Privacy Policy

Your privacy is fundamental to Korassa. This Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it under Egyptian, EU/UK, and California privacy laws.

1. Introduction

This Privacy Policy ("Policy") describes how Osama Mohamed Sharkawy ("Korassa," "we," "us," or "our"), operating individually as the operator of the Korassa mobile application (the "App") and any related websites and services (collectively, the "Services"), collects, uses, stores, shares, and protects your personal data when you use our Services.

Publishing arrangement. The Korassa App is currently distributed on the Apple App Store and Google Play Store under the developer account of Bright Flag Technology Solutions LLC (علم الساطع لتقنية المعلومات), a limited liability company registered in Dammam, Kingdom of Saudi Arabia, which acts as our publishing services provider. In that role, Bright Flag processes a limited set of personal data (such as store-account transaction metadata and payout records) on our behalf and on our documented instructions, as our data processor. Bright Flag is not a data controller of your personal data. The sole data controller responsible for your personal data is Korassa, as identified in Section 2 below. See Section 7.1 for the scope of Bright Flag's processing.

Transition plan. This publishing arrangement is a temporary bridge. An Egyptian limited liability company (Korassa LLC / كراسة ش.ذ.م.م., or its equivalent successor) is in formation and, upon completion of its registration and the opening of its own Apple Developer and Google Play developer accounts, will (a) assume operator and data-controller status from the individual publisher named above, and (b) take over app-store distribution from Bright Flag Technology Solutions LLC. Both steps will be at no cost to you and without change to your rights. Upon that assignment, all references to "we," "us," and "our" in this Policy will refer to the operating company. See Section 16 below and Section 17.4 of our Terms of Use.

This Policy is published in compliance with:

• The Egyptian Personal Data Protection Law No. 151 of 2020 ("PDPL") and its Executive Regulations issued by Prime Ministerial Decree No. 816 of 2025;
• The EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and the UK GDPR, where applicable;
• The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), where applicable;
• The privacy requirements of the Apple App Store and Google Play Store;
• Other applicable data protection and consumer privacy laws in jurisdictions where we offer the Services.

By creating an account, accessing, or using the Services, you confirm that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please do not use the Services.

2. Who We Are (Data Controller)

The data controller responsible for your personal data under this Policy is:

Bright Flag Technology Solutions LLC is not a data controller of your personal data. It acts solely as our publishing services provider and, in that limited capacity, as our data processor. See Section 7.1.

Transition to operating company. Upon completion of the registration of Korassa LLC (كراسة ش.ذ.م.م., or its equivalent successor), the Legal Name, Commercial Registration No., Tax Registration No., and Registered Office fields above will be updated to reflect the operating company. Notice will be given in accordance with Section 16.

A separately appointed local Egyptian representative under Article 4 of the PDPL Executive Regulations is not applicable: the data controller is a natural person established and resident in the Arab Republic of Egypt and is therefore directly subject to the PDPL. All data-protection inquiries are handled directly by Osama Mohamed Sharkawy at privacy@korassa.com.

For users in the EU/EEA, our EU representative under Article 27 GDPR is: not applicable at launch — we do not target the EU/EEA. This designation will be updated if that changes.

3. Scope of This Policy

This Policy applies to personal data processed in connection with:

• Your Korassa account (including guest/anonymous accounts);
• Your profile and demographic information;
• Your financial entries (transactions, recurring expenses, loans, ROSCAs, lending records, investments, strategic purchases);
• Shared categories (multi-user expense groups);
• Subscriptions and payments;
• Customer support communications;
• Marketing and analytics (where applicable and consented to).

It does not cover third-party services that you may link to or access through the App (such as Google Sign-In, Apple Sign-In, the Google Play Store, the Apple App Store, or any external website). Those services have their own privacy policies, which we encourage you to read.

4. Personal Data We Collect

We collect the following categories of personal data. We collect only what is necessary for the purposes described in Section 5.

4.1 Account & Identification Data

• Email address
• Password (stored only as a hashed value — we never see your plaintext password)
• Name (where provided)
• Language preference (English / Arabic)
• Platform (iOS / Android)
• Authentication provider identifier (Google ID / Apple ID, where you sign in via these)
• A pseudonymous internal user identifier (firebase_uid)
• Timestamps of account creation, login, and session

4.2 Profile & Demographic Data (Optional, Provided During Onboarding)

You choose what to enter during onboarding. The fields collected may include:

• Username, last name, mobile number
• Gender, date of birth (used to compute age and to gate age-appropriate features)
• Marital status, expense-sharing model
• Pregnancy status and expected due date (where you choose to enter this)
• Whether you have children, number of children, age groups of children
• Employment types and income sources (e.g., salary, freelance, business, pension)
• Housing information (own / rent, monthly rent, rent due day, vehicle ownership)
• Lifestyle indicators (e.g., smoker status)
• Driver-specific fields (if you use the driver/ride-hailing module)

Note on sensitive data: Under the PDPL, data revealing health, religion, political opinions, or sexual life is "sensitive personal data." Pregnancy and related health information you choose to enter falls into this category. We process such data only with your explicit, written (electronic) consent and only to power the features you have enabled. You may withdraw this consent at any time by writing to privacy@korassa.com, and we will erase the data within 30 days. You can also update or clear these details yourself at any time from your Profile screen, and deleting your account under Section 10.4 removes them along with the rest of your data.

4.3 Financial Data You Enter

• Income and expense transactions (amount, category, date, payment method, notes)
• Recurring expenses
• Loans, installments, and ROSCA (gam'eya / جمعية) details
• Investment holdings, lots, and income records
• Lending records — including the name and (optional) phone number of third parties you have lent money to or borrowed from
• Strategic / planned purchases and savings goals
• Bank account labels, credit-card labels, and cash-on-hand balances (you enter labels and balances; we do not connect to your bank and never receive account numbers, card numbers, statements, or transaction feeds from financial institutions)
• Custom categories you create
• Spending pattern summaries derived from your entries

All entries are text and numbers only. The App has no facility to attach a photograph, receipt image, document, or any other file.

4.4 Shared-Category Data

If you create or join a shared-expense category (e.g., a household budget), the other members of that category will see the transactions, amounts, payer name, and split details you record within it. Only data you choose to record inside a shared category is shared.

4.5 Subscription & Payment Data

We use RevenueCat as our subscription-management platform, which connects to Google Play Billing (Android) and Apple App Store StoreKit (iOS). Store payouts are received by our publishing services provider Bright Flag Technology Solutions LLC and remitted to Korassa; store-account transaction metadata associated with those payouts is accordingly processed by Bright Flag on our behalf (see Section 7.1). We do not receive your full credit-card or banking details. We receive:

• Subscription status, plan tier, billing period, store of origin
• Anonymized purchase identifiers, receipt tokens, and invoice metadata
• Payment-success and renewal events
• Country/region of the store account
• Promotional codes and discounts redeemed
• Discounted months you earn and use (see Section 4.11), and the store offer they were applied with

For users in Egypt purchasing through Google Play, payment may be made via card, Google Pay, or carrier billing on Vodafone, Etisalat, or Orange Egypt — those carriers and Google handle the payment instrument and apply their own privacy policies.

4.6 Device & Technical Data (Collected Automatically)

• Device model, operating system and version, app version, time zone, language
• A device identifier (used for crash reports and security)
• IP address (used transiently for routing requests, security, and abuse prevention)
• Approximate location derived from IP (country/region only — we do not collect GPS location)
• Crash logs and diagnostic data
• API request logs (endpoint, status code, latency) for security and debugging

4.7 Usage & Analytics Data

• Onboarding step completion events
• Feature-use counts (e.g., whether you have used investments, lending, ROSCA, shared categories)
• Daily activity flags (whether you opened the app, recorded a transaction)
• Session-cohort retention metrics
• Aggregated, k-anonymized counts (we apply a k-anonymity threshold of 20 before any aggregate is shown in our internal dashboards, so no fewer than twenty users are ever represented in a visible aggregate)

We do not use third-party advertising SDKs, behavioral-advertising trackers, or cross-app tracking identifiers.

4.8 Communications

• Emails you send to support, security, or privacy mailboxes
• In-app messages and feedback
• Password-reset codes and account-security notifications (transactional emails, sent via ZeptoMail)

4.9 Data You Provide About Other People

If you record a person in your lending tracker or invite someone to a shared category, you provide us with that person's name and (optionally) phone number or email. You are responsible for ensuring you have the right to share that information with us. We will only use such third-party data to operate the feature for you (e.g., display the contact in your list, send the invitation), and we will not contact those people independently for marketing.

4.11 Referral, Code & Acquisition Data

To run our referral program and promotional codes, and to understand which channels bring people to Korassa, we record:

• Who invited you, and whom you invited. When you enter another user's personal referral code, we record that link between your account and theirs, to give and track referral rewards. We also record your own personal code.
• Referral status — whether the people who used your code have verified their email address and whether they currently hold a paid subscription, as counts and statuses only, never their financial records.
• Discounted months earned and used through the referral program or promotional codes.
• Codes you enter (referral, promotional, or influencer/campaign codes) and the marketing channel or campaign a code belongs to (for example, a code shared on TikTok).
• How you found Korassa — on Android, the install referrer that Google Play passes to the App (which identifies the Korassa link or website button you came through, if any) and the time of installation; and, if you answered it in an earlier version of the App, your answer to "Where did you first hear about Korassa?". We do not receive any advertising identifier.
• What led to your first payment — the code, if any, used with or before your first paid subscription, recorded once.
• To prevent abuse of the referral program, we compare the device identifier described in Section 4.6 between the inviting and the invited account (a code cannot be used on a device its owner has used).

If you join with another user's code, that user can see in the App your first name and the initial of your last name, and whether you have verified your email address. They cannot see your email address, phone number, or any of your financial data. If you invite others, the same applies to them.

4.10 Data We Do NOT Collect

For clarity, we do not collect:

• Bank or credit-card account numbers, statements, or transaction feeds (we don't integrate with banks);
• Continuous GPS or precise location;
• Contact-list dumps from your device;
• Photos, videos, or files on your device — the App accepts text input only and has no attachment feature;
• Microphone or camera streams;
• Health-app data, biometrics (other than the local face/fingerprint check used by your device's OS to unlock the App, which never leaves your device);
• Government-issued ID numbers (national ID, passport, etc.);
• Any data about your contacts beyond what you explicitly enter into the lending tracker or invitation flows.

5. How We Use Your Data and Our Legal Bases

We process personal data only when at least one lawful basis under Article 6 of the PDPL (and the corresponding Article 6 GDPR basis, where applicable) is satisfied. The table below maps each processing purpose to its legal basis.

We will not process your personal data for purposes that are materially different from the above without first obtaining your fresh consent.

6. Automated Decision-Making and Profiling

We perform the following limited forms of automated processing on data you have entered:

• Smart category filtering — your profile attributes (e.g., employment type, presence of children) drive which transaction categories appear by default. This is a UX convenience, not a decision about you.
• Spending-pattern detection — we look for recurring entries to surface reminders. You can dismiss or restore any detected pattern.
• Quota tracking — we sum the absolute values of your transactions to enforce the monthly quota associated with your subscription tier.
• Personalized pricing (Phase 3, when launched) — we may compute personalized discount percentages on subscription plans based on signals such as your savings rate and category mix. This will only be activated with your explicit, granular opt-in. You may opt out, request a non-personalized price, request human review of any pricing decision, or contest the outcome by writing to privacy@korassa.com.

We do not use your data to make decisions that produce legal effects on you (such as creditworthiness, employment, insurance, or eligibility for government benefits). We do not sell your data to data brokers, ad networks, or scoring agencies.

7. How We Share Your Data

We share personal data only in the limited circumstances below.

7.1 Service Providers (Data Processors)

We rely on a small set of vetted processors. Each is bound by a data-processing agreement and must comply with privacy obligations equivalent to those in this Policy.

We do not share your data with advertising networks, data brokers, or analytics-aggregator services.

7.2 Other Users (Only Where You Initiate)

When you use the shared category feature, the transactions and split details you record inside that shared category are visible to the other members. When you accept an invitation, the host sees that you joined.

When you join with another user's referral code, that user sees your first name and last-name initial, and whether your email address is verified (see Section 4.11).

7.3 Legal, Regulatory, and Safety Disclosures

We may disclose personal data when we believe in good faith that disclosure is necessary to:

• Comply with a binding legal obligation, court order, subpoena, or lawful request from a competent authority (including the Egyptian Personal Data Protection Centre, courts, prosecutors, tax authorities, and anti-money-laundering authorities);
• Enforce our Terms of Use;
• Protect the rights, property, or safety of Korassa, our users, or the public;
• Investigate fraud or security incidents.

Where legally permitted, we will notify you before producing your data in response to such requests.

7.4 Business Transfers and Publishing Migration

If Korassa is involved in a merger, acquisition, financing, reorganization, sale of assets, or transfer of the Services from an individual publisher to an operating company (including the anticipated assignment to Korassa LLC described in Section 1), your personal data may be transferred to the successor entity.

Separately, upon Korassa LLC opening its own Apple Developer and Google Play accounts, app-store distribution will migrate from Bright Flag Technology Solutions LLC to Korassa LLC. Following that migration, Bright Flag will cease to have any role in relation to the Services, and any personal data it processed on our behalf will be returned to us or securely deleted in accordance with our instructions.

We will give you advance notice (where legally required) of any material change, and the successor will be bound by this Policy or an equivalent one.

7.5 With Your Explicit Consent

We may share data for purposes not listed above only with your specific, prior consent.

8. International Transfers of Personal Data

The Services are operated in part outside the Arab Republic of Egypt. Our backend and database are hosted in the European Union, and some of the processors named in Section 7.1 process data in the United States, India, or other regions. Cross-border transfers are governed by Articles 14–15 of the PDPL and the Executive Regulations, which require:

• A license or permit from Egypt's Personal Data Protection Centre (PDPC) for cross-border transfers. We are preparing our application ahead of the November 2026 PDPL enforcement deadline. During this preparation period, cross-border transfers of your personal data are made in reliance on your explicit consent (see below) and on the technical and contractual safeguards described in this Section 8. We will update this Policy and Section 2 once the PDPC license or permit is issued;
• Your explicit consent to the transfer (which you provide by accepting this Policy when creating an account). You may withdraw this consent at any time by deleting your account under Section 10.4; withdrawal does not affect the lawfulness of processing carried out before the withdrawal;
• A finding that the receiving country provides protection at least equivalent to the PDPL, or appropriate safeguards (such as Standard Contractual Clauses) if it does not.

For users in the EU/EEA and the UK, where we transfer personal data to a country that has not received an adequacy decision from the European Commission or the UK ICO, we rely on the latest version of the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) entered into with each processor, supplemented by technical and organizational safeguards (such as encryption in transit and at rest).

You may request a list of countries to which your data is transferred, and copies (with commercial information redacted) of the safeguards in place, by writing to privacy@korassa.com.

9. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

If you delete your account (Section 10.4), we will erase or irreversibly anonymize the data above on the timelines stated, except where retention is required by law. Our account-deletion page sets out precisely which fields are erased and which records are retained in de-identified form.

A note on our internal "never delete user data" rule. Our codebase carries a development convention that historical entries are not auto-purged so that long-term reports remain consistent. This convention does not override your right to deletion. When you exercise the right under Section 10.4, we perform an actual erasure or irreversible anonymization on the timelines above.

10. Your Rights

You have the rights below in respect of your personal data. To exercise any of them, write to privacy@korassa.com from the email address registered to your account. We will respond within 30 days (extendable by an additional 30 days for complex requests, with notice to you). There is no charge for routine requests; we may charge a reasonable fee or refuse manifestly unfounded or excessive requests, with reasons.

10.1 Identity Verification

To protect you, we will verify the identity of any requester before disclosing or deleting data. This usually means confirming control of your registered email and providing a one-time code.

10.2 Authorized Agents

You may use an authorized agent (e.g., under California law or a power of attorney) to make a request on your behalf. We will require proof of authorization.

10.3 In-App Self-Service

You can change most profile fields, your email address, your password, your language, your subscription, your PIN, and your biometric setting directly in the App.

To request a copy of your data (the portability right in the table above), email privacy@korassa.com from your registered email address. After identity verification, we will send you a structured, machine-readable copy of your data within 30 days.

10.4 Account Deletion

You can delete your account via Settings → Account → Delete Account, or by emailing privacy@korassa.com. Deletion is irreversible. Our account-deletion page explains the process, the timelines, and exactly what is removed and what is retained.

As described in Section 9, certain records (such as paid invoices) are retained for legally required periods.

11. Children and Minors

Korassa is intended for use by adults 18 years of age and older. We do not knowingly collect personal data from anyone under 18.

If we become aware that we have collected personal data from a person under 18 without appropriate consent, we will:

• Delete the account and associated personal data promptly;
• Notify the parent or legal guardian where we are able to identify them;
• Where required, report to the relevant supervisory authority.

Parents or legal guardians who believe their child under 18 has provided personal data to us can contact privacy@korassa.com, and we will investigate and take appropriate action.

We may, in a future version of the Services, introduce features specifically designed for use by minors under 18 with verified parental consent compliant with Article 3 of the PDPL Executive Regulations and Article 8 GDPR. Any such feature would be governed by an updated version of this Policy and by a separate consent flow. This is not a feature of the current Services.

12. Security

We protect your data using a defense-in-depth program that includes:

• Encryption in transit — all communications between the App and our servers use TLS 1.2 or higher;
• Encryption at rest — production databases and backups are encrypted with industry-standard ciphers (e.g., AES-256);
• Password hashing — passwords are hashed using bcrypt; we never store plaintext passwords;
• Tokenized authentication — Laravel Sanctum bearer tokens, with the option to revoke tokens on logout;
• Local-device protection — optional 4-digit PIN and biometric (fingerprint/face) lock on the App; these checks happen on your device and biometric data never reaches our servers;
• Role-based access control — administrative access is restricted by role (super_admin, admin, support, analyst), audited, and protected by IP allowlisting and 180-day password rotation;
• Audit trails — every administrative action is logged and retained;
• K-anonymity — internal analytics dashboards apply a k≥20 threshold so no aggregate exposes a small group of users;
• Vulnerability management — regular dependency updates, security reviews, and penetration testing prior to major releases.

No system can be 100% secure. If you suspect your account has been compromised, change your password immediately and email security@korassa.com.

12.1 Data Breach Notification

If we become aware of a personal data breach, we will:

• Notify the Egyptian Personal Data Protection Centre within 72 hours, as required by Article 7 PDPL and the Executive Regulations;
• Notify affected data subjects within 3 working days thereafter, as required by the Executive Regulations;
• For users in the EU/EEA, follow the corresponding 72-hour timeline under Article 33 GDPR and notify users without undue delay where the breach is likely to result in a high risk to their rights (Article 34 GDPR).

13. Cookies, Local Storage, and Similar Technologies

The App stores data locally on your device in an on-device database (Hive) so that the App works offline. This local storage holds your transactions, profile, settings, session token, and a quota cache. The local database is cleared when you sign out, delete your account, or uninstall the App.

The App does not use third-party advertising cookies, advertising identifiers, or cross-app tracking SDKs. The App does not rely on Apple's IDFA or Google's Advertising ID.

Our marketing website (korassa.com) uses a session cookie for language preference and, during that visit only, to remember which site or platform you arrived from (for example, Facebook or a search engine), so that a download started from our site can be credited to it. It also records anonymized page-view statistics; it does not use advertising cookies.

Our download links (for example, korassa.com/download/…) set no cookies. When you tap one, we record that the link was tapped, the type of device (iPhone, Android or computer), your browser's user-agent string, the website that sent you to the link (its domain only, if there was one), and a one-way code made from your IP address that changes every day, so we can count unique taps without being able to identify you. Your IP address itself is never stored. You are then sent to the App Store or Google Play, with the name of the link attached so we can tell which link led to the download.

14. Anonymous (Guest) Accounts

You may use Korassa in guest mode without providing an email address. In guest mode:

• We create an account identified only by a pseudonymous identifier (local_xxx) — there is no email address, name, or other identifier attached to it;
• Your data is stored on your device and synced to our backend under that pseudonymous identifier;
• We process the same categories of financial and profile data described above, where you choose to enter them;
• You can convert a guest account to a full account at any time by adding an email and password (the data is migrated and the same retention rules apply).

Because a guest account has no registered email address, we cannot verify your identity by email, and the email-based rights requests in Section 10 are not available to you. Delete the account from within the App (Settings → Account → Delete Account) while you still have access to it. If you have already uninstalled the App, email privacy@korassa.com with the pseudonymous identifier shown in the App and we will assist as far as we are able.

15. Marketing Communications

We will only send you direct electronic marketing (such as promotional emails or push notifications) if you have opted in. You may opt out at any time by:

• Tapping the unsubscribe link in any marketing email;
• Disabling marketing notifications in Settings → Notifications;
• Emailing privacy@korassa.com.

We treat transactional messages (password resets, receipts, security alerts, and material changes to this Policy or the Terms of Use) as service messages, not marketing, and will continue to send them while you have an account.

In Egypt, our direct electronic marketing activity (where conducted) is subject to the licensing regime introduced by the PDPL Executive Regulations, and we will hold the required permit before commencing such activity.

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top;
• Post the new version in the App and on our website;
• For material changes (e.g., new categories of data, new processors in different countries, new purposes, the assignment of operator status from the individual publisher to Korassa LLC, or the migration of app-store distribution from Bright Flag Technology Solutions LLC to Korassa LLC), notify you in-App and by email at least 30 days before the change takes effect, and (where required by law) seek your fresh consent.

Your continued use of the Services after the effective date of an updated Policy means you accept the changes, except for changes that legally require fresh consent.

17. Contact

If you have any questions, complaints, or requests regarding this Policy or your personal data, please contact us:

Postal address: Osama Mohamed Sharkawy, New Cairo, Cairo, Arab Republic of Egypt (until such time as Korassa LLC assumes operator status, after which the operating company's registered office will apply).

You also have the right to lodge a complaint directly with:

• The Egyptian Personal Data Protection Centre (PDPC) — for matters under the PDPL;
• Your local EU/EEA supervisory authority — for matters under GDPR;
• The UK Information Commissioner's Office (ICO), ico.org.uk — for UK matters;
• The California Attorney General, oag.ca.gov — for CCPA/CPRA matters.