Privacy Policy — Mawed

Effective: 2026-09-22 · Publisher: Mazen Abusyam (individual developer)

Mawed records your appointments and tasks and reminds you of them. This page says what is collected and what is not, who receives it, and how it is deleted. It was written from the app's own source code, and it is revised whenever a release changes what is stored.

1. What Mawed does not do

No advertising. No tracking of you across other apps or websites. Your data is not sold and not shared for marketing. There is no social layer: no public profiles, no follows, no messages, and nothing anyone can discover.

Nobody else can see your entries except one you choose to share, through a link you create — and then only the people who open that link. Nothing is shared without an action by you, and a link cannot add an entry to anyone's account without them tapping to accept it.

Mawed collects two technical things, both switchable off at any moment under Settings › Privacy, and both described in section 7.

2. Your account

An account is created with Sign in with Apple, or with an email address and a password, through Supabase's authentication service. With Sign in with Apple, Mawed receives from Apple a verified identifier and the email address you choose to share, which may be an Apple private relay address. If you share your name the first time, it is used only to pre-fill your display name, which you can change. Your email address and an account identifier are stored. Your password never reaches Mawed and is not stored by it in its original form.

3. What is stored in your account

Your profile: display name, username, gender if you chose one, timezone, language, country and city if you entered them, prayer calculation method, display preferences, and the path to your profile picture if you uploaded one. Your phone number if you added one — optional, stored in international format, never verified by SMS, and not used to contact you. Also the day and month of your birthday if you entered it — not the year, because the app celebrates the date and never computes an age. The city you choose for prayer times is picked from a list in the app; prayer times are calculated on your phone from it, and Mawed never asks for or reads your device's location.

Your entries: title, notes, location, times and dates, recurrence, amount, currency and debt direction where they apply, and the original sentence you typed or spoke.

Entries you shared, and entries you added from someone's link: the link itself, who created it, and — for each person who added it — that they did. A sender sees the display names of the people who added their entry, and nothing else about them. Nothing else of yours travels with a share: not your other entries, not your categories, not your counts.

Payments you record: amount, currency, date, method and your note.

Suggestions and problem reports you send: your message, with the app version and build number, your phone's operating-system version, the app's language and appearance setting, and whether you asked for a reply. Nothing from your entries is attached. If you choose to be thanked by name, the name you gave and the date are kept separately from the message, and you can ask for them to be removed at any time. Up to five messages a day.

Your subscription, if you buy Mawed Plus: one record of its state — the product, whether it is active, cancelled or in a billing retry, its renewal or end date, and the store — kept with your account to set your monthly allowance. Deleting your account deletes it.

Your reminders: when they are due. When a reminder fired, and whether you opened it, stays on your device and is not sent to Mawed.

Your device's push identifier: when you sign in, the identifier Google's Firebase Cloud Messaging issues to Mawed on your phone is stored with your account, so an entry someone shared with you can tell you when it changes. It is replaced whenever your phone is issued a new one, and deleted when you sign out and before your account is deleted.

Your extraction log: for each sentence you send to the AI, the original text, what the model returned, the model's name, token counts, cost and response time. This log is yours alone. It is used to improve how accurately Mawed understands you, and to control cost.

4. What leaves your device, and where it goes

When you write a sentence and ask Mawed to understand it, the sentence itself — together with your language, your timezone and the current date and time — is sent to Google's Gemini model, at generativelanguage.googleapis.com. Your name, your email, your account identifier and every other entry are not sent.

A photo or a PDF. Before an image leaves your phone — from the camera, the photo library or Files — it is re-encoded as a JPEG no larger than 1600 pixels on its longest side, and everything written into it besides the picture is removed, including the location (GPS) a camera records. A PDF within your plan's page limit for one file is sent as it is. For a longer PDF, you choose one page, which is turned into an image on your phone and treated like a photo. It is then sent to Mawed's server, which passes it to Google's Gemini model to read: Google receives the image or the PDF itself. Mawed does not keep it: it is not uploaded to storage and not saved anywhere. What Mawed keeps, in your extraction log, is the number of pages, what the model read from it, any words you sent with it, and a fingerprint of the file (a SHA-256 digest), which lets the same file sent again within 24 hours be answered without sending it a second time. A fingerprint cannot be turned back into the file. The words you sent with it are deleted from Mawed's server after 30 days (section 6); the rest is kept until you delete your account.

Both a sentence and a file are processed by Google through the Gemini API, under Google's terms for that API: https://ai.google.dev/gemini-api/terms.

Mawed Plus. A subscription is bought and billed by Apple (App Store) or Google (Google Play); Mawed never sees or stores your card or payment details. To confirm and manage it, Mawed uses RevenueCat, which receives the purchase record from the store and your Mawed account identifier — not your entries — and tells Mawed's server the state described in section 3. You can cancel at any time in your App Store or Google Play account settings; access continues until the end of the paid period.

An entry you choose to share leaves your device too, because that is what sharing is. It goes to Mawed's own server, and from there to the people who open the link you created — nobody else, and nothing happens in their app until they tap to add it. A notification about a shared entry passes through Google's Firebase Cloud Messaging and, on an iPhone, Apple's push service on its way to the other person's phone. It carries the entry's title and, when the time moved, the new time. If that person has turned on hiding detail on the lock screen, it says only that a shared entry changed, with no title and no time.

Otherwise nothing leaves your device except to your own Supabase storage, and what sections 5 and 7 describe.

5. Voice

When you speak a sentence instead of typing it, the words are recognised by your phone's own speech service — Apple's on an iPhone, and on Android the phone's speech service, usually Google's. Mawed does not require that recognition to happen on the phone itself, so what you say may be processed by Apple or Google, under their terms. Mawed receives only the resulting text, never a recording, and treats it like a sentence you typed (section 4).

6. How long it is kept

Your data is kept for as long as your account exists. Delete an entry and it is gone; delete your account and everything belonging to it is gone. The text of your sentence in the extraction log — what you typed, or the words your phone heard — is deleted from Mawed's server 30 days after you send it. What was understood from it stays, with the entry. The sentence you see on the Review screen is part of your entry and is kept as long as the entry is.

7. Crashes and usage counters

Crash reports. When the app meets an error, technical detail is sent to Sentry so it can be fixed: the kind of error, where in the app's code it happened (file, line, function), the app version, whether the phone is iOS or Android, the app's language, and a random identifier that changes when you sign out. Nothing you wrote is sent. The error's own message is removed before sending, because that is where text can end up. Any remaining text containing an Arabic character is replaced in full, and any other text is cut short. No screenshots, no record of what you tapped or typed, no account identifier and no email, and the app does not attach your IP address to a report.

Usage counters. Anonymous counts of a fixed list of actions — for example, that an entry was saved by text, voice or photo, or that the review screen was opened — are stored on Mawed's own servers, not with a third party. Each count carries the app version, iOS or Android, the app's language and the same random identifier. It carries no text, and no name, email or account identifier. Because counts are not linked to your account, deleting your account cannot find them, and they identify no one. They are kept for 90 days and then deleted automatically.

Both are switches under Settings › Privacy. Crash reports are on by default. Usage counters are on by default, except where your device's region is in the European Union, the EEA, the United Kingdom or Switzerland, or cannot be determined — there they are off until you turn them on. Turning either off stops it immediately, and counts not yet sent are discarded.

8. Reminders

Reminders are scheduled on your device, by the operating system itself. They do not pass through a server and need no connection to arrive on time. If you turn on hiding detail on the lock screen, the notification appears generic and without the entry's title. A reminder you turn into an alarm is scheduled on your phone by the phone's own alarm system; the only thing about it that leaves your phone is that it is on, which is saved with the entry.

One kind of notification does come from a server: the one that tells you an entry somebody shared with you has moved, changed or been cancelled. Your device cannot know that by itself. It is sent through Google's Firebase Cloud Messaging and, on an iPhone, Apple's push service, as section 4 says.

9. Files

Your profile picture is kept in private storage that only your account can open. There is no public link to it.

10. Where it is stored

On Supabase infrastructure in the eu-west-1 (Ireland, European Union) region.

11. Your rights

You can edit your profile and delete any entry at any time, and delete your account entirely from Settings. Deletion is permanent and cannot be undone. For questions, or for a copy of your data: support@getmawed.com

12. Children

Mawed is not directed at anyone under 13, and it does not collect a full date of birth, so it cannot infer anyone's age.

13. Changes to this page

If what is collected changes, or where it goes changes, this page changes with it and the effective date above changes too.