Introduction

Mawthooq is an accounting and business-management app for commercial businesses. This policy explains what data the app collects, how it is used, stored, and shared, and your rights. By using the app, you agree to this policy. The data controller (provider) is Mawthooq, operated by Abdoulla Al-Kalkoul; see Section 11 to contact us.

1. Data We Collect

We do not collect your geographic location, and the app does not request location permission. The camera is used for barcode scanning (not stored as a photo) and to capture images you choose to save (item & receipt images, report logo, chat images). Biometrics are handled by the device OS and never leave it, and the call feature opens the phone dialer without collecting your call logs.

2. How We Use Data

• Operate the accounting service and sync your data across your company's devices.
• Verify sign-in via a code sent to your email, and secure access via secret code/biometrics.
• Enforce subscribed-device limits and prevent fraud (via device id and integrity checks).
• Store and display media you add (item & receipt images, voice notes) within your records.
• Send work-related reminders/notifications (e.g., invoice notes).

We do not use your data for advertising, and we do not sell it.

3. Who We Share Data With

• Supabase — cloud database, authentication, and file storage.
• PowerSync — device–cloud sync engine.
• Google Play Integrity — device integrity verification for anti-fraud.
• SMS provider (Twilio) — only if SMS verification is available and used in your country; in that case your phone number is processed to deliver the verification code (email is the primary verification channel).
• Telegram — only if your company enables the optional Telegram bot / price-search integration; in that case, the data you choose to make available through it is shared.

We may disclose data where required by law.

4. Storage & Retention

Your data is stored in your company's cloud account on Supabase and retained while the account is active, on cloud servers operated by our providers that may reside in regions outside your country. A company admin can delete all company data from cloud and device (see Section 7). After deletion, operational backups may persist for up to 90 days before permanent erasure, and we may retain minimal records needed to prevent free-trial abuse.

5. Security

• Transport encryption via HTTPS/TLS between the app and our servers.
• Secret codes hashed (PBKDF2-HMAC-SHA256) — never stored in plaintext.
• Biometrics handled solely at the device OS level.

6. Your Rights

• Access & export reports of your data from within the app, and a full copy before any permanent deletion.
• Delete your company data and request deletion of your account (see Section 7).
• Contact us about your data via the details in Section 11.

7. Account & Data Deletion

• In-app (immediate): a company admin permanently deletes the entire account — login identity plus all company data and images — via Settings → Delete & Reset Data → Delete Account Permanently.
• Or by email request: email us at the address in Section 11 from your registered account email, and we will delete your account and personal data within 30 days.

Operational backups may persist for up to 90 additional days before permanent erasure. We may retain minimal records (e.g., a hashed phone/email/device fingerprint) solely to prevent free-trial abuse. Financial transaction records (bank-transfer requests) and records shared with other businesses (B2B requests) are retained on the other party's side.

8. Payments & Subscription

We do not collect payment-card details inside the app; payment itself happens outside the app via the provider. (In some versions you may upload a bank-transfer receipt image to activate your subscription.)

9. Children's Privacy

Mawthooq is a business tool, not directed to children under 13, and we do not knowingly collect their data.

10. Changes

We may update this policy from time to time; the "last updated" date above will reflect changes.

11. Contact

For any privacy question, or to request deletion of your account, contact us by email: abdoullakalkoul@gmail.com.