Wejoo Privacy Policy

Version 1 · Effective date: [EFFECTIVE DATE]

1. Who we are

Wejoo is a mobile app that lets people in Dubai give away, for free, items they no longer need to people nearby. Wejoo is operated by [COMPANY LEGAL NAME], a [LEGAL FORM] registered in the United Arab Emirates under trade licence no. [TRADE LICENCE No.] issued by [LICENSING AUTHORITY], whose registered address is [REGISTERED ADDRESS] ("Wejoo", "we", "us").

We decide how and why the personal data described in this policy is used: we are its controller. For any question or request, write to support@wejoo.app. [DPO CONTACT — only if a data protection officer is appointed]

This policy covers the Wejoo app for iOS and Android and the website wejoo.app. It explains what we collect, why, who we share it with, how long we keep it and the rights you have under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").

2. The short version

• We ask for very little: your mobile number, a first name and, if you wish, a profile photo. No surname, no email address, no date of birth, no contacts.
• Your phone number and the exact pickup point are shown only to the other person in an exchange, and only once the giver has accepted that person's request.
• In listings and on the map, an item's location is approximate: it is shown 150 to 400 metres away from the real point.
• Nothing is sold on Wejoo and we never ask for payment details. We do not sell your personal data and we show no advertising.
• Our servers and our database are in the UAE. A few service providers process some data outside the UAE (section 8).
• You can delete your account at any time from the app. It is deactivated immediately and de-identified after 30 days (section 10).

3. The data we collect

3.1 Your account

• Mobile phone number: it identifies your account and lets you sign in. We verify it by sending you a one-time code on WhatsApp.
• First name (2 to 30 characters) and, if you wish, a profile photo.
• Language of the app (English or Arabic).
• Your acceptances: the date on which you accepted the Terms of Use and this policy, the version accepted, and your confirmation that you are 18 or older. We record this confirmation and its date; we do not ask for your date of birth or an identity document.
• Invitations: the invitation or promotional code you used, if any, and the person who invited you.

3.2 Your listings

When you give an item: its photos (2 to 5), its title, description, category and condition, the pickup type (home, building reception or public place), the exact pickup point you choose and the neighbourhood. From the exact point we calculate an approximate public location, offset by 150 to 400 metres. This offset is fixed for each listing, so that the real point cannot be worked out by comparing several displays.

Photos are compressed on your phone before they are sent. [TECH TO CONFIRM: this re-encoding removes embedded metadata such as the GPS position of the photo.] To detect reposted photos and prevent abuse, we calculate a visual fingerprint of each photo and check whether it contains camera capture information.

If an item you received is given on again through Wejoo, its page shows the item's journey: the first name of each successive giver, their neighbourhood and the dates on which the item changed hands.

3.3 Your exchanges

The requests you send (with your optional message to the giver), the requests you receive, the person you choose, cancellations, missed pickups, the handover code (a 4-digit code we generate and show only to the receiver) and the confirmation of the handover. We also keep the history of your dates, the in-app units used to request items, which have no monetary value.

3.4 Ratings

After a handover, each person may rate the other from 1 to 5 stars, with an optional comment of up to 140 characters. Ratings are double-blind: they are published on the rated person's profile, with the first name of the person who wrote them, once both have rated or after 72 hours.

3.5 Safety

The reports you make or that concern you (reason and optional details), the people you block, our moderation decisions and their reasons, and any restriction, suspension or ban.

3.6 Location

If you allow it, the app uses your phone's location only while you are using it, never in the background, to show items near you and to place a new listing. Your position is sent with the request to calculate distances; it is not kept as a location history and it never appears in our logs. [TECH TO CONFIRM: if nearby-item notifications start storing an approximate home area, describe it here.] You can refuse access to your location and choose a neighbourhood instead.

3.7 Device and technical data

An identifier generated by the app for your sessions, the type of device (iOS or Android), the app version, your device's notification token, your IP address (used to protect sign-in against abuse) and technical server logs. Our logs automatically mask phone numbers, codes, access tokens, coordinates and email addresses.

3.8 Usage statistics

To understand how Wejoo is used and to improve it, we record events such as "a screen was opened" or "a request was sent". They are linked to your internal Wejoo account ID (a technical identifier, never your number or your name) or, before you sign in, to a random identifier of the app session, and to your neighbourhood and distance ranges (for example "500 m to 1 km"). These events are pseudonymous: they never contain your phone number, your name, your exact coordinates or the content of your messages.

3.9 Crash reports

When the app or our servers fail, we receive a technical report (the error, the device model, the system and app versions). It is configured to exclude your personal data.

3.10 Messages to support

The emails you send us and our replies.

3.11 What we do not collect

We do not access your contacts, your microphone or your messages. Wejoo has no chat: once a request is accepted, you arrange the pickup with the other person on WhatsApp, and that conversation stays between the two of you, under WhatsApp's own terms; we do not see it. We collect no payment data and we use no advertising identifier.

4. Why we use your data

When you create your profile, you tick a box to accept the Terms of Use and this Privacy Policy. [LAWYER: decide whether a separate consent is needed for usage statistics or for transfers outside the UAE.]

5. Automated moderation

Before a listing is published, its photos and texts are analysed automatically: an image and text moderation service, a list of prohibited terms and a check for reposted photos give it a risk score. Depending on that score, the listing is published, held until a person reviews it, or refused. A listing that receives several separate reports is hidden until it has been reviewed. If you think a decision is wrong, write to support@wejoo.app: a person will review it. We do not use your data to build advertising profiles.

6. Who can see what

• Other Wejoo users see your public profile (first name, photo, average rating and number of ratings, number of items given and received, the date you joined, published ratings) and your listings, with their approximate location and distance.
• The other person in an exchange, once the giver has accepted the request, sees your phone number (to arrange the pickup on WhatsApp) and the exact pickup point. Before acceptance nobody sees them, and they are never shown to anyone else. If you delete your account, the other person no longer sees them.
• The handover code is shown only to the receiver.
• The people you block and you stop seeing each other's profiles, listings and requests.
• If you joined with a friend's invitation, that friend sees your first name and the status of the invitation.
• Our team accesses data only when needed to run the service, moderate content and answer support requests, through an administration tool protected by multi-factor authentication; every action taken there is logged.

7. Our service providers

We use the providers below. They process data on our behalf, on our instructions and only for the purpose described.

We do not sell or rent your personal data, and we do not share it for advertising. We may disclose data when the law requires it, to the competent UAE authorities, or to protect someone's safety.

8. Transfers outside the UAE

Our database and servers are in the UAE, and automated moderation runs in the UAE. Some of the providers listed in section 7 (Meta, Google, Apple, Cloudflare, PostHog, Sentry) may process data in other countries. In particular, all traffic between the app and our servers passes through Cloudflare's global network on its way to the UAE, and may transit through Cloudflare servers in other countries. We transfer to each provider only what it needs, under the conditions set by the PDPL for cross-border transfers. [LAWYER: legal mechanism for each transfer (adequate jurisdiction, contract or consent).]

9. How long we keep your data

We may keep data for longer when the law requires it, or to establish or defend a legal claim.

10. Deleting your account

In the app: Profile → Settings → Delete my account. You can also make the request by email, from any device: see wejoo.app/account-deletion.

• Immediately: your account is deactivated and you are signed out. Your profile and listings are no longer visible to other users, and your listings are removed from the feed. Your exchanges in progress are cancelled, the requests still pending are closed and the dates held for them are returned. The people you were exchanging with no longer see your phone number or the exact pickup point.
• For 30 days: you can change your mind by signing in again with your number; your account is then reactivated. The exchanges cancelled and the requests closed at the time of the deletion are not restored.
• After 30 days: your account is de-identified. Your phone number is replaced by a random technical value and released, your first name is replaced by "Deleted member", your profile photo and location are removed, and the records of your sign-in code requests (fingerprint of your number, IP address) are deleted. Your number can then be used to create a new account, which starts from scratch.
• Pseudonymised, not anonymous: the records we keep remain linked to the internal ID of your account. Nothing derived from your phone number stays attached to them, but they could still be linked back to you in other ways: for example, the people you exchanged with know who they dealt with, and the photos and details of your past listings are kept for now: they are no longer offered to anyone, but people who had saved one as a favourite still see its title and photo, greyed out. We use these records only for the purposes and periods described in section 9.
• What we keep, in this pseudonymised form: the records of past exchanges and the history of dates, the ratings you wrote (shown as written by "Deleted member"), reports and moderation decisions, and usage statistics linked to your account ID, for the periods in section 9. Backups are overwritten within 14 days.

[TECH TO CONFIRM: the photos and details of past listings are currently kept — no longer offered, but still shown greyed out, with title and cover photo, in other users' favourites; define and implement their deletion.]

[TECH TO CONFIRM: the profile photo is unlinked from the account, but its file is not deleted from storage yet (technical gap 1); implement the deletion before publishing.]

11. Your rights

Under the PDPL, you can ask us to:

• tell you what data we hold about you and how we use it, and give you a copy;
• send you your data, or send it to someone else, in a structured format;
• correct data that is inaccurate (you can change your first name and photo yourself in Settings);
• delete your data;
• restrict or stop the processing of your data in certain cases;
• review a decision based solely on automated processing that significantly affects you;
• withdraw your consent at any time, without affecting what was done before.

To exercise these rights, write to support@wejoo.app. As we do not hold your email address, we will first check that you are the account holder [VERIFICATION PROCESS TO DEFINE: e.g. confirmation from the phone number of the account]. We will answer within [RESPONSE TIME: e.g. 30 days]. You may also lodge a complaint with the UAE Data Office.

12. Security

Encrypted connections (HTTPS/TLS); database and cache encrypted at rest; sign-in tokens kept in your phone's secure storage (iOS Keychain or Android Keystore); sign-in codes never stored in readable form; phone numbers looked up through a keyed fingerprint; masked logs; team access limited by role, with multi-factor authentication and an audit log. No system is completely secure: if a breach affects your data, we will inform the UAE Data Office and you, as the law requires.

13. Minimum age

Wejoo is only for people aged 18 or over. You confirm your age when you create your profile. If we learn that an account belongs to someone under 18, we close it. Please contact us if you think a minor is using Wejoo.

14. Permissions on your phone

• Location, only while you use the app: to show items near you and place your listing. Optional.
• Camera and photos: to add photos to a listing or to your profile, and only the photos you select.
• Notifications: requested after your first listing or request, never at first launch. Optional notifications can be turned off in Settings → Preferences; notifications about your ongoing exchanges are always sent while notifications are allowed on your phone.

You can change these permissions at any time in your phone's settings. Wejoo does not use the microphone, does not read your contacts and does not track you across other companies' apps or websites.

15. Our website

The website wejoo.app uses no cookies, no analytics and no trackers. Our host, Cloudflare, processes technical connection data such as your IP address to deliver and protect the site.

16. Changes to this policy

We may update this policy. We will inform you in the app before a significant change applies and, where required, ask you to accept the new version. The version number and the effective date appear at the top of this page.

17. Contact

[COMPANY LEGAL NAME] · [REGISTERED ADDRESS] · support@wejoo.app

This policy is available in English and Arabic. [PREVAILING LANGUAGE: which version prevails in case of discrepancy — LAWYER TO CONFIRM]