1. Who is responsible for your data
The NAWWIR app is operated by Xeplans, Inc., a company being registered in the United States ("we", "us"). Its registration number and registered address will be published here once registration completes. We are the data controller: we decide why and how your personal data is used.
For anything in this policy, including privacy requests: support@xeplans.com. We do not operate a telephone line; email is the way to reach us.
Our person responsible for personal data protection can be reached at the same address. Write "Privacy" in the subject line.
2. What we collect, and why
Every item below is either needed to run the app or optional and marked so. If you do not provide a required item, you cannot open an account; nothing else happens.
You give us:
| Data | Why we need it | Required? |
|---|---|---|
| Email address | To create your account and sign you in by emailed link or password. | Required |
| Password (if you set one) | A second way to sign in. Stored only as a one-way hash we cannot read. | Optional |
| Display name | Shown to other users so they know who they are meeting. | Required |
| Public username | A handle other users can recognise you by. | Optional |
| Gender (man / woman) | Some activities are for men only or women only; this decides which you can see and join. | Required |
| Year of birth | To confirm you are 18 or older and to show an approximate age. We never ask for your full date of birth. | Required |
| City | To show you activities in your city. | Required |
| Interests (from a fixed list of activity types) | To highlight activities you may like. | Optional |
| Language (Arabic or English) | To show the app and notifications in your language. | Required |
| Activities you post: title, type, time, end time, number of places, audience, age range, language, description, city, whether a waitlist or a join note is allowed, and any cancellation reason and note | To show them to other users and run the activity. | When you post |
| Meeting point of an activity you post, with the place's name and any directions note | To show the exact place to approved members and a blurred area to everyone else (section 3). | Optional |
| Notes you send with a join request | The host reads them before deciding. | When asked by the host |
| Messages in an activity chat | Delivered to the other members of that activity. | When you chat |
| Whether you turned up | Hosts mark who attended. Your counts of attended and missed activities are shown on your profile (section 4). | Automatic |
| Reports you file, and the reason and details you give | To review and act on safety problems. | When you report |
| People you block | To hide you from each other. | When you block |
| Notification preferences | To send only the notifications you asked for. | Optional |
| Your consent records | Proof of which version of the rules and this policy you accepted, and when. Required by law. | Automatic |
Your device gives us:
| Data | Why | Required? |
|---|---|---|
| Push notification token | To deliver notifications to this phone. | Only if you allow notifications |
| Your location, only at the moment you tap "use my current position" | To set the meeting point of an activity you are posting, or to work out roughly how far activities are from you. | Only if you allow location |
| A coarse "home area" (rounded to about one kilometre), saved once you allow location | So notifications about new activities can respect the distance you chose. Visible only to you. | Only if you allow location |
| Platform (iOS or Android) | To deliver notifications correctly. | Automatic |
| Crash and error reports: what failed, phone model, operating system version, a random installation id | To find and fix faults. Never contains your name, email or account id. | Automatic |
| Update check: operating system and a random token | To fetch app updates from our update service. | Automatic |
We do not collect: your contacts, your photo library, your precise continuous location, your movements in the background, your browsing on other apps or sites, advertising identifiers, or any payment details. The app is free. This version of the app has no profile photo or image upload; if we add one, this policy will be updated first.
We collect no sensitive data as defined by PDPL: nothing about ethnic origin, religious, intellectual or political belief, health, biometrics, genetics, credit or criminal history. Please do not put such information in your profile, activity descriptions or messages.
3. How your location is used
This matters, so it is spelled out.
- We read your device location only when you ask us to, by tapping "use my
current position". We never track you in the background.
- When you set an activity's meeting point, the exact point is stored
restricted: the server shows it only to you and to people you have approved.
- Everyone else sees a deliberately blurred point, roughly one kilometre
wide, plus the area name you typed.
- Your coarse home area (about one kilometre) is visible only to you and is used
only to decide which "new activity" notifications you receive.
- Venue events are the exception: a business posting a public event has a
public address, by design.
- The map is drawn from map tiles fetched from OpenFreeMap. That service keeps
no user database and sets no cookies, and receives no identifier from us; like any web request, it sees your device's network address while tiles load.
4. Who can see what
Visible to any signed-in user
- Display name, username, approximate age, gender, interests
- The activities you post and their area
- Whether an activity is full
- Your counts of activities attended, activities missed, and activities hosted
Visible only to you
- Email address, whether you have set a password
- City, language, notification preferences and coarse home area
- Your blocked list and your consent records
- Whether your account is suspended
- The reports you have filed
Visible only to the host and approved members of an activity
- The exact meeting point, its name and directions note (for a venue event the
address is public, section 3)
- Chat messages
- Who else is going
Visible only to us
- Reports filed about you, including who filed them. The person reported never
learns who reported them.
- Moderation decisions, notes and the evidence the moderator saw.
Your email address is never shown to other users. Before a host approves you, other people can see only *how many* people are going, never who.
5. Why we are allowed to use your data (legal basis)
PDPL requires a legal basis for every use. Ours are:
- Performing our agreement with you (Article 6(2)): running your account,
showing activities, delivering messages and notifications you asked for, recording attendance and reliability counts.
- Your consent (Article 5): reading your device location, and receiving
push notifications. You can withdraw either at any time in your phone's settings, or notifications in the app's Notification preferences. Withdrawing does not affect anything already done.
- Our legitimate interests (Article 6(4)): keeping the app safe and lawful,
reviewing reports, suspending abusive accounts, keeping a record of safety decisions, preventing fraud and fixing faults. We have assessed that these interests do not override your rights, and we never use this basis for sensitive data.
- A legal obligation: where Saudi law or a competent authority requires us
to keep, disclose or act on data.
Consent is never a condition of using the app, except where the feature literally needs it (a map pin needs your position).
6. Who else processes your data
These providers process data on our written instructions and may not use it for their own purposes.
| Provider | What they do | Where the data is | Terms |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in, sending sign-in emails, server code | Frankfurt, Germany | Data Processing Addendum, includes EU standard contractual clauses |
| Expo (650 Industries, Inc.) | Delivers push notifications and app updates. Holds your push token; deletes each notification once handed to Google or Apple | United States | Privacy policy; Data Privacy Framework |
| Google LLC — Firebase Crashlytics | Receives crash and error reports (no name, email or account id) | United States | Google data processing terms; Google begins deleting after 90 days |
| Google LLC — Firebase Cloud Messaging (Android) and Apple Inc. — Push Notification service (iOS) | Carry each notification to your phone. The notification text passes through them. | United States | Their platform terms |
| OpenFreeMap | Serves the map tiles | Europe | No accounts, no cookies, no user database |
| Zoho Corporation | Hosts the support@xeplans.com mailbox that receives your emails | United States | Zoho terms |
We never sell your personal data. We never share it for advertising. We use no analytics or advertising SDKs.
We disclose data outside this list only when Saudi law or a competent authority requires it, or when it is necessary to protect someone's life or safety. Where a venue publishes a public event, the venue sees the same about attendees as any host sees about approved members (section 4).
7. Your data leaves Saudi Arabia
Our database is in Germany. Notifications, updates and crash reports run through the United States. PDPL (Article 29) allows this where it is necessary to perform our agreement with you, the transfer is limited to what is needed, and safeguards give your data protection no lower than PDPL requires. We rely on contractual safeguards with each provider and on a written transfer risk assessment that we keep and can show to the Saudi Data & Artificial Intelligence Authority (SDAIA) on request.
Your consent is not the basis for these transfers, and we will not ask you to tick a box to "allow" them. This section is the disclosure PDPL requires.
8. How long we keep it, and how it is destroyed
| Data | Kept until | Then |
|---|---|---|
| Account, profile, settings, consent records, blocked list | You delete your account | Deleted from the live database at once; disappears from backup copies on the next backup cycle, within 30 days |
| Activities you host, and their chats | You delete the activity or your account | Deleted at once |
| Your messages in other people's activities | You delete your account, or the host deletes the activity | Deleted at once |
| Attendance record and reliability counts | You delete your account | Deleted at once |
| Push token | You sign out or delete your account | Deleted at once |
| Coarse home area | You delete your account | Deleted at once |
| Reports you file or that are filed about you, including any quoted message text | 12 months after the report is closed | Deleted; a record of the decision remains (next row) |
| Moderation decision record (which account, what was decided, when, by whom, the moderator's note, and a copy of the message or text the moderator acted on) | Up to 5 years after the decision | Deleted |
| Crash and error reports (at Google) | 90 days | Google begins removing them from its live and backup systems |
| Emails you send to support | 24 months after your request is closed | Deleted from the mailbox |
Why safety records outlive an account. If a report vanished when the reported account was deleted, a person reported for harassment could erase the record by deleting their account and signing up again. When an account is deleted, reports about it are unlinked from the deleted profile: the name and profile are gone, and only an internal reference number, the report text and the decision remain for the periods above. The reference lets us recognise a repeat pattern; it is not shown to anyone and cannot be used inside the app to find a person. This is our legitimate interest in protecting other users (section 5), and it is the only data that survives account deletion.
Destruction means the data is removed so that it cannot be read or recovered and the person can no longer be identified from it.
9. Your rights
Under PDPL you have the right to:
- be informed about how we use your data — this policy;
- access your data and receive a copy in a clear, readable form, free of
charge;
- correct inaccurate or incomplete data — most of your profile you can edit
yourself in the app;
- request destruction of data we no longer need;
- withdraw consent for location or notifications at any time;
- complain to SDAIA if you believe we have mishandled your data.
To exercise a right, email support@xeplans.com from the address on your account. We reply within 30 days. If a request is unusually complex we may take up to 30 more days and will tell you why. We may ask you to confirm it is you, so that nobody can obtain or delete somebody else's data.
We make no decisions about you by automated means that have a legal or similarly significant effect. Suspensions are decided by a person.
10. Deleting your account
You can delete your account permanently:
- In the app: Profile → Settings → Delete my account, then type DELETE.
- On the web: xeplans.com/nawwir/delete-account
- By email: support@xeplans.com from the account's address, subject
"Delete my account". Completed within 30 days, normally much sooner.
Deletion is immediate and cannot be undone. It removes your sign-in record, profile, settings, consent records, push tokens, coarse home area, the activities you host, your memberships and requests, your messages, your attendance record and your block list. Safety records are handled as described in section 8. People who attended activities with you keep their own counts.
11. Security
Access rules are enforced inside the database itself, not only in the app, so data you may not see is data the server will not send, even to a modified copy of the app. Traffic is encrypted in transit and the database is encrypted at rest by our hosting provider. Passwords are stored only as one-way hashes. Moderation records cannot be read or changed from the app by anyone. No system is perfectly secure, and we do not claim otherwise.
If a personal data breach occurs, we will notify SDAIA within 72 hours of becoming aware of it, and we will notify you without undue delay if the breach could harm you or your data, as the Implementing Regulations require.
12. Children
NAWWIR is for adults aged 18 and over. Your year of birth is checked when you sign up, and you also declare that you are 18 or older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete the account and its data. If you believe a person under 18 is using the app, write to support@xeplans.com with the subject "Child safety". Our child safety standards are published at xeplans.com/nawwir/child-safety.
13. If you are outside Saudi Arabia
NAWWIR is currently offered in the Kingdom of Saudi Arabia. If we make the app available where you live, this section applies in addition to the rest of this policy, and where your local law gives you stronger rights than PDPL, you have them.
European Economic Area, United Kingdom and Switzerland. Our legal bases under GDPR / UK GDPR are: performance of a contract (Article 6(1)(b)), consent (6(1)(a)) for location and notifications, legitimate interests (6(1)(f)) for safety, moderation and fault-fixing, and legal obligation (6(1)(c)). You also have the rights to restrict processing, to data portability, and to object to processing based on legitimate interests, and the right to lodge a complaint with your local supervisory authority. Your data is stored in Germany; our access to it from Saudi Arabia, and processing by US providers, rely on the safeguards in section 6. We have not appointed an EU or UK representative because the app is not yet offered there; we will before it is.
United States. We do not sell or share personal information for cross-context behavioural advertising, and we do not use your data for targeted advertising. We honour access, deletion and correction requests from residents of any state under the procedure in section 9.
Everywhere else. We honour the rights your local data protection law gives you, through the same contact. The age of use is 18 or the age of majority where you live, whichever is higher.
14. Changes to this policy
If we change this policy in a way that matters — new data, a new recipient, a new purpose, a changed retention period — we will show you the new version in the app and ask you to accept it before you continue. Smaller changes are noted by the date at the top. Earlier versions you accepted remain visible in Settings → What you agreed to.
15. Contact
support@xeplans.com Xeplans, Inc. — registration in the United States pending; registration number and registered address published here once it completes — xeplans.com