Yak privacy policy

Last updated: 14 November 2026

1. Who we are

Yak is a service for businesses in Kuwait, with two separate services: the smart queue and the loyalty card. It is run by Adel Ben Asri, Kuwait ("Yak", "we").

This policy covers the Yak app for iPhone and iPad, its App Clip, and the Yak web pages at yak-kw.com that you reach by scanning a business's code.

Each business's customers' data belongs to that business. Yak runs the service and processes this data on the business's behalf, under a written agreement. This page explains what Yak does with it.

Questions about your privacy: yak@yak-kw.com.

3. What we collect, and how

We collect only what you give us and what the service needs to work.

When you take a turn in a queue

• Your turn: the business and branch, your number, and the times you joined, were called and finished.
• A name, only if the business has chosen to ask for one. Otherwise your turn is known by its number alone.
• Your language (Arabic or English).
• A random code that stands for your phone. On the web it is kept in a cookie. In the app it is kept on your phone. It lets the same phone get its turn back, and it stops one phone from filling a queue. The cookie stays in your browser for up to 13 months unless you clear it; the copy kept with your turn is emptied after 30 days.
• If you allow alerts: the address your phone or browser gives us for sending alerts. On an iPhone it comes from Apple. In a browser it comes from the browser's own alert service. An alert carries the business's name and your number, not your name.

When you get a loyalty card

• The name you type for the card. Any name will do, and it shows on your card.
• The card's number and its private link.
• Your balance and its history: points or stamps added, used, given as a gift or expired, with the date and the branch. When a cashier adds points, the bill amount they enter is kept with that entry.
• A one-way code made from your phone's random code. The phone's code can't be worked out from it. It gives each phone one card at a business: if you ask for a card again, you get your own card back. It is kept with the card until you delete the card or it is replaced, and in a holiday gift's records only until the gift ends, so the same phone doesn't get the same gift twice.

When you add your card to Apple Wallet or Google Wallet

• Apple Wallet: Apple gives us an identifier for your Wallet and an update address, so the card on your phone shows your new balance and the business's notices, such as points ending soon or a holiday gift.
• Google Wallet: we send Google your card's name, number, balance and scan code, and the business's messages, so Google can show the card. This happens only if you tap "Add to Google Wallet".

The nearby message

• A business can put a short message and its branches' locations on its loyalty card. If your card is in Apple Wallet, your iPhone compares its own location with those places, on the phone itself, and may show the message on the lock screen near a branch. Your phone decides when. Yak never receives your location.
• You can turn it off in the card's details in the Wallet app, or by turning off Location Services.
• The Yak app doesn't offer the nearby message yet. If it adds it later, we will update this page first.

When you scan a code

• The app uses the camera only to read the code. No picture or video is saved or sent.

Technical data

• When your phone connects, its internet address and its browser or device type reach Yak's server. We use the internet address briefly, in the server's memory only, to limit misuse. We don't store it with your turn or your card, and the server keeps no record of visits.
• Our web pages load their fonts from Google Fonts, so Google receives your internet address when a page opens.
• If you open an old Yak link or code at yak-kw.github.io, a page at GitHub sends you on to yak-kw.com, so GitHub receives your internet address.

Kept only on your phone

• The app's "My visits" list (links to your own turns and cards), and your language choice.
• On the web: your language, in a cookie for one year, and your card's link, in the browser's storage, so the card page can open your card again. The link is removed when you delete the card.
• None of this is sent to us as a list.

4. What we don't collect from customers

• No phone number, email address or home address.
• No location. The nearby message works on your phone alone.
• No contacts, photos or files.
• No payment card details. Yak takes no payments from customers.
• No advertising identifier, and nothing for advertising or tracking.

5. How we use it

We use your data only to run the service for the business you visit:

• to keep your place in the queue and show it to you and to the branch's staff
• to send the alerts you allowed, such as "You're next" and "It's your turn"
• to keep your loyalty balance, show it on your card, and apply the business's rules: expiry, holiday gifts and event designs
• to give each phone one card at a business
• to stop misuse, such as one phone taking many turns or a card being used too often
• to show the business its own totals, such as how many people waited and for how long

We don't use your data for advertising, and we don't build a profile of you.

6. Who can see it

The business you visit. Its staff see your number in the line, and the name you typed if the business asks for names. A cashier who scans your card sees its name, number and balance. Its managers see totals and can look up a card by its number. The business sets its own loyalty rules and messages, and it is responsible for its customers' data.

Yak. The people who run Yak reach the data only to run, support and fix the service.

Companies that help us run Yak. Each one receives only what its job needs, under its own privacy and security terms:

• DigitalOcean: runs Yak's server in Frankfurt, Germany, and keeps its daily backups.
• Google: keeps Yak's encrypted backup copy in Google Drive, which Google can't read because the key never reaches it. It also delivers alerts in Chrome and on Android, shows cards in Google Wallet when you add one, and serves the web pages' fonts.
• Apple: delivers alerts to iPhones, and updates cards in Apple Wallet.
• Other browser makers: deliver alerts in their own browsers.
• Cloudflare: holds Yak's domain name (yak-kw.com) and points your phone to its server's address. Your visits don't pass through Cloudflare.
• GitHub: hosts the old address yak-kw.github.io, which only sends visitors on to yak-kw.com.
• Let's Encrypt: issues the security certificate for yak-kw.com, and receives no customer data.

No one else. We don't sell, rent or trade your data. We disclose it only if Kuwaiti law requires us to.

7. Where it is kept

• Yak's server and its database run at DigitalOcean in Frankfurt, Germany (European Union).
• Backup copies: on the same server, in DigitalOcean's daily backups, as an encrypted copy in Yak's Google Drive on Google's servers, and as a copy on Yak's computer in Kuwait.

If that changes, we will update this page.

8. How long we keep it

• A name on a turn, and the copy of your phone's random code: emptied 30 days after the turn.
• Alert addresses: deleted a day after your turn ends, and after 30 days at the latest. The record of alerts sent is deleted after 30 days.
• The turn itself, without a name or code: kept, so the business can see its totals.
• Your loyalty card: kept while it is active. When you delete it, its name and the phone's code are erased at once, the card stops working, and your Wallet card is updated without the name (in Google Wallet it shows as inactive). Its number and past entries stay without a name. Your Apple Wallet identifiers are deleted 30 days after you delete the card.
• The phone's code in a holiday gift's records: erased when the gift ends.
• Technical logs about Wallet updates (Apple and Google): kept for 30 days.
• The record of what staff and managers did: kept while the business uses Yak.
• Backup copies: copies on the server are removed after 30 days, and names older than 30 days are emptied from them. DigitalOcean's daily backups are kept 7 days, and the Google Drive copy and the copy on Yak's computer are kept 30 days each. These copies aren't changed after they are made, so a name or a deleted card can stay in one of them for up to 30 days more, and then the whole copy is deleted.
• If a business closes its Yak account: its data is deleted within 30 days of its written request, except what the law requires keeping.

9. Your choices, and how to delete your data

• Use any name. Yak never asks for your real name.
• Leave a queue at any time with "Leave the queue".
• Delete your loyalty card with "Delete my card" on the card's screen. Its balance is lost, and it can't be undone.
• Turn alerts off in your phone's or browser's settings. Your turn still works, and you can watch it on the screen.
• Remove your card from Wallet in the Wallet app or Google Wallet.
• Clear the cookies and site data for Yak's pages in your browser's settings.
• Ask the business, or us. The business you visit is responsible for its customers' data. You can ask it, or write to yak@yak-kw.com, to see, correct or delete what Yak holds about you, or to withdraw a consent. Because Yak has no accounts, please include your card number or your turn's link so we can find it. We work on your request with the business, and answer within 30 days.

10. Children

Yak isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

11. Security

• All connections to Yak are encrypted.
• Your turn and your card open only through private links that can't be guessed.
• The code on your card is a scan-only code for the cashier. It doesn't open your card.
• Staff reach Yak only from devices the business has linked, each with their own PIN. Managers sign in with a password and can add a second step, which sending a holiday gift requires.
• Passwords and PINs are stored in a form that can't be read back.
• Each business's data is kept apart from every other business's.
• The backup copy that leaves the server for Google Drive is encrypted, and its key never reaches Google.

No system is perfectly safe. If a breach affects your data, we will tell the business, and tell you and the authorities as the law requires.

12. If you work at a business that uses Yak

We keep your name or username as the business entered it, your sign-in details in protected form (password or PIN, and a second-step secret if you turn it on), the browser and device type of linked devices, and a record of what you did in Yak and when, such as calling a turn, adding points or sending a gift. A sign-in cookie lasts 12 hours, and a linked device's cookie up to 13 months. The business you work for decides who has access.

If your business subscribes to Yak, we also keep its legal details, and a contact person's name, phone number and email, for the subscription and its printed forms.

13. Changes to this policy

When we change this policy we will put the new date at the top. If a change affects how we use your data, we will say so on this page before it takes effect.

14. Contact