Who operates the app
E-Warzsh operates E-WARZSH, a football app for leagues, teams, matches, transfers and sports videos in Kurdistan. This notice describes the current account and service data handling.
Information collected
Account data includes your name, phone number, password hash, profile photo, account role, province, branch, area, account status and sign-in/session records. Team and player registrations can include team membership, address, occupation, year of birth and identity documents. Face verification stores a numerical face representation (embedding), model details, capture quality/liveness information and consent records. Notifications use device type and push tokens. The service also stores transfers, appeals, problem reports and notification history. Server logs record requests, IP addresses, timestamps, response status and processing times. These public information pages have no forms and do not collect support messages.
How information is used
We use account and verification information to register and authenticate users, manage profiles, check identity and manage access. Team/player information supports registration, team membership, league participation, matches and transfers. Contact details, device tokens and submitted messages support verification codes, notifications, account assistance, appeals and support. Request and administrative logs help operate, troubleshoot and protect the service.
What other users can see
Signed-in users can view team/player information provided by the app, including names, photos, roles, phone numbers, team membership, location and match information. Some team/personnel responses also include year of birth, address, occupation and document links. Administrators can access records according to their management permissions. Uploaded media and document links must not be treated as private messages or as visible only to the uploader; a person with a working direct link may be able to access the file.
Third-party services
Firebase Cloud Messaging receives device push tokens and notification content to deliver notifications. OTPiq receives phone numbers and verification codes to deliver WhatsApp verification messages. Hosting and network services process requests and store the service data. External video/stream providers receive requests when their content is played. First Iraqi Bank (FIB) is the payment integration associated with earlier transactions; its current app availability is described below. This notice does not assert that an unreviewed mobile SDK collects no additional data.
Identity and face verification
Profile photos and identity documents submitted separately are stored as uploaded files. Face verification uses the numerical face template and related information described below; matching is performed on our application server. Our backend does not send face embeddings to Firebase Cloud Messaging or OTPiq. Permanent administrative account deletion removes associated face-verification records from the active database. The current Profile Details account action deactivates the account and does not perform this deletion.
Face verification and face data
What we collect
When you use face verification, E-WARZSH processes camera frames on your device to detect your face, check head movements, and generate a numerical face template called a face embedding. We collect this template together with model information, liveness and capture-quality results, and your consent record. Camera frames from face verification are processed in memory and are not saved as photos or videos. Profile photos and identity documents submitted separately are not covered by this statement.
Why we use it
We use face data only to verify your identity and help prevent duplicate registrations in account, player, and team-related features. We do not use face data for advertising, marketing, or tracking.
Storage and sharing
Face-verification data is transmitted over HTTPS and stored in our backend database on servers located in Iraq. Delta Iraq provides the server hosting for our backend and database and processes this data in its hosting role. We do not sell face data or share it with third parties for their own purposes.
Retention and deletion
We retain face-verification data while your account remains active. The current account action in Profile Details deactivates your account and retains its face-verification data. Permanent account deletion performed by an administrator deletes associated face-verification data from our active database. Scheduled backups target approximately 14 days of retention, with cleanup dependent on successful backup jobs; older or manual copies may remain. We do not currently guarantee deletion from all backups within one day or by another fixed deadline. Uninstalling the app does not delete your account or its server records.
Payments
FIB payments are currently disabled in the app. Disabling payments does not erase earlier transaction records. Where earlier transactions exist, stored information can include phone number, payment identifier, amount, currency, payment status and time, payer name/IBAN and branch/area details. No automatic expiry is currently applied to these records.
Storage and security
Service records are stored in a hosted server database; uploaded photos/documents are stored in server file storage. Website/API connections use HTTPS. Passwords are stored as hashes rather than plain text. Protected API operations use access tokens, and administrator access uses permissions. Request limits and input validation help protect the service. These public pages do not create login sessions, set application cookies, or connect to the account database. These safeguards do not make publicly accessible file links private. No claim is made here that all stored files or backups are encrypted.
Retention
We retain face-verification data while your account remains active. The current account action in Profile Details deactivates your account and retains its face-verification data. Permanent account deletion performed by an administrator deletes associated face-verification data from our active database. Scheduled backups target approximately 14 days of retention, with cleanup dependent on successful backup jobs; older or manual copies may remain. We do not currently guarantee deletion from all backups within one day or by another fixed deadline. Uninstalling the app does not delete your account or its server records. Other account, profile, team/player, transfer, document, notification and earlier payment records have no uniform automatic deletion schedule. Permanent administrative deletion removes the records listed under Account deletion; uploaded files, earlier payments and logs are handled separately. Verification-code expiry does not itself delete verification history. Server logs follow log rotation rather than a uniform per-user deletion deadline. These informational pages do not store form submissions or use application cookies.
Account deletion
The current account action in Profile Details deactivates your account and matching team memberships and ends the active session. It retains personal data, including face-verification records. A separate administrator operation permanently deletes the account from the active database, together with associated face-verification records, matching team/personnel records, player transfers and team history, verification-code history, notification devices/history, problem reports, appeals and user-linked match details. Administrators must first reassign teams and league registrations and resolve or reassign pending transfer approvals where required. This operation does not remove uploaded photo/document files, earlier payment records, administrative/request logs or backup copies; these may remain under the retention rules in this privacy policy. This website provides information only and does not submit deletion requests. Uninstalling the app does not delete your account or its server records.
User choices
You can update supported profile details and your profile photo, change your password and sign out through the app’s account features. You can manage camera, photo-library and notification permissions through your device settings; refusing a permission may prevent the related feature from working. Sign-out and permission changes do not remove existing server records. Read the support and account-deletion pages for more information. Do not send passwords or identity documents in a support message.
Children’s privacy
E-WARZSH is intended for people aged 15 and older. Player-registration forms currently accept birth years corresponding to ages 12–99, which is a separate restriction from the app’s intended minimum age. General account signup does not currently collect a date of birth or automatically verify age. Data submitted by users aged 12–17 is handled by the same storage and retention processes described in this notice; no separate automatic minors-data deletion process is implemented. A verified parental-consent or underage-account removal procedure has not yet been established.
Policy updates
Effective date: 10 September 2026. Last updated: 20 October 2026. Changes to this notice will be published on this page with a revised last-updated date. This page does not promise individual email or in-app notification of every policy change.