Your Privacy Matters

Who We Are

HifaTag is a smart QR tag recovery service operated as a sole trader business registered in Geelong, Victoria, Australia (ABN registered). We provide QR-based identification tags that help reunite lost items with their owners during Hajj, Umrah and everyday life.

If you have any questions about this policy, contact us at info@hifatag.com.

Information We Collect

We collect different types of information depending on how you use HifaTag:

Tag Owners (people who register a tag):

• First name and avatar/emoji
• Email address and password (stored securely via Firebase Authentication)
• WhatsApp number and Saudi number (if provided)
• Tag type (e.g. Passport Tag, Luggage Tag)
• Country of registration (detected via IP address at time of registration)

Finders (people who scan a tag):

• Message text (what they type)
• Contact details (optional — phone number or email, only if they choose to provide it)
• GPS location (optional, only if they grant permission)
• Photos of the found item (optional, up to 3 photos)
• Device user agent (for abuse prevention, truncated to 120 characters)

How We Use Your Information

• To connect finders with tag owners and reunite lost items
• To send email alerts to tag owners when their tag is scanned
• To display owner information (first name and tag type only) on the finder page
• To allow owners to manage their tags via the dashboard
• To detect country of registration for analytics and geo-pricing
• To prevent abuse through rate limiting (max 10 messages per tag per 24 hours)
• To monitor messages for safety and abuse purposes

What Finders See

When a finder scans a HifaTag, they see only:

• The owner's first name only (never surname, email or full contact details)
• The tag type (e.g. Passport Tag, Luggage Tag)
• Item photos uploaded by the owner (if any)
• The owner's Saudi number and/or WhatsApp — only if the owner has provided these during registration

Data Storage and Security

• All data is stored on Google Firebase in the australia-southeast1 region (Sydney, Australia)
• Passwords are hashed and managed by Firebase Authentication — we never store plain-text passwords
• Finder photos are automatically deleted after 3 days
• Owner photos are stored permanently until the owner deletes them
• All data is transmitted over HTTPS (TLS encryption)
• Firebase Storage and Firestore are secured with access rules

Third-Party Services

We use the following third-party services to operate HifaTag:

• Google Firebase — authentication, database, file storage
• EmailJS — sending email notifications to tag owners
• ipapi.co — country detection at time of registration (IP-based, no personal data stored by them beyond standard logs)
• Google Fonts — typography (DM Sans)

We do not sell, rent or share your personal information with any third party for marketing purposes.

Cookies and Local Storage

HifaTag uses browser localStorage (not cookies) for one purpose only: to enforce the rate limit of 10 finder messages per tag per 24 hours. This data stays on your device and is never transmitted to our servers.

We do not use advertising cookies, tracking pixels or any third-party analytics cookies.

Your Rights

As a tag owner, you have the right to:

• Access and update your personal information via the dashboard at any time
• Delete your account and associated data by contacting us at info@hifatag.com
• Update or remove your WhatsApp and Saudi number at any time

If you are in the European Union or UK, you may also have rights under GDPR including the right to erasure, portability and restriction of processing. Contact us to exercise these rights.

If you are in Australia, this policy is consistent with the Australian Privacy Act 1988 and the Australian Privacy Principles.

Message Monitoring

HifaTag reserves the right to monitor finder messages for safety, abuse prevention and legal compliance purposes. This is disclosed to finders on the finder page and to owners during registration.

We will cooperate with law enforcement requests where legally required.

Child ID Tags

HifaTag offers a Child ID Tag type designed for parents and guardians to register on behalf of their children. When registering a Child ID Tag, only the parent or guardian's contact details are stored — the child's personal information is not collected beyond what the parent voluntarily provides (such as the child's first name as the tag owner name).

Parents and guardians are responsible for ensuring the information they register is appropriate and accurate. If you wish to remove a child's tag registration, you can do so via the dashboard or by contacting us at info@hifatag.com.

Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects when the policy was last updated. Continued use of HifaTag after changes constitutes acceptance of the updated policy.