Privacy policy

Last updated: 2026-11-08

DRAFT, not yet legally reviewed. Must be reviewed by a lawyer familiar with Saudi Arabia’s Personal Data Protection Law (PDPL) before publishing.

This policy explains what data the Waaa app and website process, why, and your rights under Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations.

1. Who we are

Data controller: [legal name of the entity or person, CR number, national address]. Privacy contact: hello@getwaaa.com, or X · @og7oska.

2. Data we process

• Data you enter: your baby’s name, birth date and photo (optional); feed, sleep, diaper, meal and other logs; and the parent name shown to your family.
• Family sync data: your family code, a random device identifier, and your Apple push token so family alerts can be delivered.
• Invites: when you invite someone by phone number, we store a keyed hash of the number (not the number itself) to match the invite [confirm when family roles launch].
• Purchases: handled by Apple or Google. We never receive card details, only your subscription status.
• Contact form: your name, contact details and message.

Anonymous usage statistics: the app sends anonymous statistics about how it is used (screens and buttons used, the kind of feed logged but not its amount or time, session length, notification status, and errors) to PostHog in the EU, tied only to a random install identifier: no names, no baby data, no family code, no Apple ID, and no IP address is stored. Some sessions may be recorded as wireframes in which all text and images are hidden. This data is not used for tracking or advertising, and you can switch it off at any time in Settings › Privacy › “Share anonymous usage data”. We also use aggregate, anonymous statistics across all families (no individual data) to improve the app. This website uses no analytics or advertising tools.

Customer support: Waaa support opens a family’s data only with a consent code the family creates in Settings › “Share with support” (valid 24 hours, can be stopped at any time), to fix a problem you asked about. Without the code, support sees only account status (plan, number of members, last activity) to fix billing issues. Every access and every change is recorded in a log that cannot be edited, and any change is shown to the family in the app.

3. Where data is stored

• On your device first. If you turn on family sync, a copy is stored with our database provider (Supabase) in [hosting region].
• iCloud backup (once launched) is stored in your own iCloud private database at Apple.
• Where hosting is outside the Kingdom, transfers follow the PDPL’s cross-border transfer rules [legal review: transfer basis and safeguards].

4. Why we process it (purposes and legal basis)

• To provide the app and its features, including sync and reminders (performing the service you asked for).
• To send family notifications (with your consent, which you can withdraw in device settings).
• To answer your messages and support you.
• To keep the service secure and prevent abuse.

5. Sharing

We do not sell data or share it for advertising. Logs are visible only to the family members you invite, according to their permissions. We use processors acting on our behalf: Supabase (database), PostHog in the EU (anonymous usage statistics), Apple (notifications, purchases, iCloud), Google (once Android launches) and [hosting and contact-form provider].

6. Children’s data

Waaa is for parents and the people they authorise. Data about a baby is entered by a parent or guardian, or with their permission. Children are not meant to use the app themselves.

7. Nannies and caregivers

Nanny mode collects no location, uses no camera and produces no monitoring reports. This is shown to her, and her consent is asked in her language before she joins. She can leave the family at any time.

8. Retention

We keep data while your family uses sync. When you delete data or ask us to, we remove it from our servers within [period, e.g. 30 days]. Contact messages are deleted after [period].

9. Your rights

• To be informed about how your data is processed.
• To access your data and get a copy.
• To correct or update it.
• To ask for it to be destroyed when no longer needed.
• To withdraw consent at any time.

To use any right, email hello@getwaaa.com or message us on X · @og7oska; we reply within the statutory period. You may also complain to the Saudi Data & AI Authority (SDAIA).

10. Security

We use encrypted connections and access controls that limit each family’s data to its members [confirm after security phase 1 ships]. We will notify the competent authority and affected people of any incident as the law requires.

11. Changes

We will post changes here with the update date, and tell you in the app if a change is significant.