Privacy Policy

1.What we collect from you

• Account details: your name, email address and mobile number — so you can sign in and so we can reach you about your order.
• Delivery details: the recipient's name, mobile number and full address (city, area, street, building, floor, apartment) — what the courier needs to deliver the gift.
• An optional map location: if you drop a pin, we store those coordinates with the order to shorten the courier's last hundred metres. This step is entirely optional and you can clear it at any time.
• Voice and video messages: if you attach a surprise recording, we store it and generate a QR code that opens it for the recipient.
• Delivery-proof photos: the courier photographs the gift at handover, and the photo appears in your order details.
• Device data: if you enable notifications, we store the device's push token (FCM) so we can send order updates.
• Basic usage data: server logs such as IP address and request time — used to prevent abuse and diagnose faults.
• An anonymous session id: a random cookie stored on your device that says nothing about you. We use it to tell that the person who viewed a product is the person who ordered it, without knowing who that person is. It is never shared with anyone and does not follow you to other sites.

2.Why we collect it

• To fulfil your order: preparing the gift, delivering it, and contacting you or the recipient at handover.
• Order updates: in-app notifications, emails, and lock-screen notifications if you enabled them.
• Security: preventing abuse and fraud, and protecting your account.
• Improving the service: understanding which products and occasions are most requested — in aggregate, never per person.

3.Who sees your data

• The shop you ordered from: sees the recipient details and address in order to prepare and wrap the gift.
• The assigned courier: sees the recipient's name, number, address and map pin. In Surprise Mode your own name is not shown.
• Payment providers: payment details go directly to the provider (Paymob or Fawry) — we never see or store card details.
• Service providers: our email relay, and Google's push service (Firebase Cloud Messaging).
• Authorities: only where legally required.
• We do not sell your data to anyone.

4.How long we keep it

• Account data: for as long as the account exists.
• Orders and invoices: for the period Egyptian law requires for financial records, even after you delete your account — but stripped of your personal details.
• Voice and video messages and delivery photos: removed with the order.
• Anonymous usage events (product viewed, added to cart, checkout started, order placed): deleted automatically after 180 days.

5.Your rights

• View and correct your data from the Account screen.
• Delete your account entirely from Account → Delete account. Your name, email, phone number, addresses, reminders, wishlist and notifications are erased permanently, and your email address is released so you can sign up again.
• Turn notifications off at any time, from your phone settings or from the notifications screen in the app.
• Clear your map pin from the addresses screen.

6.Security

• All traffic is encrypted (HTTPS), and passwords are stored hashed with bcrypt — unreadable even to us.
• Card details are handled by the payment gateways directly and never pass through our servers.

7.Children

• The service is not directed at anyone under 18, and we do not knowingly collect data from children.

8.Changes to this policy

• If we change something material we will tell you in the app or by email before it takes effect.

Contact

Questions about privacy or these terms: support@mofagaa.app — or from the Account screen inside the app.