Privacy policy

Version dated 05/10/2026

Massatir is an independent app: it is neither published nor endorsed by the Moroccan administration. The information comes from official sources cited on each page.

In short

• Outside the forum, what you enter in Massatir stays on your phone. The community forum (optional) is the only feature that uses an account and a server: see “Community forum”.
• No usage statistics, no trackers, no automatic error reports. Business ads in the Bon plan tab are shown without any tracking.
• Outside the forum, only public files are downloaded (exchange rates), through simple read requests that contain no data about you.
• You can erase everything at any time: Settings > Erase my data.

Who is responsible

Data controller and publisher: Gerens Labs (Samir KEBIR), 6 rue Gisele Halimi, 59150 Wattrelos, France, tel. 06 52 71 51 29. Contact: massatir.ma@gmail.com.

What is stored on your phone

To work offline, Massatir stores this information in the app’s private space, on your device only:

• the language you chose and your settings (theme, text size, vibrations, background flag, “unofficial rates” option, onboarding already seen);
• your favorites (pinned tools and procedures);
• your recent searches in procedures, useful addresses and key links (the text typed, only a few entries, can be erased);
• your documents: title, expiry date, reminder lead times and, if you fill them in, a note and a file reference;
• the items you tick for each procedure;
• your city, if you choose or enter it;
• the drafts of the tools (calculations, dates, passport, CV, letters), including what you write in the CV (name, contact details, career) until you reset it;
• your progress in the step-by-step guides;
• the latest exchange rates downloaded (public data);
• reminders: they are scheduled by your phone (local notifications), without going through a server;
• the documents in your vault, if you add any (see “Document vault”): encrypted files.

Protection of this data

Except for the document vault (see below), Massatir does not encrypt this data itself: it is protected by your phone’s system (app isolation, lock code). Use a lock code and do not write passwords or bank card numbers in the notes.

On Android, the app disables the automatic backup of its data. On iPhone, depending on your settings, system backups (iCloud or computer) may include app data.

Document vault

• Optional: you can store in the vault photos and PDFs of your important documents (ID card, passport, certificates, contracts, prescriptions…), with a name, a category and a note. Nothing is added without your action.
• Encryption: each file and the list of documents are encrypted on your phone (XChaCha20-Poly1305) with a random 256-bit key, kept only in the device’s secure keychain (Keychain on iPhone, Keystore on Android), tied to this device and excluded from backups.
• Access: Face ID, fingerprint or phone passcode each time you open it, and again after 60 seconds in the background. Massatir neither reads nor keeps your biometric data: the system does the verification. Screenshots are blocked in the vault where the system allows it.
• Nothing leaves the phone: no upload, no synchronization, no analysis. The only exception: when you tap “Share” for a document, a temporary decrypted copy is handed to the app you choose, then deleted.
• Unrecoverable key: the vault cannot be restored on a new phone, after a device reset or if you remove the lock code, and nobody, Massatir included, can decrypt it for you. Keep your originals. The vault is never included in “Export my data”.

Community forum

The forum is optional: you can read the questions without an account. To ask a question, reply, vote or report, you create an account with your email address and a username. This is the only Massatir feature that sends data about you to a server.

• Data processed: your email address (to send you the sign-in code; it is never shown to other members), your username, your questions, replies, votes, reports and blocks, your reviews of the Bon plan professionals (stars and text), your souk proposals, the date you accepted the charter and any moderation sanctions. If you edit a message, the previous version is kept for 12 months for moderation. No real name, phone number, location, contacts or photo is requested.
• What others see: your username and your messages, publicly, with the label “User content — unofficial”. Do not put contact details, documents or information that identifies you: the app rejects phone numbers, email addresses and most links.
• Hosting: the forum uses a Supabase server (database and authentication) at rgtrwjdcczjmbyzpnytj.supabase.co, hosting region: Allemagne (Francfort), pays reconnu par la CNDP (délibération n° 236-2015). Supabase acts as a technical processor. Like any server, it sees the IP address of your connection and the technical information of a request, and its logs are kept according to the host’s policy. The email containing the sign-in code is sent by the sending service configured by the publisher.
• On your phone: the sign-in session is kept in the device’s secure keychain (Keychain on iPhone, Keystore on Android); the latest lists of questions read are kept in cache for offline reading.
• Bon plan: the Bon plan tab shows ads paid for by merchants, craftspeople and restaurants, marked “Ad” or “Sponsored”. Massatir sells nothing and handles no payment; the professionals have no access to your data and can neither edit nor delete your reviews. Your reviews (stars, text) are public with your username. The professionals’ photos and contact details are loaded from the same server as the forum, which therefore sees the IP address of your connection.
• Souks: the Souks section lists souks by city. The names and cities come, where indicated, from the website of the Moroccan National Tourist Office (ONMT); the days and opening hours are proposed by members, checked by moderation and shown as unofficial. If you propose a souk, your member identifier is kept with the proposal while it is pending; once published, the information is public without your username.
• Private messages: a member can write privately to another member (a conversation between two people); the first message is a request that the person can accept, decline or block, and nothing else reaches them until they accept. These messages are stored on the forum server, are visible only to the two people, and go through the same automatic filter as the forum. Each person can report a received message or block the other. The moderation team only reads a conversation if a message in it is reported; the administrator may consult a conversation to keep the service safe. Every consultation by the team is recorded in a log. “@handle” tags (three at most per message) are used to mention a member in the forum.
• Moderation: an automatic filter rejects insults, threats, personal contact details and unofficial links; each member can report a message or block a member; the moderation team reviews reports and may hide or remove content, warn or suspend an account. To handle an abuse, it may view the reported content and the email address of the account concerned. These actions are logged. When the server rejects a message (insult, number, unofficial link), an excerpt of at most 300 characters, the reason and your username are kept for 30 days in a log reserved for the moderation team, to spot repeated abuse.
• Retention: your account and your content are kept until you delete your account. Settings > Forum > Delete my account erases your account, your username, your email address, your votes and your blocks, deletes your replies and your questions that received no reply, and anonymizes (“Deleted user”) your questions that have already received replies. The host’s backups may keep this data for a few days.
• Settings > Erase my data removes the forum session and cache from this phone, but does not delete your online account: use “Delete my account”.
• Your rights (access, rectification, deletion, objection): exercise them in the app (account deletion, username change) or by writing to massatir.ma@gmail.com.
• Legal framework: this processing falls under law no. 09-08 on the protection of individuals with regard to the processing of personal data (Morocco). The formalities with the CNDP (declaration or authorization, including for hosting outside Morocco) must be completed by the publisher before the forum opens.
• The forum is reserved for people aged 16 and over.

What Massatir does not collect

• no account, name, email or phone number, unless you create a forum account (see “Community forum”) or write it yourself in your CV or letters (this stays on the device);
• no advertising identifier and no ad network (business ads in the Bon plan tab are published by the publisher, without tracking);
• no analytics tool or usage statistics;
• no location recorded or transmitted: your location is read only if you tap “Near me”, only on your phone (see “Permissions requested”);
• no access to your contacts or your microphone; the camera and your photos are used only when you yourself add or scan a document (vault, My papers); a document’s text is read on your phone.

Permissions requested

• Notifications: requested only when you turn on reminders for your documents. You can refuse it or withdraw it in the phone’s settings; the app remains usable.
• Location (optional): requested only when you tap “Near me” in useful addresses, after an explanation on screen. It is the “while using the app” permission (never in the background), and an approximate location is enough (on Android, the app requests only approximate location). It is used only to calculate, on your phone, the distance to the addresses that have official coordinates (post offices) and to estimate your city; it stays in memory while the screen is open, is neither stored, nor sent, nor shared, and does not enter backups or reports. You can refuse it: you then choose your city, and the list is sorted by name. You can withdraw it at any time in the phone’s settings (Settings > Location shows its status).
• Prayer times: “My position” reads an approximate position once, when you tap, and rounds it to 0.1° (about 10 km). This rounded place stays on your phone to compute the times and is erased by “Erase my data”. Outside Morocco, it is sent once to your phone’s maps service (Apple Maps on iPhone, Google on Android) to display the city name; Massatir and its publisher do not receive it.
• Sending an application: “Apply with my CV and letter” opens your phone’s mail app with the recipient, subject, message and the documents you ticked in your vault, decrypted into a temporary file that is deleted afterwards. The message is sent from your own mail app: Massatir receives neither the message nor the attachments.
• Camera (optional): requested only when you tap “Take a photo” or “Scan” to add a document to the vault or read an ID document. The text is read on the phone, offline; the photo is encrypted in the vault and stays on the device. Only the photos you choose from your library are read.
• Face ID / fingerprint: used only to open the vault, with the phone passcode as a fallback. No biometric data is read or kept by the app.
• On Android, the app also declares the technical permissions for Internet access, vibration, restart (so that scheduled reminders survive a phone restart), camera and biometric identification. No other permission is requested.

Network connections

Apart from these cases, the app works without a connection. Here is everything the app can download by itself:

• Currency converter: when you open the tool, the app may download, automatically at most once a day per source (and each time you request a refresh), the rates of Bank Al-Maghrib (www.bkam.ma) and the reference rate of the European Central Bank (www.ecb.europa.eu). If the address of a Bank Al-Maghrib file has changed, it re-reads the corresponding public page of the same site.
• Only if you turn on “Include unofficial rates” in Settings (off by default): indicative rates from a free third-party public provider, via cdn.jsdelivr.net or latest.currency-api.pages.dev.
• Data updates: the feature exists in the code but is inactive in this version (no server is configured): the app then contacts no server of this kind. If it is enabled in a future version, this policy will say so.
• Community forum (only if you open the Forum tab or the “Community questions” area of a page): the app reads the questions and then, if you sign in, sends your email, your username and your messages to the server rgtrwjdcczjmbyzpnytj.supabase.co. See “Community forum”.
• Outside the forum, these requests are simple reads of public files. The app attaches no account, identifier or personal data to them.
• As with any Internet connection, the server hosting a file sees the IP address of your connection and the usual technical information of a request (time, type of network software). These servers belong to third parties, who apply their own policies; Massatir has no access to them.

Links, maps, calls and sharing

These actions go outside the app and happen only when you trigger them:

• Opening an official link, a map or a route opens your browser or your maps app (Maps, Google Maps). The app passes only the link address and, for a map, the coordinates or address of the place you are viewing, never your location. The site or app opened applies its own policy (a maps app may, depending on its own settings, use your location to calculate a route).
• Calling a number opens the phone’s dialer.
• Sharing a page, an address, a list of documents, a CV, a letter or a backup opens your phone’s share sheet, or WhatsApp if it is installed, with a ready-to-send text. Nothing is sent until you confirm in the chosen app; the recipient receives this text.
• Reporting an error opens your email app (if an address is configured) or the share sheet, with a message containing the page identifier and title, the problem chosen, your optional text, the data and app versions, and the language. You send this message yourself.
• PDFs (CV, letters) are produced on your phone, then shared by you.
• The backup export produces a text (documents, ticked items, favorites, settings, never the vault) that you copy or share: it contains your information, keep it in a safe place. The import reads the clipboard only when you tap “Paste”.

Sharing with third parties

Massatir does not sell, rent or pass on any data to third parties for commercial purposes. The only information that leaves the device is what is described in “Network connections”, “Links, maps, calls and sharing” and, if you use the forum, “Community forum” (your messages are public there, under your username).

Retention, erasure and your rights

• Your data stays on your phone until you delete it or uninstall the app.
• Settings > Erase my data deletes the documents, ticked items, favorites, city, drafts, recent searches, guide progress, saved rates and settings, erases the document vault and its encryption key, and cancels scheduled reminders. You can also delete a document, clear the search history or remove your city separately. Uninstalling the app also deletes its data.
• Outside the forum, Massatir has no access to any of your data: it can neither view nor correct it remotely; you view, edit, export (Settings > Export my data) and delete it yourself, directly in the app. Forum data is also managed in the app (Settings > Forum): see “Community forum”.
• For any question about this policy: massatir.ma@gmail.com.

Children

Massatir is an administrative information app intended for a general audience. The forum is reserved for people aged 16 and over. Outside the forum, it collects data about no user, including children. Parents can delete the local data as described above.

Changes to this policy

This policy describes the current version of the app, forum included. If a new feature that collects or sends data is added (for example an online backup), this policy will be updated before it goes live, and the necessary steps with the National Commission for the Control of Personal Data Protection (CNDP, law no. 09-08) will be examined.

The version date appears at the top of the screen. Important changes are flagged in the app.

Contact

massatir.ma@gmail.com