TWAZ Privacy Policy

1. About this policy

The TWAZ app, its services and related websites (the "Services") are provided under the name تواز | TWAZ ("TWAZ", "we", "us"). This policy explains how we process personal data when you use the Services, and we are responsible for that processing. For any privacy matter, contact us at a@twaz.org.

2. Data that stays on your device

Many features of the Services work without an account. The personal information you enter or import, such as income, commitments, transactions and notes, and your tasks, countdowns, habits and focus sessions, is stored and processed on your device, and we do not receive it. Information you choose to share through the Services, such as a shared expense or a task or countdown you share with friends, is not part of this local data and is covered in Section 3. Messages you paste into the app or pass to it are read on your device, and their text is not sent to us. If you turn on sync or backup in Data & Sync, this data is encrypted on your device before it is stored in your own cloud account, from where it reaches your other devices that use the same cloud account; we cannot read it. The cloud account's provider (Apple, for iCloud) stores this encrypted data in its own or third-party data centres, which may be outside Saudi Arabia; we do not receive it, and it cannot be read without the keys kept on your devices. Settings that belong to one device, such as app lock, stay on that device. If you choose to download an optional component, it may be delivered directly by a third-party provider, which receives the technical data needed to deliver it.

3. Data we process

We process the following data when you use the Services or a feature that needs it:

• Account data: the identifier your sign-in provider gives us and an account reference. We do not ask the sign-in provider for your name or email address.
• Profile data you choose to provide, such as a username or display name, and your visibility settings.
• Content you share with others, such as shared expenses and their amounts, notes, images, invitations and payment requests, the names of people you add, and tasks and countdowns you share with friends: their titles, notes, steps and dates, their participants, and who completed them and when. Some of what we keep about a shared task is visible only to you, such as your ticks on its steps and which of your shared countdowns sets its date. We do not receive your reminders or the countdowns you have not shared.
• Connections: friend requests you send or receive and your list of friends, if you use friends features.
• Safety data: blocks, reports and the measures we take to protect users and the Services.
• Communications: support requests and messages you send us, with basic app and device information.
• Notification data: the notifications listed in your account, such as friend requests and invitations, and whether you have read them; and, if you allow notifications, a notification token for your device and your notification preferences, including the language of your notifications.
• Technical data needed to deliver and secure the Services and to prevent abuse, such as your network address and app version.
• Installation data: a random reference for your installation of the app, a code that confirms it, your app version and when we received them. The app sends them automatically, even if you are not signed in, when it is updated, when you sign in or out, and about once a month when you open it; while you are signed in, they are linked to your account. We use them to support you and to keep the Services secure.

We do not sell personal data, do not use third-party advertising or analytics tools, and do not track you across other companies' apps or websites.

4. How we use data and on what basis

We use personal data to:

• provide and operate the Services you request, under our agreement with you;
• provide optional features you turn on, such as being found by others, notifications, or offers and news, on the basis of your consent, which you may withdraw at any time in the app;
• keep users and the Services safe, prevent misuse and fraud, and enforce our Terms of Use, on the basis of our legitimate interests, without overriding your rights; and
• comply with our legal obligations.

5. Disclosure

We disclose personal data only:

• to other users, as you direct: members of a shared space see what is shared there; a friend you invite to a shared task or countdown sees its title and that the invitation is from you, and friends who accept see its content, its participants and who completed it, but not your reminders or your ticks on its steps; people you send a friend request to, and your friends, see your profile, even if it is not discoverable; anyone holding a link you share sees the information in it; and while your profile is discoverable, others can find it by your username — a new profile is discoverable until you turn off “Let people find me”; on 22 October 2026 we turned it on once for existing profiles that had it off, and each person is told in the app when it happens for them (on TWAZ 1.0.13 or later), with the option to turn it off at once; once you turn it off, it stays off; and turning it off does not remove your friends;
• to service providers that host, operate, secure or support the Services on our behalf, who must protect the data and use it only to provide their services to us;
• to platform providers, such as the provider of your device's operating system and app store, for sign-in, notifications, sync, backup and app distribution, under their own terms;
• where required by law or by a competent authority, or where necessary to protect the rights, safety or security of users, TWAZ or others; and
• in a reorganisation, merger or transfer of the Services, subject to this policy and applicable law.

Our authorised personnel access personal data only as needed to operate the Services, provide support, protect users and comply with the law. They cannot access the financial data stored on your device.

6. Retention and deletion

We keep personal data for as long as needed for the purposes in this policy or as required by law. When it is no longer needed, we delete it or remove what identifies you.

You can request deletion of your account in the app. If you manage a shared space that other members still use, you will first need to hand it over to another member; if that is not possible, contact us. When your account is deleted, we delete or de-identify its personal data, except that:

• content you added to shared spaces stays there without your name, so that other members' records remain accurate; and
• we keep limited records, such as a record that the account existed and of measures taken to protect users, where needed for safety, preventing misuse, resolving disputes or meeting legal obligations.

Tasks and countdowns you shared are deleted for everyone when your account is deleted, together with your ticks on their steps. Data on your device and in your own cloud account, including what you sync or back up, stays under your control until you delete it; you can delete what is in your cloud account from Data & Sync. Our retention periods are available on request.

7. Security

We use reasonable technical and organisational measures appropriate to the nature of the data, including encryption. No method of storage or transmission is completely secure. If a breach affects your personal data, we will notify the competent authority and you as required by law.

8. Your rights

Subject to applicable law, you have the right to:

• be informed about how your personal data is processed;
• access your personal data and obtain a copy of it;
• have it corrected, completed or updated;
• have it destroyed when it is no longer needed;
• withdraw your consent where processing is based on consent; and
• lodge a complaint with the Saudi Data and Artificial Intelligence Authority.

You can exercise many of these rights in the app, for example by editing your profile, deleting your account or deleting data on your device. Otherwise, contact us at a@twaz.org. We may ask you to confirm your identity, and we respond within the period set by law.

9. Children

Features that require an account or involve sharing with others are intended only for people aged 18 or older. If you believe a child has given us personal data, contact us so that we can take appropriate action.

10. Changes to this policy

We may update this policy when the Services or legal requirements change. We will publish the updated policy with its effective date and notify you of material changes as required by law.

11. Contact and language

For any question or request about this policy, contact us at a@twaz.org. This policy is published in Arabic and English; if the two differ, the Arabic text controls.