Last updated: 26 July 2026
Joba (Arabic: جوبا) — "we", "us", "our" — is a directory that connects people who need home services ("Consumers") with independent service providers ("Providers") in the Arab world. Joba is operated from Kuwait by its founder; a formal operating entity is being established and this policy will be updated with its details. This policy explains what personal data we handle, why, and your rights. It is written to align with GCC data-protection laws (the Saudi PDPL, the UAE PDPL, and applicable Kuwait rules).
One thing to understand first: Joba only connects you. Providers are independent; you deal and pay with each other directly, off the platform. We do not process payments between Consumers and Providers and never collect card or bank details for those transactions.
This policy covers the Joba website (https://jobaapp.com) and the Joba mobile
app.
Account and profile.
Sign-in (one-time codes). We use passwordless sign-in: you enter a phone number or email address and we send a short-lived one-time code (OTP) by SMS or email. We store the verified phone/email as your account identifier. We never see or store passwords.
Location. If you grant the app location permission (or the browser equivalent), we use your device's location at the moment you search to find providers near you. The coordinates are sent to our server to run that search. If you attach a location to a service request, it is stored with that request so the provider knows where the job is. Location access is while-in-use only — we do not track your location in the background and we do not build a movement history. You can always decline and choose a city manually instead; the service works without location.
Push notification tokens. If you enable notifications in the app, we store the device push token issued by Apple (APNs) or Google (FCM), the device platform, and when it was last seen, linked to your account. We use it only to deliver service notifications — above all, alerting a Provider that a new request arrived. Tokens are deleted when your account is deleted.
Service requests (leads). The category, note, city/location, and the contact details you choose to share when you contact a Provider, plus the request's status over time (viewed, responded, won/lost) and — if a Provider records it — an approximate job value. This is what powers each Provider's own statistics.
Reviews and content. Ratings, review text, and other content you post. Reviews are tied to a real contact request.
Analytics events. The app and website record product-usage events in our own database so we can understand whether the service actually works (do requests turn into jobs?). Each event stores the event name, a small set of properties, the page path, your interface language, the platform (web/app), and a timestamp. The current events are:
| Event | What is recorded | Why |
|---|---|---|
service_searched |
the search term or category chosen | which services people look for |
nearby_searched |
category and number of results | whether "near me" search finds providers |
provider_viewed |
the ID of the provider profile viewed | which profiles get attention |
lead_submitted |
provider ID and category | how many searches become contact requests |
availability_changed |
the provider's new status | how providers manage availability |
lead_status_changed |
lead ID and new status | whether providers respond to requests |
job_won |
lead ID and the job value the provider entered | whether requests become real jobs |
Analytics events do not contain your name, phone number, or message text. They are stored in our own database, are write-only from the apps, and are never sold or sent to an advertising network.
Advertising measurement (website only). When we are running search ads, the
Joba website loads Google's advertising tag (gtag.js) so we can tell
whether an ad click led to someone actually contacting a provider. It records
that a conversion happened, along with Google's own ad-click identifier and
cookies it sets in your browser. We do not pass it your name, phone number,
message text, or which provider you contacted. The Joba mobile app contains
no advertising or tracking SDKs at all. The tag is absent entirely when no
campaign is running, blocking it has no effect on using Joba, and you can turn
off ad personalisation in Google's own Ads Settings.
Device and technical data. Device type, app version, and basic logs needed to run and secure the service.
Legal bases: performance of our service to you; your consent (e.g. precise location, push notifications, marketing); and our legitimate interests (safety, fraud prevention, service improvement), as recognised under applicable GCC law.
With the Provider you contact: when you send a contact request, we share the details needed for the Provider to reach you (your name, phone number, your note, and the job location if you attached one). This is the core of the service — you are choosing to be contacted. Providers may not use your details for anything beyond responding to your request.
Service vendors (processors) acting on our instructions:
| Vendor | Role | Where |
|---|---|---|
| Supabase | database, authentication, and backend hosting | Frankfurt, Germany (EU) |
| Vercel | website hosting | global edge network |
| Apple (APNs) / Google (FCM) | push-notification delivery | per Apple/Google infrastructure |
| SMS/email delivery providers | delivering one-time sign-in codes | per provider infrastructure |
Legal and safety: where required by law, or to protect users' rights and safety.
We do not sell personal data. Apart from the website's advertising measurement tag described in section 1 — which tells Google that a conversion happened, and nothing about who you are — we do not share your data with advertising networks.
Our database and backend are hosted with Supabase in Frankfurt, Germany (European Union). This means your data is processed outside your country of residence. We rely on the safeguards required by applicable law for such transfers, including hosting in a jurisdiction with strong statutory data protection (the EU GDPR framework) and contractual commitments from our vendors.
We keep personal data only as long as needed for the purposes above and to meet legal obligations, then delete or anonymise it. In particular: one-time sign-in codes expire within minutes; push tokens are removed when the account is deleted; contact requests and their statuses are kept while the related accounts are active (they power Provider statistics); analytics events are retained for up to 24 months and are not tied to your name or phone number.
Subject to applicable law, you may request to access, correct, delete, or object to the processing of your data, and to withdraw consent (e.g. disable location or notifications in your device settings at any time). You can request deletion of your account and its data by contacting us; account deletion will also be available inside the app.
Contact azizal7seny@gmail.com — we respond within the period required by law.
We apply reasonable technical and organisational measures: encryption in transit, access controls, and row-level data isolation in our database so users can only read what they are entitled to. No system is perfectly secure.
The service is for users 18 years or older. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
We may update this policy and will post the new version here with a revised date. Material changes will be flagged in the app or on the site.
Questions or requests: azizal7seny@gmail.com — Joba (جوبا), Kuwait.
This policy is published in Arabic and English.