Privacy policy

1.What we store

Account details: your name, email, password (kept by Supabase Auth only as a one-way hash — nobody can read it), display currency, time zone and language.

Waitlist details you choose to give: WhatsApp number, what you're building, and roughly how many projects you have.

Your content: projects, next actions, blockers, notes and ideas, voice notes and their transcripts, files, links, people and their roles, decisions, costs and reminders.

Technical data: sign-in cookies (set by Supabase Auth, named sb-…-auth-token, they keep you signed in), a language cookie, the times you sign in, your IP address (Supabase Auth keeps it, with your browser type, for each signed-in session, and we keep it for up to a day to slow down repeated sign-in attempts), which screens you open (counts per day, no content), and errors you run into (with your browser type). We don't use advertising cookies or third-party analytics.

Support messages you send us, with the page you came from, your browser and screen size.

2.Why we use it

Only to run KzaFekra for you: to sign you in, show your projects and money numbers, send the reminders you turned on, and support you when you ask.

Admins see your account details, usage counts (for example, how many projects you have, which features you use and storage used), errors you hit and your support messages, to manage access and help you. They don't see the content of your projects, notes, ideas or files.

3.Who else processes data

Vercel: hosts KzaFekra. Our server code runs in Vercel's Dublin (Ireland) region, and your requests pass through Vercel's worldwide network on the way.

Supabase: stores the database, handles sign-in (Supabase Auth) and keeps your files and voice notes (Supabase Storage), all in its Ireland (eu-west-1) region. Uploads go straight from your browser to Supabase Storage.

Email provider (Resend): only when an email is sent to you, such as a sign-in link.

Live voice transcription runs through your browser's own speech service — in Chrome the audio goes to Google, in Safari to Apple. The recording itself is stored only in our private Supabase Storage. You can type transcripts instead.

WhatsApp: only when you message us, or we message you about your account at your request.

4.Security

Passwords are hashed by Supabase Auth, sign-in cookies are secure and http-only (scripts on the page can't read them), files and voice notes sit in private storage and open only through short-lived links we give out after checking you're signed in and they're yours, and every request is checked against your account.

5.How long we keep it

As long as your account exists. Deleted items are removed immediately. You can export everything as JSON from Settings at any time. To delete your account and all its data, contact us and we'll do it.

6.Your rights

You can see, correct, export and delete your data. Contact us for anything you can't do yourself in the app.

KzaFekra is not intended for children under 16.

7.Changes

If we change this policy in a meaningful way, we'll tell you in the app before it applies.