سياسة الخصوصية
Privacy Policy

Privacy Policy (English)

Last updated: 31 October 2026 · Effective: 31 October 2026

This policy explains what data the Sofra Dayma («سفرة دايمة») app (Android now, iPhone later) and its shared-list web page handle, why, where it is stored, and how to delete it. If the Arabic and English versions differ, the Arabic version applies [for legal review].

1. Who we are

Sofra Dayma is owned and run by Amwaj Technology («أمواج للتكنولوجيا»), Egypt [for legal review] ("we", "us"). We are responsible for the personal data handled through the app and the shared-list page.

Full legal name, commercial registration number and address: to be added [for legal review].

Contact: amwaj.sofradayma@gmail.com · WhatsApp support +20 155 553 1180.

This policy is written with Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations in mind [for legal review].

2. Using the app without an account

If you choose "continue without account", your data (household setup, menu, shopping list, the ingredients you have at home, «طبختها» cooked history, saved receipts, the «اسأل الطبّاخ» chat, settings) stays on your phone and is not sent to our servers. What is sent in that case: the things you ask for directly — reading a receipt photo (section 5), the messages you type to «اسأل الطبّاخ» (section 6) and sharing your list as a link (section 8); usage statistics under a random ID (section 3e); and what is needed to show ads (section 7).

3. Data we handle

a. Account data (only if you sign in with Google). Sign-in is with Google only — no phone number, no password. We request only the basic scopes (openid, email, profile) and receive your name, email address, profile photo URL and account identifier. These are stored in our account database.

b. App data synced to your account (only when signed in):

• Household setup: number of adults and children (numbers only, no names) and your weekly lunch budget. The app no longer asks for your city; one is kept only if it was entered in an earlier version (a city, not an address).
• Settings, weekly menu (including dishes you added from «اسأل الطبّاخ»), fixed weekly dishes, disliked dishes and preferences.
• Pantry contents, shopping-list ticks, cooked history.
• Saved receipts: date, total, item lines with quantities and prices, and the list estimate (never the photo).

c. Receipt photos — when you choose to take or pick one; see section 5.

d. «اسأل الطبّاخ» messages and the shared list — when you type a message to the chef (section 6) and when you share your list as a link (section 8).

e. Technical data.

• Receipt-scan limits: a daily counter of scans, keyed by your account ID if you are signed in, or for guests by a one-way hash (SHA-256) of a random key kept on the phone and a hash of the network (IP) address. Counters are deleted after 30 days.
• «اسأل الطبّاخ» limits: a daily counter of typed messages, keyed by a SHA-256 hash of your account ID, or for guests of a random key kept on the phone. Deleted after 14 days. For each message we also log one line without the message text: that same hash, the time, the outcome (answered, off-topic, daily limit, service off, or error), the model name, the response time and the number of dishes suggested. Used for aggregate numbers in our admin panel; kept for up to about 3 months, then turned into monthly totals only (no hash).
• Usage statistics (our own, not a third-party tool): the app sends simple events — app opened (once a day), a recipe opened, «طبختها» (cooked), a dish added to «أسبوعي» from «اسأل الطبّاخ», and our own ads shown or tapped. Each event carries a random ID created on the phone, the app build number, the dish name or the ad's ID and place, the time, and your account ID if you are signed in. They contain no name or email. The events themselves are kept for 12 months (we fold whole months at a time, so up to 13 months), then turned into monthly totals only (such as app opens per month, number of devices, and opens per recipe or views per ad) with no ID at all; these totals are kept indefinitely. When you delete your account, your events stay counted as anonymous statistics: we remove the account ID and replace the random ID with a new one that cannot be linked to you or your phone.
• Server logs: our hosting provider keeps standard technical logs (e.g. IP address, time and type of request) for security and operations, for a short period set by the provider [for legal review].

f. Contacting us. If you email or WhatsApp us, we receive your message and the address or number it came from, and use them only to reply. WhatsApp is a Meta service and its own terms apply.

What we do not collect ourselves: precise location, contacts, microphone or payment data. There are no third-party analytics SDKs and no crash-reporting tools in the app (our own usage statistics are described in section 3e). What Google AdMob collects when it shows its ads (including the advertising ID) is described in section 7. The camera and photo library are used only to pick a receipt photo when you choose to.

4. Why we use data

• To run your account and restore your data on any phone.
• To plan the menu to your budget, estimate approximate prices and build your shopping list.
• To read receipt photos and update your list, pantry and actual spend after you review them.
• To run «اسأل الطبّاخ»: answer your messages, suggest dishes from our recipes, and put the dish you choose into «أسبوعي» (your week), updating the shopping list and budget.
• To run shared-list links.
• To show ads (our own ads and Google AdMob ads) and count how often our own ads are shown and tapped; ads help keep the app free.
• For aggregate usage statistics that help us improve the app (such as the number of users, the most-opened dishes, and which app versions are in use).
• To prevent abuse (including the limit of 20 receipt scans per day and a daily limit on typed «اسأل الطبّاخ» messages, currently 15, which we may change) and keep the service secure.
• To answer support messages and comply with the law.

Legal bases: your consent, providing the service you asked for, and our legitimate interest in keeping the service secure, improving it and funding it through ads [for legal review].

The optional nightly reminder is scheduled locally on your phone; there is no push server. You can turn it off in settings.

5. Receipt photos and Google Gemini

Receipt scanning is optional. When you use it:

1. The app sends the photo over an encrypted connection (HTTPS) to a function on our server (Supabase, EU).
2. That function sends the photo to Google's Gemini API to read the lines, and returns the items, quantities, prices, total and date to the app. We do not extract the store name.
3. We do not store the photo: it is processed in memory only and then discarded.

After reading, a review screen appears; nothing is saved until you confirm. The saved receipt (without the photo) stays on your phone, and is synced to your account if you are signed in.

6. «اسأل الطبّاخ» (Ask the Chef) and Google Gemini

«اسأل الطبّاخ» is a chat that helps you choose a dish from what you have at home. The buttons, the ingredient picker and the suggestions based on them work on the phone itself and send no text. When you type a message:

1. The app sends your message over an encrypted connection (HTTPS) to a function on our server (Supabase, EU), together with: your household size, the ingredients you picked or have at home, this week's lunches in «أسبوعي», and the last few chat messages (up to 6) so the chef can follow the conversation. Your name and email are not sent.
2. The function adds our recipe list with its ingredients and approximate prices, and sends all of this to Google's Gemini API to write the reply and suggest dishes from our recipes only.
3. We do not store the text of your messages or of the replies on our servers. The chat history is kept on your phone only (it is not synced to your account even if you are signed in); you can clear it with «امسح المحادثة» (Clear chat), and it is also wiped when you delete your account.
4. For usage limits we keep a daily counter and a log without the message text, as described in section 3e. If you choose to cook a suggested dish, it is added to «أسبوعي» like any other menu change, and we record an anonymous usage event.

The chef's replies are automatic and may be wrong; prices shown on the dish cards are approximate and come from the app's own data. Typed messages have a daily limit (currently 15); the buttons do not count towards it.

7. Ads

The app shows ads that help keep it free, in set places (such as between the days in «أسبوعي» and at the bottom of some screens), and full-screen ads at transitions between screens, limited per day; they are not shown when the app opens or during cooking steps.

• Our own ads: an image, text and link that we place ourselves. They are not sent to any ad network. We record when they are shown and tapped, under the random ID (section 3e). Tapping one opens its link outside the app, where the link owner's policy applies.
• Google AdMob: when switched on, Google shows ads (banner, native ads within the content, and full-screen ads). To serve and measure ads and prevent fraud, Google and its partners may collect from your phone: the device advertising ID, your IP address (and from it an approximate location), device and app information, and your interactions with ads, and may show personalised ads. The app requests the advertising ID permission (AD_ID) and Google's ad library may use Android's ad services (Privacy Sandbox) where available. Learn how Google uses data at How Google uses information from sites or apps that use its services.
• Consent and choice: before Google ads start, the app asks Google's consent tool (UMP), which shows a consent form only in countries whose law requires it (such as the EU and UK); there, «خيارات الخصوصية للإعلانات» (Ad privacy options) appears in «حسابي» to change your choice. In Egypt no consent form is currently shown [for legal review]. You can always reset or delete your advertising ID in Android settings (Privacy → Ads).
• We do not sell your data to advertisers, and we do not send Google your account, menu or chat data for advertising.

8. Shared list links

When you share your list, the server stores a read-only snapshot with the items to buy, quantities, approximate prices, totals and items marked "at home". It contains no name, budget, household data or phone number.

• Anyone who has the link can open it for 30 days (renewed when you share again) or until you stop sharing. Share it only with people you know.
• We count how many times the link is opened.
• Stopped or expired snapshots are deleted within about 7 days after they end.
• For guests, proof of ownership is a random key kept on the phone; the server stores only its SHA-256 hash.

The shared-list page uses no cookies and no trackers. Sending the link happens through your phone's share sheet (e.g. WhatsApp), and that app's terms apply.

9. Prices, photos and recipes

The app downloads from our server a public price catalogue, the recipes and dish photos, our own ads and the app's settings; no personal data is sent for that (only the technical logs in section 3e). "Original recipe" links open the chef's video or page in the YouTube app or your browser, outside Sofra Dayma, where Google's or the site owner's policies apply. There is no video player inside the app.

10. Who we share data with

We do not sell personal data. We only work with:

• Supabase — database, sign-in and server functions, hosted in the EU (Frankfurt, Germany).
• Google — Google sign-in; reading receipt photos and «اسأل الطبّاخ» messages through Gemini (see sections 5 and 6 about the free tier); and showing ads through Google AdMob, which collects device data directly for advertising as described in section 7.
• Authorities — where the law requires it.

11. Where data is stored and transfers outside Egypt

Our servers are in the EU (Frankfurt, Germany), and Google may process receipt photos, «اسأل الطبّاخ» messages and advertising data in other countries, so data is transferred outside Egypt. Licence/permit requirements of the Personal Data Protection Center for cross-border transfer, and the safeguards required [for legal review].

12. Security

All connections are encrypted (HTTPS). The database enforces row-level security so each account can only access its own rows. Service keys (including the Gemini key) are held on the server only, never in the app. No system is 100% secure; if a breach happens we will notify users and the authorities as the law requires [for legal review].

13. Retention

• Account and app data: kept while your account exists; deleted when you delete the account.
• Receipt photos and the text of «اسأل الطبّاخ» messages: never stored on our servers (the chat history stays on your phone until you clear it).
• Shared list links: 30 days from the last share or until stopped, then deleted within about 7 days.
• Receipt-scan counters: 30 days. «اسأل الطبّاخ» counters: 14 days, and its request log (no text): up to about 3 months, then monthly totals only.
• Usage statistics and our own ad events: the events themselves for 12 months (up to 13), then monthly totals only with no ID, kept indefinitely.
• Hosting-provider backups: data may remain for a short time before being overwritten [for legal review].

14. Deleting your account and data

In the app: «حسابي» (My account) → «مسح الحساب» (Delete account) → confirm. This deletes your account and all data stored with it from our servers, and all app data on the phone (including the «اسأل الطبّاخ» history). Usage statistics (section 3e) stay counted as anonymous numbers: at the moment of deletion we remove the account ID and cut their link to your phone; after 12 months they become monthly totals only. Without the app: email amwaj.sofradayma@gmail.com from the Google address you signed in with. Full details: Delete account.

Uninstalling the app does not delete your account on our server.

15. Your rights

You have the right to know what data we hold about you and get a copy, to correct it, to delete it, and to withdraw your consent at any time (for example by no longer scanning receipts or typing to the chef, through «خيارات الخصوصية للإعلانات» (Ad privacy options) where shown, or by deleting your account). Requests: amwaj.sofradayma@gmail.com. You may also complain to Egypt's Personal Data Protection Center [for legal review].

16. Children

The app is intended for users aged 13 and over (users under 18 should use it with a parent or guardian's consent) and is not directed to children under 13 [for legal review]. The number of children in the household setup is a number only, with no data about them.

17. Changes to this policy

When we update this policy we change this page and its "last updated" date; the link in the app always opens the latest version. Material changes are announced in the app.

18. Contact

Amwaj Technology, Egypt [for legal review] · amwaj.sofradayma@gmail.com · WhatsApp +20 155 553 1180