Privacy Policy

Last updated: October 14, 2026

In short:

We only collect what the app needs to work.
We don’t sell your data, use it for ads, or track you.
Only your buddies and crew see your photos and messages.
You can delete your account and all your data from the app at any time.

1. Who we are

Kafu (كفو) is an app that helps you stay consistent with your workouts alongside your buddies and crew. It is run by Mohammad Aldarsani (“we”). For any privacy question, contact us at support@getkafu.app.

2. What we collect

Account: your email, to send you a sign-in code.
Profile: your display name; your birth date (to confirm you’re 18 or older; never shown to anyone); your gender (buddies and crews are same-gender only); your goal, level, training time, weekly target and the languages you speak; and your city and gym if you choose to add them.
Workouts: the photos you take when you check in, and when you checked in.
Activity: your buddies and crew, the Kafus you send and receive, challenges, your points, and your chat messages.
Safety: people you’ve blocked, and reports you send with any details you write.
Device: a push notification token and your app language, so we can send you notifications.

We don’t collect your location, your contacts, or any tracking or advertising data, and we don’t use third-party analytics.

3. How we use your data

To run the app: signing in, saving your workouts, and counting your streaks and points.
To suggest buddies and crews that fit you (same gender, language and goal).
To automatically check workout photos and block inappropriate ones.
To keep people safe: reviewing reports and stopping abuse.
To send you notifications about your buddies, crew and messages.

We rely on the consent you give when you sign up, and on our need to provide the service you asked for.

4. Who sees your data

Your buddies and crew: your name, your workouts and their photos (once approved), your points, and the messages you send them.
People looking for buddies: users of your gender see your name, goal, level, training time, weekly target and languages, plus your city and gym if you added them.
No one: your email and birth date.
People you block (or who block you) can’t see anything from you, and you can’t see anything from them.

5. Companies that help us

We use service providers that process data only on our behalf, and only to run the app:

Supabase: database, sign-in and photo storage. Servers are located in Tokyo, Japan.
Sightengine: automatic checking of workout photos. Photos are sent to them for checking only.
Expo, Apple and Google: delivering notifications to your device.
Resend: sending your sign-in code email.

Some of these companies process data outside Saudi Arabia. We choose providers with strong data protection, and share only what they need.

We never sell your data. We may disclose data if a competent authority requires it by law.

6. Photo checks

Every workout photo is checked automatically before anyone else sees it. If it’s inappropriate, the photo and the check-in are deleted right away. Until it’s checked, only you can see it.

7. How long we keep your data

We keep your data while your account exists. When you delete your account, we delete your profile, photos, workouts, messages and all your data. Copies may remain in backups for a limited time before being deleted automatically.

Reports: if an account is reported, we keep the report, along with the account’s name and email at the time, for two years, even if the account is deleted. This protects users and stops people who break our rules from coming back with a new account. If an email is banned from Kafu, we keep it for as long as the ban lasts.

8. Your rights

Under Saudi Arabia’s Personal Data Protection Law, you have the right to:

Know how we use your data (this page).
Ask for a copy of your data.
Correct your data, from Settings → Edit profile.
Delete your account and data, from Settings → Edit profile → Delete account.
Withdraw your consent at any time, by deleting your account.

For any request, email support@getkafu.app and we’ll reply within 30 days.

9. Age

Kafu is for adults only (18 or older). If we learn that an account belongs to someone younger, we delete it.

10. Security

Data is encrypted in transit, and access is limited by strict rules: each user can reach only their own data and that of their buddies and crew. Still, no system is 100% secure.

11. Changes

If we make an important change to this policy, we’ll tell you in the app before it takes effect.