Privacy Policy

Effective: 27 October 2026

We respect your privacy. This policy explains what data the Bkhatri app collects and why, who we share it with, and your rights. It is written under Saudi Arabia's Personal Data Protection Law (PDPL) and its regulations. The Arabic version is the original; this English version is provided for convenience.

1. Who is the data controller?

The controller is Abdalkarim Aldebasi (“we”), based in Riyadh, Saudi Arabia. Contact: [email protected].

2. Data we collect

Data	Why	Basis
Your phone number	Sign-in with a one-time code (OTP) and to identify your account	Providing the service
Display name and optional photo	Show your name to friends	Providing the service / your consent for the photo
Products you add: link, title, image, price, target price, note, priority, occasion, who can see it	Track prices, alert you, and show your list to people you allow	Providing the service
Budgets (monthly and per occasion) and purchase prices you enter	Compute what is left and the “Buy now” list	Providing the service
Contacts (optional)	Find which friends are on the app (see section 3)	Your explicit consent
Reservations you make on others' gifts	Avoid duplicate gifts; never shown to the list owner	Providing the service
Push token	Send price-drop alerts	Your consent to notifications
Subscription status (active or not)	Unlock Pro features. We never receive your card details; payment is handled by Apple	Providing the service
Pseudonymous usage analytics and crash reports	Improve the app and fix bugs. We do not send phone numbers or contact data to analytics or crash tools	Our legitimate interest in improving the service

We do not collect your location, read your messages, sell your data, or use it for advertising.

3. Your contacts: how we handle them

Syncing is optional and happens only after your explicit consent and the system permission. The app works fully without it; only friend discovery is limited.
If you agree, the app reads your contacts' phone numbers only (not names or emails), normalises them to international format and sends them over an encrypted connection to our servers.
Our servers compute a cryptographic hash for each number (HMAC-SHA256 with a secret key only we hold) and store only the hashes. We do not store or log the original numbers.
We match hashes against other users' hashes to find which of your friends are on Bkhatri and who has your number saved. No user can see another user's contact list.
We treat hashes as personal data and protect them accordingly. Deleting your account deletes your stored hashes.

4. Who can see your list?

You choose per item: “Anyone with my number”, “Mutual only”, “Selected people”, or “Only me”. These rules are enforced inside the database, not only in the app. People who can see an item see your display name, photo and the item's details. You can also create a share link for an occasion; it shows anyone who has the link only the items set to “Anyone with my number”, with your display name, and you can stop the link at any time from the occasion screen in the app.

Reservations are secret: the list owner never sees them, and others only see the item as “reserved”.

5. Who we share data with (processors)

We use providers that process data on our behalf under contracts that require them to protect it:

Provider	Purpose	What it receives
Supabase	Database, authentication, photo storage, running our services	All account data listed above
Authentica	Sending the OTP by SMS	Your phone number and the code
Apple (App Store, APNs) and Expo	Subscriptions and push notification delivery	Push token and alert content
RevenueCat	Subscription management	Your internal account ID and subscription status
PostHog	Usage analytics	An internal account ID and usage events (no phone numbers or contacts)
Sentry	Crash reports	Technical error details (no personal data)
Cloudflare	Hosting this website and share pages	Normal technical connection data (such as IP address) while browsing

We may disclose data if a competent authority legally requires it. We do not sell your personal data to anyone.

6. Transfers outside the Kingdom

We are based in Riyadh, Saudi Arabia, but the hosting and technical service providers we use may store and process data in data centres outside the Kingdom. When they do, we comply with the controls the PDPL and its regulations set for transferring data outside the Kingdom and limit transfers to what is needed to run the service. Section 5 lists our providers, and you can ask us for more detail by email.

7. Retention

We keep your data while you use the app. When you delete your account in the app, your personal data is deleted immediately: profile, items, hashes, reservations, share links and photo. Public product price records remain because they are not about you. Backups may persist briefly until they rotate out in the normal cycle. We may keep records we are legally required to keep or need to protect our rights.

8. Your rights

Under the law you may: be informed how your data is processed, access it and get a copy, ask for correction, ask for deletion, and withdraw consent at any time (for example turn off notifications or contacts in your phone settings, or delete your account). To exercise a right, email [email protected] and we will respond within the legal period. If you believe we have not treated you fairly, you may complain to the competent authority (the Saudi Data and AI Authority – SDAIA).

9. Security

We use encrypted connections, database-level access rules, secret keys that never ship inside the app, and least-privilege access. No system is 100% secure; if a breach affects your data we will notify the authority and affected users as the law requires.

10. Children

The app is not directed to children under 13 and we do not knowingly collect their data. If we learn we have, we delete it. If you are a guardian and believe your child signed up, contact us.

11. Changes

We may update this policy. We will change the effective date above and notify you in the app of material changes.

12. Contact

[email protected] — Abdalkarim Aldebasi