Privacy Policy

1. Introduction

This policy explains what the Netlaga app ("the app", "we") collects about you, how it uses it, who sees it and how you delete it. The app is operated by RidersOn from Saudi Arabia. By using the app you agree to this policy. Sections 4 and 5, on your phone number and your contacts, deserve a careful read.

2. What we collect

• Your account: your mobile number and its country code (they are your account, and required), your name, your language, and your photo if you add one. We ask for no email and no password.
• Your groups: each group's name, photo, description and settings, its member list and roles, and the members' mobile numbers (see section 4).
• What you write and send: messages, photos, voice notes and shared locations, polls, gatherings (title, time and place), rotations, items, kitty expenses with receipt photos, and transfers and their confirmation.
• Places: the places you add: their name, type, country, city, district and point on the map, what you choose to add of capacity, price, notes and features, and how many gatherings were arranged at each. Your places are yours alone (see section 7).
• Attendance: that you arrived at a gathering and when, whether you tapped "I'm here" or arrival was recorded by location (see section 6).
• Your contacts: read on your phone only and never leave it (see section 5).
• Invitations: when you invite someone by mobile number we keep that number with the invitation until they answer, even if they have not registered yet.
• Notifications: your device's push token, and the notification choices you make in each group.
• Reports: when you report a message we keep the report with the message, the reason and who reported it, for review. Whose messages you hid is kept in your settings for that group, and they are not told.
• Technical data: your Firebase account id, the last time you opened the app (to the hour), crash reports (Firebase Crashlytics), and the usage events Firebase Analytics collects: the automatic ones (app opens, screens viewed, device model and OS, approximate country) and three we count ourselves (a group created, a gathering created, a transfer confirmed), without your number, name, content or amounts. We show no ads and use none of this for advertising.

3. How we use it

To create your account and verify your number by SMS, to run the app's features (groups, gatherings, chat, the kitty, rotations, attendance), to show your name and photo to your groups' members, to send notifications as you set them, to diagnose faults and improve the app, and to answer your messages. We never sell your data or use it for advertising.

4. Your mobile number and who sees it

Your number is your account. Only people who share a group or a gathering with you see it, for one purpose: so the app can show them your name as they saved it on their own phone (section 5). Nobody else sees it, and there is no people search by number or name.

Someone who knows your number and has an account can invite you to their group, and thereby learns you are registered. Nobody is added to a group or gathering without accepting the invitation themselves.

5. Your contacts

The app shows your groups' members by the names you saved for them on your phone, as messaging apps do. It therefore asks for the contacts permission after explaining why; you may refuse, and it then shows the names members wrote for themselves.

What actually happens: your contacts' numbers and names are read on your device and matched against members' numbers on your device. We never upload or store your address book and never message anyone in it. You can turn the feature off in Settings or withdraw the permission in your phone's settings at any time.

6. Location

We do not track your location, neither in the background nor while you use the app, and we never store your coordinates unless you yourself choose a point on the map. Location is used in three cases only, each with your permission through the operating system:

• Arrival check-in: off to begin with. Whoever arranges a gathering can switch it on when choosing its place on the map, if the group allows it. Then, if you open the app inside the venue's radius, from an hour before the gathering until it ends, we record that you arrived and when, not where you were. You can turn it off for yourself in your settings in the group; the "I'm here" button remains.
• Sharing a location in chat: you choose a point on the map and name it; that point is saved as a message the group's members see.
• The gathering's place and places: the point you choose for a gathering is saved with it and shown to the invitees. A place you add is saved with its point on the map (see section 7).

Maps are shown through Google Maps, which receives map-display data when a map is opened.

7. What others see

Your name and photo appear to the members of your groups and to the invitees of gatherings you take part in. Everything you post in a group is seen by its members; a gathering's guest sees that gathering's chat only. Chats are not end-to-end encrypted: they are encrypted in transit and at rest by Google, and we can technically access them when necessary to investigate an abuse report or meet a legal obligation. Do not send through the app what you consider secret.

Places: a place you add is yours alone, and nobody else sees it: not the members of your groups, not anyone else, and the app has no public directory of places. A place reaches others only by something you do: send it to a group and it appears in that group's chat as a location for its members; arrange a gathering there and the invitees see its name and point with that gathering.

8. Sharing

We do not sell, rent or share your data for advertising. We may share limited information: with your groups' members within the features described above; with the providers in section 10 as far as running the app requires; or when necessary to comply with a legal obligation or an order from a competent authority, or to protect our users.

9. Notifications

The app sends notifications about messages, gatherings, rotations, the kitty, attendance, polls, and invitations addressed to you. They reach you through Firebase Cloud Messaging even when the app is closed, which is why we keep a token for your device that is used for nothing else. In each group's settings you choose what reaches you from it, or mute it for an hour, a day or a week, and you can withdraw the notification permission on your phone.

10. Service providers

The app relies on the following services, each under its provider's privacy policy:

• Firebase Authentication: verifying your number by SMS.
• Cloud Firestore: your account, groups and messages, stored in the Dammam region (me-central2).
• Firebase Storage: photos and voice notes, stored in the Doha region (me-central1).
• Cloud Functions: notifications, kitty arithmetic and data clean-up, running in Doha (me-central1) and partly in the United States (us-central1).
• Firebase Cloud Messaging: delivering notifications to your device.
• Firebase Crashlytics and Firebase Analytics: crash reports and automatic usage events.
• Firebase App Check (Play Integrity): verifies that requests come from a genuine copy of the app on a sound device; Google issues a device attestation for that.
• Google Maps: showing maps and picking places.
• EmailJS: delivering what you send through "Contact us" in the app; your message, name and number pass through it.
• Sharing apps (WhatsApp and others): when you choose to share an invite link through them, on your own initiative.

11. Storage and security

Your data is stored on Firebase and Google Cloud. Security rules at the database level define what each user may read and write: a group's data is for its members only, a gathering's chat for its invitees, and your settings and notifications for you alone. Still, no electronic system can be guaranteed absolutely secure.

12. Retention and deleting your account

We keep your data as long as your account exists. You delete your account yourself from Settings ("Delete my account") and the deletion runs immediately: your number, name, photo, language, push token and the invitations addressed to you are deleted, you leave every group and gathering, and your number is freed to register again.

What you wrote in groups remains attributed to "Former member" so others' context is not broken, and your expenses and transfers stay in the kitty ledger because they concern other members' balances. All your places are deleted with the account; what you sent of them into a group chat stays, since it became a message in other people's context. A message you delete yourself before that is removed together with its files. Details are on the Delete account page.

13. Your rights

You may access, correct or delete your data, object to its processing, and withdraw any permission you granted (location, contacts or notifications) at any time, bearing in mind that this disables only the related feature. You edit your name, photo and language inside the app, and exercise your other rights through the email in section 16.

14. Children

The app is for people aged 13 and over; anyone under 18 uses it with a guardian's knowledge and consent. We do not knowingly collect data from children under 13, and if we learn of an account belonging to a child under that age we delete it and its data. If you are a guardian and believe your child created an account, write to us.

15. International transfers

The app's core data lives in Dammam and Doha; some processing (background functions, crash reports and analytics) happens on Google servers in the United States. We rely on the contractual and technical safeguards these providers offer.

16. Changes and contact

We may update this policy; any material change is announced in the app, and the last-updated date is at the top of this page. For any question about your data: support@netlaga.app. See also the Terms of Use and the Child Safety Standards.