1. Introduction

Welcome to Nesab ("we," "us," or "our"). Nesab is an Islamic financial products calculator and information platform available on iOS and Android. We are committed to protecting your privacy and handling your personal data transparently.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using Nesab, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

Data Type	When Collected	Purpose
Email address	Account registration	Authentication & account recovery
Display name	Account registration	Personalization
Profile photo URL	Social sign-in (Google/Apple)	Profile display
Password	Email registration	Authentication (encrypted by Firebase, never stored in plain text)

2.2 Information Collected Automatically

Data Type	Purpose
Authentication provider type	Account management
Login timestamps	Security & account activity
Account creation date	Account management
Device locale & language preference	App localization (stored locally on device)
Theme preference (light/dark)	UI personalization (stored locally on device)

2.3 Financial Calculator Data

2.4 Information We Do NOT Collect

• Location data
• Contacts or address book
• Camera or microphone data
• Health or fitness data
• Financial account numbers or bank details
• Government-issued identification numbers

3. How We Use Your Information

• Account Authentication: To create and manage your account, verify your identity, and enable secure sign-in via email, Google, or Apple.
• App Functionality: To provide personalized experience including language preferences, theme settings, and saved view preferences.
• Security: To detect unauthorized access and protect your account.
• AI Calculator Assistance: To provide AI-powered chat assistance within calculators via Firebase Cloud Functions. Only your chat messages and calculator context (no personal data) are sent.
• Communication: To send password reset emails when requested by you.

4. Third-Party Services

We use the following third-party services that may process your data:

4.1 Firebase (Google LLC)

• Firebase Authentication: Manages user sign-in and identity. Firebase Privacy Policy
• Cloud Firestore: Stores user profile data (name, email, authentication provider). Data is stored on Google Cloud servers.
• Cloud Functions: Processes AI chat requests for calculator assistance. Only chat messages and calculator context are sent (no personal identifiable information). Processed on Google Cloud servers.

4.2 Google Sign-In (Google LLC)

If you sign in with Google, we receive your name, email, and profile photo from your Google account. We do not access your Google contacts, calendar, or other Google services. Google Privacy Policy

4.3 Apple Sign-In (Apple Inc.)

If you sign in with Apple, we receive your name and email (or Apple's private relay email if you choose "Hide My Email"). Apple Privacy Policy

4.4 Currency Exchange Rate APIs

Our currency converter feature fetches live exchange rates from ExchangeRate-API and Open Exchange Rates API. These requests contain only currency codes (e.g., SAR, USD) and no personal data is transmitted.

5. Data Storage & Security

5.1 Where Your Data Is Stored

• Cloud: Account data (email, name, auth provider, timestamps) is stored in Google Cloud Firestore with Firebase security rules ensuring user data isolation.
• On-Device: Preferences (theme, language, view mode, onboarding status) are stored locally using SharedPreferences and are never transmitted to any server.

5.2 Security Measures

• All data transmission uses HTTPS encryption
• Firebase Authentication handles password hashing and token management
• Apple Sign-In uses cryptographic nonce verification
• Firestore security rules enforce user data isolation (users can only access their own data)
• No plain-text passwords are ever stored

6. Data Retention

• Account Data: Retained as long as your account is active. You may request deletion at any time (see Section 8).
• Local Preferences: Stored on your device until the app is uninstalled.
• Calculator Data: Not retained after calculation is complete. Native calculators process in device memory only. Web-based calculators may transmit data to the hosting server for processing but do not store it permanently.
• AI Chat Data: Chat messages are processed in real-time by Cloud Functions and are not permanently stored.

7. Data Sharing

We do not sell, rent, or trade your personal data. We share data only in these limited circumstances:

• Service Providers: Firebase/Google Cloud processes data on our behalf to provide authentication and storage services.
• Legal Requirements: We may disclose data if required by law, court order, or governmental authority.
• Safety: To protect the rights, safety, or property of Nesab, our users, or the public.

8. Your Rights

Depending on your location, you may have the following rights:

8.1 All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Update your display name through the app's profile settings.
• Deletion: Request deletion of your account and all associated data by contacting us at the email below.
• Guest Browsing: Use core calculator features without creating an account.

8.2 European Economic Area (EEA) Residents — GDPR

• Right to access, rectify, erase, restrict processing, and data portability
• Right to object to processing based on legitimate interest
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority
• Legal Basis: We process your data based on consent (account creation), contract performance (providing app services), and legitimate interest (security)

8.3 California Residents — CCPA/CPRA

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information
• We do not sell or share your personal information

8.4 Saudi Arabia Residents — PDPL

• Right to be informed about data collection and processing purposes
• Right to access, correct, and request destruction of your personal data
• Right to withdraw consent
• We process data in compliance with the Saudi Personal Data Protection Law (PDPL)

9. Account Deletion

You can request complete deletion of your account and all associated data by:

• Emailing us at info@nesab.sa with the subject line "Account Deletion Request"
• Include the email address associated with your account

Upon receiving your request, we will:

• Delete your user profile from Cloud Firestore
• Delete your Firebase Authentication account
• Complete the process within 30 days

10. Children's Privacy

Nesab is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. International Data Transfers

Your data may be processed on servers located outside your country of residence (including the United States) through our use of Firebase/Google Cloud services. Google maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses for EEA data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date at the top of this page
• Posting a notice within the app for significant changes

We encourage you to review this policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: info@nesab.sa
• App Name: Nesab (نسب)
• Developer: Abdullah Almalki