سياسة الخصوصية

Privacy Policy (English)

App: Nawil (ناول) — package app.nawil.android · Last updated: 4 October 2026. This is a translation of the Arabic policy above, section by section. If they differ, the Arabic version prevails.

1) Introduction

Welcome to Nawil (the “App”). We respect your privacy and are committed to protecting your personal data. This policy explains what data we collect, how we use, store and protect it, how long we keep it, and your rights regarding it.

By using the App, you agree to the collection and use of your data under this policy. If you don’t agree with any part of it, please stop using the App.

This policy should be read together with the Terms of Use.

2) Data we collect

• Phone number (required) — used with a password to sign in and create your account. It is stored separately from the rest of your data and is never shown to other members or area supervisors. It is shared with the other party in a chat only if you tap “Share my number”. The app operator alone can see it, for support and handling reports.
• Name and area — to show your name to members in posts and chats, and to link you to your area and its supervisor.
• Profile photo (optional) — shown to approved members next to your name. You can remove it at any time.
• Location (optional) — requested only when you tap “My location”, “Enable”, “Nearest” or “Track location”, or open the map, never when the App opens. If you refuse, the App works normally and you can type the place name. Coordinates attached to a post are rounded to about 100 m before saving so your home isn’t shown precisely, and are shown with the post. To show how far requests are from you, your approximate location is kept on your device only and is never sent to our servers. We don’t track your location in the background or keep a history of your movements.
• Content you create — posts, messages and reports. In an anonymous post your name is hidden from members and notifications, but the post stays linked to your account, and the app operator can see the poster’s name, for moderation and abuse prevention.
• Errand history and ratings — the number of errands you completed is shown to members next to your name to build trust. After an errand you may be asked for an optional rating, visible only to the app operator.
• WhatsApp number verification (optional) — if you message the Nawil WhatsApp number from your phone, we receive your number and message through the WhatsApp Business Platform (Meta) to confirm the number is yours, then show a “Verified number” badge. We don’t keep the message text.
• Block list — the members you blocked, visible only to you.
• Post photos — an optional photo you add to your post, visible to members and deleted together with the post.
• Photo processing — every photo you add (profile, post and “Bill” photos) is compressed on your device before upload, which removes its metadata such as the location where it was taken. Camera permission is requested only when you choose to take a photo.
• Requests for someone else (“For family”) — when you request something for another person, what you write about the recipient is saved with the post and shown to members. Include only what is needed to complete the request.
• Location in chats — when you choose “Share my location”, your precise current location is sent as a message to the other person in that chat only, and is deleted with the chat.
• Location tracking (optional) — turned on by the service provider after a request is agreed. While on, their current location is sent about every 15 seconds while the App is open, and is shown only to the other person in that chat. It stops automatically after one hour or when the request is completed or cancelled, and can be stopped at any time. We keep only the latest location, not a movement history, and delete it within a day.
• Read receipts — the time you last read each chat, shown only to the other person in that chat. It is also saved in your account so read messages stay read if you change device or reinstall the App.
• “Delete for me” (امسح عندي) — the list of messages and chats you hid, saved in your account so they stay hidden after reinstalling, visible only to you.
• Notification history — your last 20 notifications, saved in your account to show in the notifications list, visible only to you.
• “Seen by” (شافو طلبك) — when an open request is shown to you, we add one to its view counter and save a mark in your account that you saw it, so you are not counted twice; nobody else can see that mark. The request owner sees only the number, not names, and the counter is deleted with the request.
• Device settings — appearance (light/dark) and “Save data” are stored on your device only.
• Bill and payment between members (optional) — used only inside a request’s chat. It includes the amount and details entered by the service provider, the payment method chosen by the requester (cash or bank transfer), optional photos of the receipt or items, a photo of the transfer slip or the hand-over place, and both parties’ confirmations. Only the two parties in the chat can see it. Nawil does not receive, transfer or guarantee any payment; payment is made directly between members.
• Bank account details (optional) — a service provider can save the account holder’s name and account number in their account, visible only to them. When sent in a specific request, they are shown only to the other person in that chat. We never ask for card numbers or banking passwords, and we advise you not to enter them in the App.
• My regular trip (optional) — the start point, destination, days and time of a recurring trip you save, to remind you with a notification. Only you can see it, and it is deleted whenever you delete it.
• Invite link — when you create an invite link in your name, its code is saved linked to your account. If someone joins through it, their area supervisor can see that you invited them.
• Last seen and activity — the time you last opened the app, shown to members in chats unless you hide it in “My account”; and a daily marker that you opened the app, visible only to the app operator for statistics.
• Technical data — push notification token (Device Token), platform (web or app), the notification settings you choose, and a record of the public Nawil messages you have seen so they don’t show again.
• Technical usage data — how you use the App (store app, installed from the website, or browser) and the date notifications failed to reach your device, if that happens. Used for technical support, visible only to the app operator, and deleted when you delete your account.

3) How we use your data

• To create your account and sign you in.
• To show your posts to other members.
• To enable communication between members through private chats.
• To send push notifications (for example: new message, a request agreed or cancelled, membership approved).
• To provide support and respond to your questions and reports, including technical reports visible only to the app operator.
• Notifications and reminders: for example, reminding you about a request nobody has taken yet or about your regular trip, a weekly summary of requests completed in your area, and messages from the app operator about the App itself. You can turn them off in settings.
• Shared links: when you share a post link outside the App, the link preview shows a summary of the post (type, title, time and area name) without the owner’s name, photo or number, and anyone who receives the link can see it.
• Moderation: your area supervisor sees your name, status and area, and the reports for their area, but not your phone number. The app operator keeps a log of administrative actions (such as approving, suspending or deleting members) that no one else can see.

We will not sell your personal data to any third party, and we will not use it for external commercial advertising.

4) Sharing data with third parties

We use the following services to run the App. They process data on our behalf:

• Firebase Authentication (Google): account management and sign-in.
• Firebase Realtime Database (Google): data storage.
• Firebase Cloud Messaging (Google): push notifications.
• Netlify: hosting the App and running server functions (notifications, account deletion, scheduled cleanup, verification, setting temporary passwords, link previews and regular-trip reminders).
• WhatsApp Business Platform (Meta): receiving number-verification messages only, if you choose to verify.
• OpenStreetMap: displaying the map when you open it and the tracking map inside chats, so map requests reach its servers.
• unpkg: loading the map library when you open the map.
• Google Fonts (Google): loading the App’s font.
• Google Maps: opened only when you tap a location sent in a chat.

When used, these services receive ordinary technical data such as your IP address and device type.

These services are governed by their own privacy policies, including those of Google, Netlify, WhatsApp Business and OpenStreetMap. We don’t share your data with anyone else unless required by law or to protect our rights or members’ safety.

5) Storage and security

• Your data is stored on Firebase servers (location: Europe — europe-west1).
• Encryption in transit: all connections between the App and our servers always use HTTPS/TLS.
• Limited access: database rules let each member access only their own data, and each area supervisor only their own area.
• We recommend protecting your phone with a lock code and choosing a password nobody else knows.

6) End-to-end encryption of chats

• The App supports encrypting messages so that only the two parties can read them — not the app operator and not Google (ECDH P-256 for key agreement and AES-GCM 256 for encryption).
• The feature is optional for each member: turn it on or off from “My account” → “Encrypt my messages”, whenever the app operator makes it available. A message is encrypted when both parties have it on; otherwise it is sent normally.
• One key for your account: your private key is stored on our servers locked with your password, so no one can open it without your password, and you can read your encrypted messages on any device you sign in to.
• If you forget your password and reset it through support, your previous encrypted messages are deleted on your side and cannot be recovered, because their key was locked with the old password. The other party keeps their copy. Changing your password yourself from “My account” doesn’t lose anything.
• Notifications for encrypted messages don’t show the text, because our servers can’t read it.
• Encryption covers message text only. It does not cover “Bill” data, its photos or bank details, which the app operator can technically access.
• When encryption is off, messages are stored in a form the app operator can technically access, so we recommend not sending sensitive information in chats in that case.

7) Password and recovery

• If you forget your password, contact support from your registered number. After verifying your identity, the operator sets a temporary password, and the App asks you to replace it with one of your choice as soon as you sign in.
• The operator never sees your permanent password, and temporary passwords are not stored in our records.

8) Data retention

• We keep your account data while your account is active.
• Chats are deleted automatically from our servers 30 days after their last message, and messages older than 30 days are deleted even inside active chats.
• Daily activity markers are deleted automatically after 90 days; last seen is deleted as soon as you hide it or delete your account.
• Completed or closed posts are deleted after 30 days; open posts nobody agreed to are deleted 30 days after their last update; “Here now” posts expire automatically after their duration.
• “Bill” data is deleted with the chat, and its photos are deleted 30 days after the bill was created, even if the chat remains.
• Notification logs are deleted after 30 days.
• The tracking location is deleted within a day, your notification history after 30 days, read marks and the “Delete for me” list after 45 days, and view counters and marks when the request is deleted.
• Closed reports and the administrative log are deleted automatically after 90 days; they are kept for that period for security and abuse prevention.
• Backups the operator keeps to restore data after failures are deleted within 30 days of creation.

9) Account deletion

• You can delete your account directly in the App: “My account” → scroll down → “Delete my account permanently” (below “Sign out”). Deletion is immediate and needs no approval.
• Deletion covers: your sign-in account itself, profile, name, phone number, photo, posts, inbox, errand history, ratings you gave, block list, encryption keys, verification badge, saved bank details, regular trips, invite link, read receipts, “Bill” photos and transfer details in your chats, last seen, activity markers, technical usage record, notification history, “Delete for me” list, your request views and tracking location.
• What may remain, and for how long:
  • Past chats held by the other party, shown as “Deleted member” without your number — up to 30 days after their last message.
  • References to your account in the administrative log or closed reports — up to 90 days, for security and abuse prevention.
  • Backups — up to 30 days from creation.
  • Ratings other members gave for errands you took part in remain with them, with your identity removed.
• Accounts suspended by moderation are deleted through support instead of in the App.
• If you can’t open the App, request deletion on the account deletion page; we complete requests within 7 business days.

10) Your rights

At any time, you have the right to:

1. Access the personal data we store about you.
2. Correct any inaccurate data (such as your name).
3. Delete your account and data in the App, or from the account deletion page.
4. Turn message encryption on or off from “My account”.
5. Turn off or customize notifications from the App or device settings.
6. Complain to the data protection authority in your country if you believe your data was handled unlawfully.

To exercise any of these rights, contact us using the details in section (13).

11) Children’s privacy

The App is intended for adults aged 18 and over and is not directed at children. We don’t collect or request dates of birth; membership opens only after an area supervisor approves each request, which is how we prevent underage use in practice.

We don’t knowingly collect personal data from children. If we discover we have, we’ll delete it immediately. If you are a parent or guardian and believe your child uses the App, contact us using the details in section (13) and we’ll delete the account and its data.

12) Changes to this policy

We may update this policy from time to time to reflect changes in the App or legal requirements. We’ll notify you of any material change through an in-app notice. Continuing to use the App after an update means you accept the revised policy.

13) Data controller and contact

Data controller: Riyad Karrar — developer and operator of the App.

For any question or request about this policy or your personal data, contact us through:

• In-app support: from the “Support” screen.
• Support phone: +966 56 636 1472
• Email: nawil.sudan@gmail.com

14) Governing law

This policy is governed by the laws of the country where the App is operated, taking into account local and international data protection laws (such as the GDPR where applicable).