Privacy Policy

Last updated: October 5, 2026

Wesam is a private family app: parents add their children, follow their tasks, points and medals, and talk to each other in a closed family circle. This page explains exactly what we collect, why, and who can see it.

1. What we collect

• Parent account: email address (sign-in by link or password), the name you choose, and an optional profile photo or colour.
• Children's accounts: a name and colour set by the parents, and gender (for wording). Children need no email or phone number. Their PIN is stored only on their own device (hashed) and never reaches us.
• Devices: device name and type, each device's public encryption key, push token and last-seen time.
• Family program: tasks, task completions and parent approvals, points, the piggy-bank ledger (numbers only — the app moves no real money), rewards, medals, the weekly challenge, occasions and birthdays, prayer-reminder settings, timers, and the «مين الأسرع؟» family quiz (who answered what, and the scores). These are stored on our server so family devices stay in sync. Parents see all children's data. A child sees their own, plus a daily summary of their brothers and sisters only (points earned today, piggy-bank balance and the tasks they finished), to cheer each other on.
• Messages, photos, videos, voice notes and stickers: encrypted on the sender's device; the server keeps only the encrypted copy until every device has received it, then deletes it (30 days at most). History lives on your devices.
• Reports and blocks: when you tap «إبلاغ» (Report) on a message, the report and the text of that one message (or only its kind, for a photo or voice note) go to the family's parents and to the Wesam team, who review reports within 24 hours. We also keep who blocked whom inside the family, to stop messages and calls between them.
• Calls: live peer-to-peer audio/video, never recorded and not routed through our servers. Google STUN servers help devices find each other and see the IP address while connecting.
• Error reports: when sending a photo or video fails, a short technical note (which step failed, file size, device type) so we can fix it. No message content.

2. What we don't collect

No location, no contacts, no cross-app tracking, no analytics or advertising SDKs. Camera, microphone and photos are used only when you choose to take, record or send something.

3. How we use it

Only to run the app: sign-in, delivering messages and notifications, syncing tasks and points across family devices, and ringing calls.

4. Service providers

• Supabase — database and storage (Frankfurt, EU).
• Expo, Apple, Google — push notification delivery (notifications carry the sender's name only, never message text).
• Google STUN — call connection setup.
• Gmail — sending sign-in links.

5. Children's privacy

Children's accounts are created and controlled by their parents. There are no public profiles, no search and no contact with anyone outside the family. Parents can pause or delete a child's account at any time in the app.

6. Deleting your account and data

In the app: Family → Delete account. If another parent remains, only your account is deleted. If you are the last parent, the whole family is deleted: every account, task, point and file. Parents delete children's accounts from each child's page.

7. Contact

wesam.app.kw@gmail.com