Privacy Policy

Last updated: 16 October 2026

1. Introduction and scope

This policy explains how Khanah ("Khanah", "we" or "us") collects, uses, stores and shares information when you use the Khanah app for Android and iOS, the web app and the related website (together, the "Service"). It applies to all users of the Service and should be read together with the Terms of Use. By using the Service you acknowledge that you have read this policy.

2. Information we collect

2.1 Account data

When you create an account we collect your email address, your name if provided by your sign-in provider (Google or Apple), your account identifier, the creation date and any referral code you use. Sign-in is through Google, Apple or a one-time code sent to your email. The Service does not use passwords.

2.2 Data you enter

This includes the notes, projects, reminders, financial accounts, transactions, categories, commitments and settings you record; names and phone numbers of people you add; messages, expenses and settlements in shared groups; deals you post in Nearby deals; attachments such as photos and documents; and messages and reports you send us from the app. Bank messages you paste and Excel, CSV or exported WhatsApp chats you import are read and parsed on your device. Only the resulting records are sent, and they are handled like the rest of your data.

2.3 Technical and device data

• Aggregated usage counters not linked to any user: the event name (for example app installed or first transaction), the platform and the country selected in settings. No identifier, text or amount is included.
• Crash reports: the error text with any email address or long number removed, its location in the code, the platform and the app version.
• If you enable browser notifications on the web: the push subscription address issued by your browser and your device time zone, so reminders arrive on time.
• When you request a sign-in code we may use Cloudflare Turnstile to confirm the request is not automated. It processes technical browser data for that purpose only.

We do not use the advertising ID, we do not show ads and we do not track you across other apps or websites.

2.4 Payment data

Payments are handled directly by payment processors: Google Play Billing and the Apple App Store for in-app subscriptions (with RevenueCat to verify subscriptions) and Paymob for web payments in Egypt. We do not receive or store card numbers or mobile wallet details. We keep only your subscription status, plan, period and transaction reference. For Paymob payments we send your email address and first name to create the payment request.

2.5 Permissions

All of the following permissions are optional, are requested only when you use the related feature and can be withdrawn at any time in your device or browser settings. The rest of the Service remains available without them.

• Microphone and speech recognition: for voice input of notes and transactions. Speech is converted to text by the speech recognition service built into your device or browser, which may be processed by that service's provider (such as Google or Apple) under its own policy. Khanah does not record, store or send audio to its servers. Only the resulting text is saved with your data.
• Location: to show deals near you in Nearby deals. Approximate location is requested only while you use the feature, never in the background. Your exact location stays on your device. The app sends our server a wide area of about 20 km to fetch its deals, and that area is not stored. You can instead pick your place on the map, and that choice is saved on your device only.
• Notifications: to remind you of note and commitment dates. In the mobile app reminders are scheduled locally on the device. On the web they are delivered through the browser push service as described in section 2.3.
• Camera and photos: to attach photos of receipts and documents to notes and transactions. The app only accesses the photo or file you choose or take.
• Fingerprint or face recognition: to unlock the app if you enable the lock. Verification happens in your device's operating system and Khanah never receives biometric data.
• Contacts: the Service does not request permission to read your contacts. When you pick a person from the system contact picker, only that person's name and number reach the app.

3. How we use information

• To provide and operate the Service, including saving, syncing and backing up your data across your devices.
• To send the reminders you set, sign-in codes and email backups if you enable them.
• To manage subscriptions, verify purchases and apply referral benefits.
• To run shared groups and Nearby deals and to review reports.
• To respond to your questions and support requests.
• To protect accounts and the Service from unauthorized use and abuse.
• To improve the Service and fix errors using aggregated counters and crash reports.
• To comply with legal obligations.

We do not use your data for advertising, build marketing profiles from it or make automated decisions with legal effect on you.

4. Legal basis and consent

We process data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, Egypt's Personal Data Protection Law No. 151 of 2020 and other applicable laws, on the following bases: performing the Service you requested, your consent to optional permissions and features, our legitimate interest in protecting and improving the Service with aggregated data that does not identify you, and legal obligations. You may withdraw consent at any time by turning off the feature or revoking the permission. This does not affect processing carried out before withdrawal.

5. Storage and security

• On your device: your data is stored in the app's private storage on your device. If you do not create an account, data stays on the device and is not transferred to our servers.
• Cloud sync: when you are signed in with an active subscription or trial, your data and attachments sync with Supabase servers in Frankfurt, Germany. When you sign out, the copy on the device is cleared and your data remains in your account.
• Encryption and isolation: data is encrypted in transit and at rest, each account is isolated by database-level security rules, and attachments are kept in private per-user storage and opened only through temporary links.
• Backups: manual backup files can be encrypted with a password you choose, and email backups are encrypted with a key that only your password can open. We never see your password and cannot recover it. We keep an encrypted daily database backup with GitHub.
• App lock: you can protect the app with a PIN and biometrics on your device.

We apply appropriate technical and organizational measures to protect data, although no method of transmission or storage is completely secure.

6. Sharing with service providers

We do not sell or rent your data or share it for advertising or marketing. We use service providers that process data on our behalf and only as needed to perform their tasks:

• Hosting and database: Supabase (sign-in, database, file storage and server functions).
• Sign-in: Google and Apple, when you choose to sign in with them.
• Subscriptions and payments: Google Play Billing, the Apple App Store and RevenueCat for in-app subscriptions, and Paymob for web payments in Egypt.
• Email: Resend to send sign-in codes and backups.
• Website hosting and protection: Cloudflare for the website, the web app and Turnstile.
• Backups: GitHub to store the encrypted database backup.
• Maps and exchange rates: OpenStreetMap for the map in Nearby deals, which only receives requests for the map tiles shown, and ExchangeRate-API for daily exchange rates, with no data about you.

Some data is also made available to others at your request. Members of a shared group see the name you chose for that group and the messages, expenses and settlements posted in it, but not your personal accounts or notes. Deals you post in Nearby deals are visible to people in the area without your name. If you connect your account to an AI assistant such as Claude or ChatGPT, the assistant can access your data only after you sign in and approve, with your own account permissions, under the policy of the company that owns it, and you can revoke it at any time. We may disclose data where required by law or by an order of a competent authority.

7. Retention

• Account data and the data you enter are kept while your account exists.
• Items you delete in the app move to trash and can be restored within 30 days.
• Posted deals disappear when they end and are permanently deleted 30 days later. You can delete them at any time.
• The area used to fetch nearby deals is not stored.
• When you delete your account, its data, attachments, subscription records and notification addresses are deleted from our database immediately and removed from backups within 30 days. Your earlier group messages remain visible to group members under the name you chose for that group so their balances stay correct, and support messages you sent us are kept without being linked to your account.
• Aggregated counters and crash reports are kept without being linked to any user.
• Payment processors keep transaction records under their own policies and legal obligations.

8. Your rights

• Access: you can view your data in the app at any time.
• Correction: you can edit your data directly in the app.
• Export and backup: you can export a full copy of your data from Settings.
• Deletion: you can delete your account and data from Settings or by following the steps on the Delete account page.
• Withdrawing consent: by turning off the feature or revoking the permission in device settings.

For any other request about your data, email us from the address registered to your account and we will respond within 30 days. You may also lodge a complaint with the competent authority in your country, such as the Saudi Data and AI Authority (SDAIA) in Saudi Arabia or the Personal Data Protection Center in Egypt.

9. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from anyone under that age. If we learn that an account belongs to a minor, we delete it and its data.

10. International transfers

Our database is hosted on servers in Germany, and some of the service providers listed in section 6 may process data in other countries. We rely on providers that apply appropriate safeguards and we comply with the cross-border transfer rules of applicable laws.

11. Changes to this policy

We may update this policy from time to time, and the date of the latest update appears at the top of this page. If a change is material, we will notify you in the app before it takes effect.

12. Contact

For any question or request about this policy or your data: khanah.app@gmail.com.