Rawaq Privacy Policy

Effective date: 8 October 2026

1. Who we are

Rawaq is provided by Aaratus Inc., 2093 Philadelphia Pike #1549, Claymont, DE 19703, USA ("we", "us"). We are the controller of your personal data in the Rawaq iPhone app and the service behind it, under Saudi Arabia's Personal Data Protection Law (PDPL) and its Implementing Regulations.

For any privacy question or request, email privacy@rawaq.app. This policy is published at https://rawaq.app/en/privacy/, and in Arabic at https://rawaq.app/privacy/.

2. How consent works

Before Rawaq asks iOS for your location, it shows a one-page notice with a link to this policy. The app asks no other privacy questions and has no privacy switches: this policy sets out every purpose. By continuing and allowing location access, you consent to the uses described here.

What Rawaq records follows your iOS location permission:

• While Using the App: Rawaq plans trips, and records a drive when you set off on a journey you have just looked up.
• Always: Rawaq also records your other drives in the background, to learn your usual trips.
• Never: Rawaq can't plan trips or record drives.

Recording needs nothing from you: there is no start or stop button. You can change the permission at any time (section 8).

3. What we collect

On our servers, in Saudi Arabia

• Install id. A random identifier the app creates; we don't ask for your name, email or phone number. With it we keep the app version, when the app was first and last used, how many free checks you've used, your subscription status, when you accepted the location notice, and a security key from Apple's App Attest.
• Your location when you plan. Your phone's precise position when the trip starts from where you are (a trip between saved or pinned places doesn't send it), and the start, end and time window of the trip you ask about.
• Saved journeys. Trips between your saved places, such as Home → Work: where each end is, the places' names and short descriptions, your work-day times if you set them, and what we learn from your trips on that journey. Home and work locations are personal data even without your name.
• Trips. For each recorded drive: when you left and arrived, the duration and distance, how much was stop-start, and a simplified path of up to 20 points with the first and last 500 metres removed.
• Full trip traces. The complete GPS record of each recorded drive: your position about once a second, with time, speed, direction and accuracy. A trace shows where a drive started and ended, which is often your home or work.
• App events. What you do in the app, such as asking for a plan, setting a reminder or seeing the subscription screen, linked to your install id. Events carry no coordinates.
• Purchase records. For Rawaq Plus: Apple's transaction id, the product, its status and dates. Apple handles the payment; we never see your card details.
• Security data and logs. Your IP address and its network range, and counts of requests from an area, used for rate limits and to detect automated abuse. Server logs can include your install id and IP address.

On your phone only

• Your lists of saved and recent places, including names from Google search results. A saved place's location and name reach our servers only as part of a saved journey.
• The full GPS record of each trip, kept for 7 days.
• Motion data, used to tell when you start and stop driving. We receive only how a departure or arrival was detected.

Google Analytics (Firebase)

Google Analytics receives app usage events (screens opened, buttons used, plans requested, trips ended) with coarse details: transport mode, type of time window, app language, and whether you use free checks or Rawaq Plus. They never contain coordinates, place names, addresses, your own labels, or the ids we use on our servers, so they can't be joined to your journeys or trips. Firebase also records standard technical details, such as device model, iOS version and approximate region, under its own random app-instance id. We don't collect your advertising identifier (IDFA), and we don't track you across other companies' apps or websites. Nothing is sent to Google Analytics until you have accepted the app's privacy notice.

Measuring our own advertising. When we advertise Rawaq, for example with Google Ads, we want to know which ads brought people who went on to use the app. Apple's ad attribution (SKAdNetwork) tells the ad network that an install followed one of its ads, without telling it who you are. Google Analytics can also share the usage events above, such as a first plan, a free trial or a subscription, with our own Google Ads account. This never includes your location, your places, your trips or your install id. Ad personalisation is switched off: we don't use what you do in Rawaq to choose ads for you, and Rawaq itself shows no ads.

Apple crash reports. If you share analytics with app developers in iOS Settings, Apple gives us crash reports and diagnostics. We add no other crash-reporting tool.

Email. If you write to us, we receive your email address and whatever you send.

4. Why we use it, and our legal basis

For the road-speed map, traces are split into short pieces of road, about 100 metres each, recording when each piece was driven, how long it took and how fast. These road-speed records carry no install id, and nothing within 500 metres of where a drive started or ended is ever kept in them, so they can't show where you live or work. Once the trip they came from is deleted, nothing links them to you, and we keep them. A road's speed is shown to other people only once at least 30 drives, from at least 5 different phones, have produced it. To count different phones without identifying any of them, each record carries a number from 0 to 63 worked out from the install id; many phones share each number, so it identifies none. Each record also carries a key that groups the pieces of one drive. The key is worked out from the drive's own recording, not from your install id or the trip's id, and it can't be worked out again once the recording is deleted.

We also keep a short summary of each completed drive, to check how close our estimates come: when it started (to the nearest 15 minutes), how long it took, roughly how far it was (to the nearest 100 metres) and what we had predicted. These summaries contain no places and no install id, and we keep them.

5. Who receives it

• Google Cloud hosts our servers, database, trace storage and analysis tools in its me-central2 region (Dammam, Saudi Arabia).
• Google Maps Platform (Routes API, Places API) calculates routes and answers place searches. Our server sends Google:
  • the start and end points and departure times of your routes, including a weekly refresh of typical travel times for your saved journeys;
  • the text you type in a place search, with your current position so nearby results come first.

  These requests come from our server, so Google doesn't get your install id or IP address with them.

• Google Maps SDK for iOS draws the maps in the app and loads them directly from Google.
• Google Maps and Apple Maps. If you start navigation, Rawaq passes the destination to the map app you choose.
• Google Analytics for Firebase receives the usage events described in section 3. When we advertise, it shares them with our own Google Ads account so we can measure our ads.
• Apple:
  • App Attest checks that requests come from the genuine Rawaq app.
  • DeviceCheck lets Rawaq ask Apple to remember two yes/no values for your iPhone, so deleting and reinstalling the app doesn't renew the first free checks. Apple holds these values, and we don't receive or store a device identifier from it.
  • Purchases: Rawaq Plus is a monthly or yearly subscription, with a free trial for new subscribers. You buy it through Apple, which processes the payment.

Google and Apple handle this data under their own privacy policies (section 11). We may also disclose data where the law requires it.

6. Transfers outside Saudi Arabia

Our servers, database and trip traces stay in Saudi Arabia (Google Cloud, Dammam). Some data leaves the Kingdom:

• Google Maps Platform processes route and place-search requests outside Saudi Arabia (section 5 lists what they contain).
• Google stores Google Analytics data outside Saudi Arabia.
• Apple handles App Attest, DeviceCheck, purchases and crash reports on servers that may be outside Saudi Arabia.

We send only what each service needs, under the providers' data protection terms.

7. How long we keep it

Deleted data can remain in backups for up to 7 days. We also keep daily totals that identify no one.

8. Your rights and choices

Under the PDPL you have the right to:

• be informed about how your data is used (this policy);
• access your personal data and obtain a copy in a readable format;
• correct inaccurate, incomplete or out-of-date data;
• have your data destroyed when it is no longer needed; and
• withdraw your consent at any time.

Delete everything. In the app, Settings → Delete everything erases, at once:

• on our servers: your install record, saved journeys, trips, full trip traces and app events;
• on your phone: everything Rawaq stores. It also resets the Google Analytics identifier, so later use can't be linked to earlier use.

What remains:

• copies in backups, for up to 7 days;
• plans and security data, until they expire (within 24 hours and 30 days);
• purchase records, kept for 7 years but no longer linked to your install;
• road-speed records derived from your drives: how long pieces of road took to drive, and when. We turn any drive not yet processed into these records before deleting it. They carry no install id and no trip id (only the shared number from 0 to 63 and the per-drive key described above), and never include the 500 metres around where a drive started or ended, so they can't be linked back to you;
• a summary of each completed drive: when it started (to the nearest 15 minutes), how long it took, roughly how far, and what we predicted — no places and no install id;
• the two DeviceCheck values Apple keeps for your iPhone;
• usage data Google Analytics already has, which isn't linked to your install id;
• totals that identify no one.

Deleting the app is not enough. It doesn't delete what our servers hold, and your install id can stay in your iPhone's Keychain and return if you reinstall. Use Delete everything first.

Location and motion. You can switch these off at any time in iOS Settings → Privacy & Security → Location Services → Rawaq, and in Privacy & Security → Motion & Fitness. Recording stops with them. Rawaq needs precise location to plan trips. Withdrawing consent doesn't affect what was done before.

Correction. You can move or rename saved places, and change your work day, in Settings.

Other requests. Email privacy@rawaq.app. Because there are no accounts, we can find your data only through your install id (Settings → About → Install ID) or your App Store purchase. We'll reply within 30 days.

Complaints. You can complain to the Saudi Data & AI Authority (SDAIA), which enforces the PDPL (sdaia.gov.sa).

9. Security

• All traffic between the app and our servers is encrypted (HTTPS).
• Our service accepts requests only from the genuine Rawaq app, checked with Apple's App Attest.
• Your data is stored in Google Cloud in Saudi Arabia, and only our service and authorised staff can access it.
• Our internal tools show aggregate statistics, never an individual's locations or trips.
• On your phone, Rawaq's files use iOS data protection, and its identifier is kept in the Keychain.

No system is completely secure.

10. Children

Rawaq is not directed at children. We don't knowingly collect personal data from anyone under 18. If you believe a child has used Rawaq, use Delete everything on that phone or contact us.

11. Google and Apple terms

Rawaq's travel-time estimates, place search and maps use Google Maps Platform. When you use Google Maps features and content in Rawaq, you are bound by the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps/) and Google's Privacy Policy (https://policies.google.com/privacy).

You buy Rawaq Plus through the App Store, under Apple's terms, including its standard licence agreement (https://www.apple.com/legal/internet-services/itunes/dev/stdeula/). Apple's privacy policy is at https://www.apple.com/legal/privacy/.

12. Changes to this policy

When our practices change, we'll update this policy and its effective date. If a change significantly affects how we use your data, we'll tell you in the app before it applies.

13. Contact

Aaratus Inc. · 2093 Philadelphia Pike #1549, Claymont, DE 19703, USA · privacy@rawaq.app