Privacy Policy

Who we are

Wasfa is operated by Wasfa Technology Trading, registered in Qatar. We are responsible for the personal data described here. You can reach us any time at hello@wasfa-app.com.

What we collect

Account details: your email address, the handle you choose, and — if you sign in with Apple or Google — the name and email those services pass to us. If you use Apple's Hide My Email, we only ever see the relay address.

What you create in the app: recipes, menus, photos you upload, the notes and steps you write, the people you follow, and what you add to This Week.

Links you paste: when you save a recipe from TikTok or Instagram we receive the link and the public content behind it (caption, thumbnail, and where available the video's audio).

What you say to the voice button: while you hold it, the app records you and sends that recording to be turned into text. The recording is used for that and nothing else, and we do not keep it.

Technical data needed to run the app: a device token if you turn push notifications on, and crash diagnostics if the app stops unexpectedly.

What we do with it

We use your data to run Wasfa and nothing else: to sign you in, to store and sync your recipes, to show your profile to the people you allow, to send the notifications you asked for, and to fix crashes.

We do not sell your personal data. We do not share it for advertising. We do not build advertising profiles.

We do not use analytics

Wasfa ships with no analytics or tracking software. We do not measure your taps, screens, sessions, or funnels, and there is no advertising identifier in the app. If that ever changes, this policy and our App Store privacy label will be updated in the same release.

When you paste a link

Turning a video into a recipe is done by outside services. The link you paste, the public caption behind it, and — when the recipe is spoken rather than written — the audio of that video, are sent to OpenAI and to Google (Gemini) so the ingredients and steps can be read out of it. Fetching the public post itself may go through Supadata or a RapidAPI provider.

When you tap Translate on a recipe, its title, ingredients and steps are sent to OpenAI to be translated into your language.

These services process that content to answer our request. They are not permitted to use it to train their models, and we do not send them your email, your name, or the rest of your account.

When you use the voice button

Holding the voice button records you, and only while you hold it. The app stops recording the moment you let go.

That recording is sent to OpenAI to be turned into text, and the text is used to put a menu together. We do not store the recording — neither the app nor our servers keep a copy — and it is not attached to your name or your email.

The microphone is never opened at any other time. If you refuse the microphone the rest of the app works exactly as before; only the voice button stops working.

Photos

Photos you upload are stored in our cloud storage and shown according to the visibility you set on the recipe. Deleting a recipe deletes its photos. Deleting your account deletes all of them.

Push notifications

If you allow notifications we store a device token so we can send them — for example when someone follows you. Turn them off in your device settings at any time and the token stops being used.

Crash reports

When the app crashes we receive a technical report (device model, operating system version, and where in the code it failed) through Sentry, whose servers are in the European Union. A report carries a random account number so we can tell one person's repeated crash from many people's, but never your name, email or recipes. Crash reports are kept for 90 days.

Who else handles your data

Supabase — database, sign-in and photo storage. Servers in Mumbai, India.

Expo — app delivery and push notification sending. Servers in the United States.

Apple and Google — only if you choose to sign in with them.

OpenAI, Google (Gemini), Supadata and RapidAPI providers — only for reading a recipe out of a link you paste and, for OpenAI, translating a recipe you ask to translate and turning what you say to the voice button into text, as described above.

Sentry — crash reports. Servers in the European Union.

Where your data goes

Wasfa is run from Qatar, your account and content are stored in India, and the services above are in the United States and the European Union. Using the app means your data is transferred to those countries. We use providers who commit to protecting it under standard contractual terms.

How long we keep it

Your account and content are kept for as long as your account exists. Deleting your account removes your profile, recipes, menus and photos immediately and permanently — it cannot be undone. Copies inside our encrypted backups are overwritten within 30 days. Crash reports expire after 90 days.

Your rights

You can see and edit your content in the app at any time, and delete everything from Settings → Delete account.

You can also ask us for a copy of your data, ask us to correct it, or ask us to delete it on your behalf. Email us and we will answer within 30 days.

Children

Wasfa is not for children under 13, and we do not knowingly collect their data. If you believe a child has an account, email us and we will remove it.

Changes

If we change this policy we will update the date at the top, and tell you in the app if the change is significant.

Contact

Questions about privacy: hello@wasfa-app.com.