not a courier. It does not process payments, hold funds, or guarantee delivery.
2. Information we collect
Account and sign-in information
You sign in through Google or Apple. We receive the information your provider supplies for that sign-in, which may include your name, email address, provider account identifier, verification information and profile-image URL. If you use Apple's private relay, the email address may be an Apple relay address. We also create an internal account identifier and record account and sign-in timestamps.
We use authentication credentials, session information and, where needed, provider tokens to maintain your account and support provider authorization and revocation. Rayeh does not receive your Google or Apple password and does not offer password-based accounts.
Profile and verification information
We collect your display name, home city, country and phone number. A verified phone number is required to complete account setup. Verification uses a one-time code delivered through WhatsApp. We record verification status, expiry and retry information, and retain a protected representation of the code for verification.
If you change your phone number, we retain a history of previous numbers and change timestamps for account security and audit purposes. If you choose a notification email different from your sign-in email, we collect and verify that address before using it for notifications.
Listings, connections and activity
We collect the information you provide when posting or managing a sending request or journey. This includes origin and destination cities, dates, document category, envelope size, document count, available capacity and any compensation preferences, offers or agreed amount.
We record connection requests, acceptances, declines, cancellations, agreed terms, status updates, delivery declarations, ratings and reviews, along with related timestamps. Some status changes follow the trip's dates. A status does not by itself prove physical handover or delivery.
Messages, reports and support
We store messages and system events in transfer conversations, including message content, participants, timestamps and read or unread information. We also collect the information you provide when reporting a concern, contacting support or making a privacy request.
Device, notification and technical information
If you enable iOS push notifications, we collect an Apple Push Notification service (APNs) device token and related registration information, such as the app identifier, notification environment and last registration time. We store your notification preferences and delivery, retry and failure records for notifications sent through the Service.
Our service and infrastructure providers process technical information needed to deliver and secure the Service. This can include IP addresses, request and error information, browser or device information, session activity and security records. We do not use this information to track your precise physical location.
Information we do not ask you to provide
Rayeh does not request or provide an upload feature for government IDs, passports, selfies, biometric verification, document scans or document photographs. It does not request access to your precise GPS location, address book, microphone or photo library, or collect card or bank-account details through a payment feature.
Do not put document contents, identity numbers, passwords, payment credentials or other unnecessary sensitive information into listings, messages or reports. If you type personal or sensitive information into a free-text field, that information becomes part of the content you submit.
3. How we use information
We use information to:
- create and authenticate accounts, verify contact details and maintain sessions;
- publish and manage listings, suggest compatible routes and dates, and support capacity and compensation matching;
- process connection decisions, maintain agreed terms, and display activity, history and transfer progress;
- deliver conversations, service notices and notification preferences you enable;
- provide ratings, reputation information, support and concern reporting;
- detect abuse, investigate disputes, protect accounts and operate the Service;
- maintain service reliability, backups and operational records; and
- respond to legal obligations and privacy requests, including account deletion.
Matching suggestions use listing information such as route, date, capacity and compensation preferences. Participants decide whether to connect; a suggestion does not verify a participant's identity or guarantee delivery.
4. Who can see your information
Public and marketplace information
Listings can be visible to other users and visitors. Public listing details may include cities, dates, status, document category and quantity, available capacity, compensation, ratings, completed-transfer counts and membership information. City-level listing activity may also appear on the map or globe.
These details can reveal travel plans or document-sending activity. Share only the information necessary for the listing, and do not include precise home addresses or confidential document contents in public content.
Connected participants
Participants in a connection can see the relevant request or journey, display names, reputation information, shared terms, messages and status updates needed to coordinate that connection.
Rayeh does not provide your verified phone number or sign-in/notification email address to the other participant as a contact method. Participant communication is through the built-in inbox. If you voluntarily include personal information in a message or other shared content, the recipient can see that content and may retain a copy outside Rayeh's control.
Operators and service providers
Authorized personnel may access information when needed to run, secure and support the Service, handle reports or comply with legal obligations. Transfer messages are not represented as end-to-end encrypted against the operator.
We use providers for hosting, database infrastructure, backups, network security, authentication and communications. Relevant services include Google and Apple for sign-in, Apple for push delivery, WhatsApp/Meta for WhatsApp communications, Cloudflare for network/security services, and our hosting, backup and email-delivery providers. Our self-hosted Evolution API integration supports WhatsApp verification and notifications. These providers receive or process information necessary for their functions and may also process data under their own privacy policies.
We may disclose information when legally required or when reasonably necessary to respond to valid legal requests, investigate abuse, protect rights and safety, or address fraud. If the Service changes ownership, personal information may be transferred as part of that transaction, subject to applicable law and any required notices.
We do not sell or rent your personal information or use it for third-party targeted advertising.
5. Notifications and your choices
Rayeh may send account-verification, security, connection and activity notices. Depending on your settings and the event, these can appear in the Service or be delivered through email, WhatsApp or iOS push notifications.
You can manage available notification preferences in your profile and disable push permission in your iPhone's Settings. Declining push permission does not prevent you from using the Service. Necessary verification or security steps may still be required to establish or protect an account.
Device notifications and messages delivered to external services may appear in previews or on a lock screen according to your device settings. Use your device's notification controls if you want to hide those previews.
We do not treat agreement to the Service's terms as blanket consent to unrelated promotional messages. Where promotional communications require consent, we obtain it and provide a way to opt out.
6. Cookies and local storage
The website uses cookies or equivalent storage for authentication, security and preferences, such as language. The iOS app stores its Rayeh session credential in the iOS Keychain and may store preferences locally. Its embedded website globe may use web storage associated with the Service.
You can clear website data through your browser or sign out of the app. Blocking required cookies may prevent sign-in or other essential functions. We do not currently use third-party advertising trackers as part of Rayeh.
7. Retention and account deletion
We retain account and activity information while your account is active and afterward only for purposes such as resolving disputes, investigating abuse, meeting legal obligations and maintaining necessary service records. The appropriate period depends on the information, its purpose, an ongoing investigation or dispute, and applicable legal requirements. Verification codes expire and expired temporary records are removed through routine maintenance.
You can initiate account deletion from Profile → Delete account in the iOS app, or contact [email protected]. Our account-deletion process is scheduled for completion within 30 days of your request. Submitting the request revokes Rayeh sessions. During processing, we cancel active listings and connections, remove or redact account details and user-authored content, remove associated verification and notification records, and revoke retained Apple authorization tokens where applicable.
Limited transfer, rating and safety records may remain under a removed-user reference where needed for the purposes described above. These may include routes, dates, statuses and agreed amounts. Removing direct account identifiers does not necessarily make every retained record anonymous. We do not retain identifiable information merely because retaining it is convenient.
Deleting a conversation from your inbox or cancelling a listing is different from requesting account deletion. Operational records or the other participant's conversation history may remain. We cannot delete copies another person has independently saved.
Backup copies may persist until the relevant backup is rotated or expires. They are kept separate from normal use. Where deleted information is restored for recovery, deletion requests must be reapplied before that information is returned to ordinary use. Information retained under a legal obligation is restricted to that purpose.
8. Security
We use safeguards appropriate to the Service, including HTTPS, authentication, server-side permission checks and restricted access to operational systems. The iOS session credential is stored in Keychain. No transmission or storage system is completely secure, and we cannot promise absolute security.
Do not share account credentials or one-time verification codes. Report suspected misuse or a security concern to [email protected].
9. International processing
Rayeh may be accessed internationally, and infrastructure, authentication and communication providers may process information in countries other than the country where you live. Those countries may have different privacy laws. Transfers are subject to applicable legal requirements. You may contact us for information about relevant processing locations and any applicable transfer safeguards.
10. Your privacy rights
Depending on your location and the law that applies, you may have rights to access, correct or delete information; obtain a portable copy; object to or restrict certain processing; withdraw consent where processing relies on consent; and complain to a competent data-protection authority.
Where a law requires a lawful basis for processing, we rely, as applicable, on providing the Service you request, legitimate interests such as security and service administration, legal obligations, and consent for processing that requires it. Withdrawing consent does not affect processing that was lawful before withdrawal.
Send requests to [email protected] from your registered email address when possible. We may use proportionate account-based checks to confirm you are authorized to make the request. Do not email identity-document scans or unnecessary sensitive material. We respond within the period required by applicable law and explain any applicable exception or extension.
11. Children
Rayeh is not designed as a children's service. Users must be legally able to undertake the activities described in the Service's terms and comply with applicable age and consent requirements. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate and take appropriate action. This policy does not claim that Rayeh performs age or identity verification.
12. Changes and contact
We may update this policy as the Service or its data practices change. We will update the date above and provide any additional notice or consent process required for material changes. This policy does not authorize new uses that require separate consent merely because it has been updated.
For privacy requests, complaints, security concerns or questions: