TWAZ Privacy Policy

1. About this policy

The TWAZ app, its services and related websites (the "Services") are provided under the name تواز | TWAZ ("TWAZ", "we", "us"). This policy explains how we process personal data when you use the Services, and we are responsible for that processing. For any privacy matter, contact us at a@twaz.org.

2. Data that stays on your device

Many features of the Services work without an account. The personal finance information you enter or import, such as income, commitments, transactions and notes, is stored and processed on your device, and we do not receive it. Financial information you choose to share through the Services, such as a shared expense, is not part of this local data and is covered in Section 3. Messages you paste into the app or pass to it are read on your device, and their text is not sent to us. If you turn on backup, your data is encrypted on your device before it is stored in your own cloud account, and we cannot read it. If you choose to download an optional component, it may be delivered directly by a third-party provider, which receives the technical data needed to deliver it.

3. Data we process

We process the following data only when you use a feature that needs it:

• Account data: the identifier your sign-in provider gives us and an account reference. We do not ask the sign-in provider for your name or email address.
• Profile data you choose to provide, such as a username or display name, and your visibility settings.
• Content you share with others, such as shared expenses and their amounts, notes, images, invitations and payment requests, and the names of people you add.
• Safety data: blocks, reports and the measures we take to protect users and the Services.
• Communications: support requests and messages you send us, with basic app and device information.
• Notification data: a notification token for your device and your notification preferences, if you allow notifications.
• Technical data needed to deliver and secure the Services and to prevent abuse, such as your network address and app version.

We do not sell personal data, do not use third-party advertising or analytics tools, and do not track you across other companies' apps or websites.

4. How we use data and on what basis

We use personal data to:

• provide and operate the Services you request, under our agreement with you;
• provide optional features you turn on, such as being found by others, notifications, or offers and news, on the basis of your consent, which you may withdraw at any time in the app;
• keep users and the Services safe, prevent misuse and fraud, and enforce our Terms of Use, on the basis of our legitimate interests, without overriding your rights; and
• comply with our legal obligations.

5. Disclosure

We disclose personal data only:

• to other users, as you direct: members of a shared space see what is shared there; anyone holding a link you share sees the information in it; and if you make your profile discoverable, others can find it;
• to service providers that host, operate, secure or support the Services on our behalf, who must protect the data and use it only to provide their services to us;
• to platform providers, such as the provider of your device's operating system and app store, for sign-in, notifications, backup and app distribution, under their own terms;
• where required by law or by a competent authority, or where necessary to protect the rights, safety or security of users, TWAZ or others; and
• in a reorganisation, merger or transfer of the Services, subject to this policy and applicable law.

Our authorised personnel access personal data only as needed to operate the Services, provide support, protect users and comply with the law. They cannot access the financial data stored on your device.

6. Retention and deletion

We keep personal data for as long as needed for the purposes in this policy or as required by law. When it is no longer needed, we delete it or remove what identifies you.

You can request deletion of your account in the app. If you manage a shared space that other members still use, you will first need to hand it over to another member; if that is not possible, contact us. When your account is deleted, we delete or de-identify its personal data, except that:

• content you added to shared spaces stays there without your name, so that other members' records remain accurate; and
• we keep limited records, such as a record that the account existed and of measures taken to protect users, where needed for safety, preventing misuse, resolving disputes or meeting legal obligations.

Data on your device and in your own backup stays under your control until you delete it. Our retention periods are available on request.

7. Security

We use reasonable technical and organisational measures appropriate to the nature of the data, including encryption. No method of storage or transmission is completely secure. If a breach affects your personal data, we will notify the competent authority and you as required by law.

8. Your rights

Subject to applicable law, you have the right to:

• be informed about how your personal data is processed;
• access your personal data and obtain a copy of it;
• have it corrected, completed or updated;
• have it destroyed when it is no longer needed;
• withdraw your consent where processing is based on consent; and
• lodge a complaint with the Saudi Data and Artificial Intelligence Authority.

You can exercise many of these rights in the app, for example by editing your profile, deleting your account or deleting data on your device. Otherwise, contact us at a@twaz.org. We may ask you to confirm your identity, and we respond within the period set by law.

9. Children

Features that require an account or involve sharing with others are intended only for people aged 18 or older. If you believe a child has given us personal data, contact us so that we can take appropriate action.

10. Changes to this policy

We may update this policy when the Services or legal requirements change. We will publish the updated policy with its effective date and notify you of material changes as required by law.

11. Contact and language

For any question or request about this policy, contact us at a@twaz.org. This policy is published in Arabic and English; if the two differ, the Arabic text controls.