Privacy Policy

Jibha is a parcel delivery platform operating in Tunisia. We connect people and businesses sending parcels (senders) with independent couriers who carry them. This policy covers the Jibha customer app, the Jibha courier app, and jibhadelivery.com.

It is written to be read, not to be survived. Where a section describes something you would reasonably object to, it says so plainly rather than burying it.

Everything below is collected because a delivery cannot happen without it. We do not sell personal data, and we do not use it for advertising.

Location is the most sensitive thing we handle, so it gets its own section.

• If you are a sender, we read your device location once, when you are choosing a pickup or drop-off point, and only if you grant the permission. You can decline and place the pin by hand instead — the app works fully without location access.
• If you are a courier, we record your location continuously while you are online, including when the app is in the background and the screen is off. This is the job: dispatch cannot offer you work it does not know you are near, and a sender watching a map needs the pin to move. A persistent notification is shown the entire time this is happening, and it stops the moment you go offline.
• We do not track couriers when they are offline, and we never track senders in the background.
• A sender following an active delivery sees the assigned courier's live position. A courier sees the pickup and drop-off points of jobs offered to them.

When you book a delivery you give us the recipient's name and phone number. That person is usually not a Jibha user and has not agreed to anything with us. We use their details only to complete that one delivery — to let the courier announce arrival and confirm the handover.

We never read your address book. The details come from what you type, or from your device's own contact picker, which hands us the one contact you select and nothing else.

By entering someone else's details you confirm you are entitled to share them for this purpose. If you are that recipient and want your details removed, contact us and we will remove them once the delivery is closed.

Two groups: the other party to your delivery, and the service providers we use to run the platform.

The other party sees only what the delivery requires. A courier sees the sender's name, phone, and the two addresses. A sender sees the courier's name, photo, vehicle, rating, and live position while the delivery is active. Neither sees the other's identity documents, order history, or payment details.

We also disclose data where the law requires it — a court order, a criminal investigation, or a regulator acting within its powers.

• Account details: for as long as your account exists.
• Orders, fares and payment records: retained after account deletion where accounting and tax law requires it, and for resolving disputes about a completed delivery.
• Courier location history: kept for operational review and pay settlement, then deleted.
• Courier identity documents: kept while the courier is active on the platform, and for the period afterwards that verification obligations require.
• Photographs of parcels and proof of delivery: kept for the dispute window on that order.
• One-time sign-in codes: minutes. Session tokens: until you sign out or they expire.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it.

Deletion is built into both apps and does not require contacting anyone: open Account, then Delete account. This marks the account deleted, ends every session on every device, and removes your personal details. Records we are legally required to retain — principally financial records of completed deliveries — survive in a form that is no longer linked to your profile.

You can also withdraw a permission at any time in your device settings. Withdrawing location permission stops that collection; for a courier it also means you can no longer go online, because the job cannot be performed without it.

There is also a dedicated page at jibhadelivery.com/data-deletion, which explains the same thing for anyone who has already removed the app and cannot reach the in-app screen.

All traffic between the apps and our servers is encrypted in transit. Session tokens are held in the operating system's hardware-backed secure storage — the Android Keystore — and are not included in device backups, which is why signing in again is required on a new device. Identity documents and delivery photographs are stored in private object storage and are reachable only through short-lived, signed links.

Jibha is not intended for anyone under 18, and we do not knowingly collect data from children. Courier accounts require identity verification. If you believe a child has created an account, contact us and we will remove it.

If we change this policy materially we will say so in the app before the change takes effect. The date at the top of this page always reflects the current version.

For any question about this policy, or to make a data request, contact Jibha support on the number shown in the app under Account → Support, or by email at privacy@jibhadelivery.com.