Privacy Policy - Rruga e Barrikadave

1. Introduction

The Socialist Party of Albania ("we", "our", "the organization") operates the mobile application "Rruga e Barrikadave" ("the App"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the App.

By installing or using the App, you agree to the practices described in this policy. If you do not agree with this policy, please do not use the App.

Effective date: March 20, 2026

2. Data We Collect

2.1 Data you provide directly

Account information: First name, last name, email address, phone number, position, and your role within the organization.
Access credentials: Password (stored only in encrypted form).
User-generated content: Posts, text, photos, videos, and documents you upload to the platform.
Profile photo: The avatar image you choose for your profile.

2.2 Data collected automatically

Device tokens: Firebase Cloud Messaging (FCM) tokens for delivering push notifications.
Device information: Device type, operating system, app version.
Usage data: Access time, actions within the app, and pages visited.
IP address: For security purposes and session management.

2.3 Data we do NOT collect

We do not collect location data (GPS).
We do not access your contacts, calendar, or messages.
We do not use tracking cookies or third-party analytics.
We do not collect financial data or credit card information.

3. How We Use Your Data

Your data is used only for the following purposes:

Purpose	Legal Basis
Providing and maintaining the service	Contract performance
Authentication and access management	Contract performance
Sending push notifications for new posts and urgent alerts	Legitimate interest
Distributing news based on geographic zones and topics you follow	Legitimate interest
Improving the security and performance of the app	Legitimate interest
Communicating with you about account matters	Contract performance

4. Third-Party Data Sharing

We do not sell, trade, or rent your personal data. Data is shared only with the following services, solely as necessary for the operation of the App:

Service Provider	Purpose	Data Shared
Google Firebase (FCM)	Delivering push notifications	Device tokens
Amazon Web Services (S3)	Media file storage	Uploaded photos, videos, and documents

We may also share data when:

Required by law, court order, or official request from authorities.
Necessary to protect the rights, property, or safety of the organization.

5. Data Storage and Security

5.1 Where data is stored

Your data is stored on secure servers. Media files are stored on Amazon S3. Data in transit is protected with TLS/HTTPS encryption.

5.2 Security measures

Password encryption: Your password is never stored in plain text; bcrypt hashing is used.
Time-limited tokens: Access tokens (JWT) expire after 15 minutes; refresh tokens expire after 7 days.
HTTPS/TLS: All communications between the app and server are encrypted.
CORS protection: API access is restricted to authorized origins only.
Rate limiting: Login attempts are limited to prevent brute-force attacks.
HTTP security headers: Additional protection against common web attacks via Helmet.

5.3 Data retention

Your personal data is retained for as long as necessary to provide the service. After account closure or deletion, personal data is removed within 30 days. User-generated content may be retained in anonymized form for archival purposes.

6. Your Rights

You have the following rights regarding your personal data:

Right of access: Request a copy of the data we hold about you.
Right to rectification: Request correction of inaccurate data.
Right to erasure: Request deletion of your personal data.
Right to restriction: Request restriction of processing of your data.
Right to object: Object to the processing of your data for certain purposes.

To exercise these rights, contact us at info@ps.al.

7. Data Deletion

You have the right to request complete deletion of your personal data at any time.

How to request deletion

Send an email to info@ps.al with the subject line "Data Deletion Request".
Include your full name and the email address associated with your account.
Alternatively, contact the platform administrator directly.

Data that will be deleted

Account information (name, email, phone number, avatar).
Device tokens for push notifications.
Notification preferences and followed zones/topics.
Access session history.
Media files uploaded by you.

Data that may be retained

Posts and content you created may be retained in anonymized form (with no link to your identity) for archival purposes, in accordance with the organization's internal policies.

Processing time

Deletion requests are processed within 30 days of receipt. You will be notified by email when the process is complete.

8. Push Notifications

The App uses Firebase Cloud Messaging (FCM) to send push notifications. These notifications include:

New posts in zones or topics you follow.
High-priority urgent alerts.
System notifications about your account.

You can disable push notifications at any time from your device settings.

9. Cookies and Tokens

The mobile App does not use cookies. For authentication, JWT (JSON Web Tokens) are used and stored securely on your device. These tokens are used solely to verify your identity and expire automatically.

We do not use any tracking or advertising technology.

10. Children's Privacy

The App is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. For significant changes, you will be notified through the App.

We encourage you to review this policy periodically.