Privacy Policy for Kashtati

Last Updated: 2 February 2026

This Privacy Policy describes how Kashtati ("we", "our", or "us") collects, uses, and protects your information when you use our mobile application (the "App"). By using the App, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your username. Usernames are case-sensitive, must be unique, and are used to identify you in groups. Your username is searchable by other users so they can add you to groups. We also generate a unique user identifier (UUID) associated with your account.
• Group Data: Information you create in groups, including:
  • Group names and descriptions
  • Member lists (usernames and user IDs of group members)
  • Checklist items (item names, categories, completion status)
  • Group photos (optional, stored securely)
• Personal Checklist Items: Items you add to your personal checklist. These are stored locally on your device and can be used without creating an account. If you create an account, this data may be synced to Firebase for backup and cross-device access.
• Guest Usage: You can use the App as a guest without creating an account. As a guest, your personal checklist data is stored only locally on your device and is not transmitted to our servers. To use group features, you must create an account.

1.2 Automatically Collected Information

• Device Information: We may collect device identifiers, device type, operating system version, and technical information about your device to ensure compatibility and improve app performance.
• Usage Data: Information about how you interact with the App, including:
  • Groups you create or join
  • Items you add, modify, or delete
  • Features you use (Compass, Checklists, Groups)
  • App crashes and performance data (for debugging and improvement)
• Location Data: If you use the Compass feature, we access your device's location to calculate the Qibla direction and to navigate to custom coordinates you save. This location data is processed entirely locally on your device and is never transmitted to our servers or stored. Location access is optional and can be disabled at any time.

1.3 Permissions We Request

• Location Services (When In Use): Used for the Compass/Qibla direction feature and for navigating to custom coordinates you save. Location data is processed locally on your device and is never stored or transmitted to our servers. You can disable this permission at any time through your device settings, though this will disable the Compass and coordinate navigation features.
• Photo Library: Used to allow you to add photos to groups. Photos you upload are stored securely using Firebase (Google Cloud Platform) and are only accessible to group members you explicitly add. You can revoke this permission at any time through your device settings.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App's functionality and user experience
• Enable real-time synchronization of groups and checklist items across your devices
• Allow you to create and manage groups with other users
• Provide the Compass/Qibla direction feature and custom coordinate navigation
• Enable user search functionality (for adding members to groups)
• Respond to your requests and provide customer support
• Detect and prevent fraud, abuse, or security issues
• Comply with legal obligations

3. Data Storage and Security

• Cloud Storage: Your account information, groups, and checklist data are stored securely using Firebase (Google Cloud Platform). All data is encrypted in transit using TLS/SSL and encrypted at rest.
• Local Storage: Some data is stored locally on your device using iOS UserDefaults for offline access and improved performance. This includes your personal checklist items and app preferences.
• Security Measures: We implement appropriate technical and organizational measures to protect your data, including:
  • Firebase security rules that control data access and prevent unauthorized modifications
  • Client-side validation to ensure only authorized users can modify group data
  • Encryption of data in transit using TLS/SSL and encryption at rest
  • Regular security reviews and updates
• Data Access Controls: Group data is only accessible to members of that group. Users can only access groups they are members of, and only group administrators can modify group settings or delete groups. Personal checklist data is stored locally and only synced to Firebase when you create an account.
• Offline Functionality: The App can function offline. Personal checklist items are stored locally on your device and will sync to Firebase when you create an account and when you have an internet connection. Group data requires an internet connection for real-time synchronization.
• Limitation: While we implement strong security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability.

4. Data Sharing

We do not sell, rent, or trade your personal information. We share your information only in the following circumstances:

• With Group Members: When you join or create a group, your username and group-related data (items you add, items you mark as completed) are visible to other members of that group. Group administrators can see all group data and manage group settings.
• Service Providers: We use Firebase (Google Cloud Platform) for data storage and synchronization. Firebase's privacy practices are governed by Google's Privacy Policy, available at: https://policies.google.com/privacy. Firebase processes your data only as necessary to provide these services to us.
• Legal Requirements: We may disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to:
  • Comply with legal obligations
  • Protect our rights, property, or safety
  • Protect the rights, property, or safety of our users or others
  • Prevent or investigate fraud or security issues
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5. Your Rights and Choices

You have the following rights regarding your personal information:

• Account Deletion: You can delete your account at any time through the Settings menu in the App. This will permanently:
  • Delete your account information (username, user ID)
  • Delete groups you created (which will also remove them for all members)
  • Remove you from groups you joined (the groups will remain for other members)
  Note: Some data may remain in backups for a limited time, but will be permanently deleted within 30 days.
• Data Access: You can view and modify your account information (username) through the App's settings at any time.
• Data Portability: You can export your personal checklist data through the App. Group data is shared with group members as part of the group functionality.
• Location Services: You can disable location services for the App at any time through your device settings (Settings → Privacy → Location Services → Kashtati). Disabling this will prevent the Compass feature from working.
• Photo Access: You can revoke photo library access at any time through your device settings (Settings → Privacy → Photos → Kashtati). This will prevent you from adding photos to groups.
• Opt-Out: You can stop using the App at any time and delete your account as described above.

6. Children's Privacy

Our App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information from our servers.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States where Firebase (Google Cloud Platform) servers are located. These countries may have data protection laws that differ from those in your country. By using the App, you consent to the transfer of your information to these countries. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

8. Data Retention

• We retain your information for as long as your account is active or as needed to provide you services.
• If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes (such as tax records, dispute resolution, or enforcement of agreements).
• Group data will remain accessible to other group members after you leave a group, as it is shared data. If you created a group, deleting your account will delete the entire group for all members.
• Some information may remain in backups for a limited period but will be permanently deleted according to our retention schedule.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the new Privacy Policy in the App
• Updating the "Last Updated" date at the top of this policy
• Providing in-app notification for significant changes (when possible)

Your continued use of the App after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

10. Third-Party Services

Our App uses the following third-party services:

• Firebase (Google Cloud Platform): We use Firebase for data storage, real-time synchronization, and user authentication. Firebase's privacy practices are governed by Google's Privacy Policy, available at: https://policies.google.com/privacy. Firebase processes your data only as necessary to provide these services to us and in accordance with our instructions.

These third-party services have their own privacy policies and terms of service. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and share
• Right to delete your personal information (subject to certain exceptions)
• Right to opt-out of the sale of personal information (we do not sell your information)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectify inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent (where processing is based on consent)

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

13. Contact Us

14. Consent

By using the Kashtati App, you consent to our Privacy Policy and agree to its terms. If you do not agree with this policy, please do not use the App.