Privacy Policy and Terms of Use | كنت هُنا
This policy explains the data I was here processes for sign-in, saving and sharing memories and communication, and the permissions and choices available to you.
1. I was here operator and contact
I was here is operated by MAZEN ABDULWAHAB QOMAWI Establishment Technical. The Arabic name is مؤسسة مازن عبدالوهاب قوماوي التقنية. For questions about privacy or your data, contact Mazenaqomawi@gmail.com. When you email us, we receive your email address and the information you choose to send. The establishment determines the purposes and means of processing as the controller for I was here, a service for saving, discovering and sharing memories associated with places and communicating with others.
2. Sign-in and account
We use your phone number to send and verify an SMS code when you sign in. We also process verification information, language, policy acceptance, and account and session data to keep you signed in and associate your data with your account. You can browse the areas available to guests; actions such as publishing and messaging require an account. The phone number is stored encrypted during verification and linked to the account after successful verification. An authorized administrator can view it for account administration, support and moderation; it is not displayed to other users. Encryption does not make the number anonymous.
3. Signing in through another account
If you choose to sign in using an account with an external provider available in the app, we process verification data supplied by that provider to complete sign-in, associate it with your account and reverify you when deleting the account. The sign-in process may request permission for your name and email address. You enter provider credentials in the provider’s interface; I was here does not ask for your external-account password in its own fields.
4. Profile information
We process the name, photo and biography you choose to add, along with account privacy and messaging settings. This information is used to display your profile and identify you in memories, friendships and conversations. Private-account and audience settings control display within the app; your name and photo may appear with content you share.
5. Memories, content and attachments
We process the memories you publish, including their title, text, place and coordinates, category and audience, and the photos, videos and audio recordings you choose to attach. We also process private-message text, attachments, replies and reactions to deliver and display them in conversations. The app requests camera and microphone permissions when needed to capture content and lets you select photos and videos from your library. Files you choose to publish or send are uploaded to the I was here service; the app may prepare or compress them before upload.
6. Location with your permission
The app uses device location after you grant permission. Coordinates and location accuracy are used to show nearby memories when you choose and set a publishing location. Browsing and opening memories do not require location permission. Location coordinates are sent to the I was here service in requests for these features, and a published memory is associated with its location. Location updates while you use the app after enabling it. If you enable nearby alerts and grant Always location permission, iOS uses regions around nearby memories to show an alert when you pass them, including when the app is closed. You can disable nearby alerts or change location permission in device settings; location-dependent features may then be unavailable. A memory’s location may reveal a sensitive place such as your home. If you choose to share a location in a conversation, its coordinates, label, source and accuracy when available are sent to the I was here service for display to the recipient.
7. Audience and sharing
You can choose a memory’s audience: everyone, friends, selected friends or only you. This choice is used to determine content visibility. Memory details, content, attachments and locations are available to the allowed audience from anywhere, without a proximity requirement. Profile privacy is separate from each memory’s audience. Consider what you share: deleting content from I was here does not retrieve a copy or screenshot someone saved outside the service.
8. Interactions and message status
We process saves, visit plans, opened memories, reactions, friend requests, friendships and blocks to display your choices and operate these features. Conversations process delivery and read status and activity indicators such as typing or recording audio to show status to the other participant. Notification read status is also used to show unread notifications.
9. Reports and moderation
When you report a memory or message, we send the content identifier and report reason to the I was here service. The moderation interface shows the reported content, its attachments, author information and report status when available. The administration interface also permits an authorized administrator to access profiles, memories, conversations and their attachments, including private or limited-audience content; this access is not technically limited to reported content. Moderation is used to handle reports and abuse and administer the service, and access must be limited to what is necessary for a legitimate purpose. Messages are not end-to-end encrypted. Some administrative actions, such as opening conversations and exporting records, are logged. For account administration and support, we retain the latest approximate connection city and country for registered users and guests. This does not prove their physical location. Only authorized administrators can view it, and it is deleted when the associated account is deleted.
10. Notifications
When you allow device notifications, we process a delivery identifier for your device and your display language to send alerts such as messages, friend requests, reactions and app updates through the device notification provider. Notification content may appear on the lock screen depending on your settings. We process message-delivery acknowledgements, and nearby-memory alerts are scheduled on your device. You can control notifications in I was here settings and device settings.
11. Sharing data with service providers
We share data needed to operate I was here with providers of hosting and storage, phone verification and sign-in, maps, notifications, email and translation. Hosting and storage providers process account data, content and files to deliver the service; the verification provider receives your phone number and verification data to send and check codes. Map services receive map-display requests and location coordinates when you open locations in an external map service. Report alerts sent by email contain the report identifier, type and review link, without attaching private-message text or photos. These providers also process technical data accompanying service requests.
12. Content translation
In versions that support this choice, we use Microsoft Translator to process text and source/target languages only after its author allows translation. One account choice covers all your memory text, bio and messages and can be changed later in account settings. Declining keeps your original text in versions that support this choice. Older versions do not support it and may continue translating until updated. Unanswered consent keeps the original without sending it to the provider in versions that support this choice. Explicit refusal displays a small note in the reader’s language. The server checks current author consent and content access before every provider request. Translation is external rather than on-device and can include non-public text accessible to the reader. We use a bounded session-memory cache and do not create new persistent translated copies; consent is checked before reusing a cached translation. Changing your choice stops future submissions but cannot retrieve text already sent to Microsoft Translator. Use the privacy email for requests concerning previous processing or provider-held data.
13. Data storage and processing
We store account, profile, memory, message, interaction and report data and uploaded files with hosting and storage providers supporting I was here. Hosting and external services may involve processing or storage outside Saudi Arabia. Transfers are subject to the Personal Data Protection Law and the regulation on transfers outside the Kingdom.
14. On-device data and protection
The app stores session credentials in the device’s protected credential storage and preferences such as language and appearance. It may keep content and attachments awaiting sending or upload to complete or retry the operation, and cached media for display. The app uses an encrypted connection to the I was here service, which checks sessions and permissions for access to protected data. Do not send anyone your password or verification code, and report suspected unauthorized access to the privacy email.
15. Required and optional data and its sources
We obtain data from you when you sign in, set up a profile, publish, message or submit reports; from your device when you use permissions and features; from your chosen sign-in provider; and from other users’ interactions with you or reports. Verification through your chosen sign-in method is required for account features; your phone number is required when you choose phone sign-in. A photo, biography, publishing content and sending messages are optional. Location permission is required when posting to save the memory’s place and for optional features that use device location; it is not needed to browse or open memories; camera and microphone access are required when you choose capture or recording; notifications are optional. Refusing a permission prevents or limits its associated feature without preventing browsing of areas available to guests.
16. Your rights and withdrawing consent
Under the Saudi Personal Data Protection Law, subject to its conditions, exceptions and other people’s rights, you have the right to be informed about processing and its legal basis and purpose; access your data and request a readable, clear copy; correct, complete or update it; and request its destruction. You can edit profile data and some options in the app or submit a request to Mazenaqomawi@gmail.com. Where consent is the processing basis, you may withdraw it through that email; you can also disable device permissions and optional features in their settings. Revoking a device permission stops use of that permission but does not automatically delete previously published content. Withdrawal does not affect the lawfulness of prior processing or stop processing supported by another legal basis.
17. Rights requests and complaints
Send data-related requests or complaints to Mazenaqomawi@gmail.com with a description and information that helps identify your account, without sending a password or verification code. Identity verification may be needed before fulfilling the request. The law requires rights requests to be fulfilled without delay within 30 days and permits an extension of up to a further 30 days in the specified circumstances, with advance notice and reasons.
18. Technical diagnostics
We record limited technical events linked to your account to support the app and resolve failures, such as opening selected screens, attempting to publish a memory, and the results of location requests, media preparation and sending a request. Records include event time, a technical attempt identifier, app version, a short error code and request duration; the server may derive an approximate connection country, which does not prove your physical location. These records do not contain memory text, messages, photos, phone numbers, sign-in tokens or precise location coordinates. Authorized administrators access them for technical support, and that access is audited. Diagnostics available for support cover the last 7 days and the latest 200 events per account, subject to a global 100,000-record cap that removes the oldest records, so the available period may be shorter. Expired records are removed during automatic maintenance; removal may be delayed if the service or maintenance is unavailable. Account diagnostics are removed when the account is deleted.
19. Data retention and account deletion
Account data and content remain stored to provide the account and associated features until deleted through available controls or rights requests. Retention needs depend on the data type, purpose and continued existence of the related account, content or request; a verification code or session’s validity is not the retention period for all account data. To request account deletion, open My account, Edit profile, then Delete my account and data, confirm and reverify using your linked sign-in method. The account-deletion process removes profile data, sign-in links, memories, messages you sent and associated records, revokes account sessions and requests deletion of their files from storage; this process records files whose deletion has not completed for retry. Other users’ messages and reports, administrative records and a technical identifier preventing an old session from recreating the account may remain. Derived identifiers and records associated with an active posting restriction may also be retained to prevent its circumvention. Deletion does not retrieve copies saved outside I was here. The law requires destruction of data no longer needed, subject to legally permitted retention; any exception must be limited to its necessary data and purpose.
20. Purposes and consent
The data described in this policy is used to verify and operate accounts, store and display content to the chosen audience, support communication, discovery and notifications, handle reports, protect the service and respond to rights requests. Each processing activity must have a specific purpose and an applicable legal basis; reading or accepting this policy is not blanket permission for all purposes. Where processing relies on consent, that consent must be specific, demonstrable and withdrawable, and separate from other purposes unnecessary for the service. Camera, microphone or location permission does not authorize a different purpose that has not been explained to you.
21. Accuracy and data minimization
Provide only the information needed for the feature you use, and review profile information and content before publishing. You can edit available profile information in its settings or request correction or completion of other data through the privacy email. Handling a correction or access request must use only the verification information necessary to protect your account and other people’s rights. Do not send an identity-document copy or sensitive information without an explanation of the need, legal basis and appropriate channel. Inaccurate or incomplete data does not authorize a new processing purpose.
22. Sensitive information and official documents
Ordinary account fields do not request health or credit records or a copy of your identity document. However, user-uploaded text, photos, videos and recordings may contain sensitive information about users or other people. Avoid publishing official documents, health or credit information, or information exposing others’ privacy. Choosing a private audience does not prevent processing by the service. Content can be reported or its removal requested through reporting tools and the privacy email. Your responsibility for choosing content does not release the establishment from its duties to protect it and process it lawfully.
23. Capacity and guardians
I was here is not directed at children or anyone under 18. Where processing someone’s data requires their legal guardian’s consent, a general statement about parental supervision does not replace the necessary consent and verification. On learning that data has been collected on behalf of someone under that age, the situation must be assessed and processing restricted or data destroyed as required by law. A guardian can submit a request through the privacy email.
24. Disclosure and legal requests
Specific data may need to be disclosed to meet a legal obligation or binding request from a competent authority. The requesting authority, basis and scope must be verified; disclosure must be limited to what is necessary and the decision documented, taking account of legal restrictions and other people’s rights. Sharing content with a user or service provider does not grant unrestricted permission to disclose it for other purposes. The establishment retains its responsibilities under the law when engaging a processor.
25. Marketing communications and content use
I was here uses the phone number for verification and account administration; receiving a verification message is not consent to marketing. Using your content, name or photo in an I was here promotional campaign requires separate, explicit permission; publishing a public memory does not grant that permission. Any marketing communication must identify the sender and allow consent withdrawal and easy opt-out. Refusing an optional marketing purpose does not prevent use of the core service, and notification permission is not blanket authorization for unexplained promotional purposes.
26. Backups and other copies
Removing account data from the primary system does not by itself establish destruction of all backups, provider logs or administrative exports. Fulfilling a destruction request must cover copies for which the establishment is responsible and coordination with processors, subject to specific lawful retention exceptions. We do not promise one universal period or immediate destruction of every copy; you can request information about your request’s status and any justified retention. Restoring an older copy must not make data designated for destruction available again.
27. Data incidents
Report suspected data exposure or unauthorized access to Mazenaqomawi@gmail.com, describing what happened and when you became aware, without resending exposed data unnecessary to understand the report. The law requires assessment and appropriate action. Notification to the competent authority is due within 72 hours of awareness where the reporting conditions concerning harm, rights or interests are met. Affected data subjects must be notified without unjustified delay where required, in clear language explaining the risks, response and contact channel.
28. Content ownership and publishing responsibility
Ownership of the text, photos, videos, audio recordings and other content you publish remains with you or its rights holders; ownership does not transfer to I was here. When publishing or sending content through I was here, you confirm that you own it or have the permissions and rights needed to publish it and grant the license below, including permissions relating to people depicted in it. Do not publish content that infringes intellectual property or other people's privacy.
29. Limited license to operate I was here
When you accept these terms and publish or send content, you grant I was here a non-exclusive, royalty-free license, in the countries needed to operate or host the service, to store, technically copy, display, play, transmit and translate that content and make necessary technical adaptations, such as file compression and previews. The license is limited to providing and protecting the service, in accordance with your chosen audience and privacy settings; it does not permit making private content public. Operating and processing providers may perform these tasks on I was here's behalf only as necessary and subject to the same restrictions. This license does not give I was here the right to sell your content or use it for purposes independent of the service.
30. Use of content in advertising
We request your separate, explicit permission before using your content, name or image in an advertisement or marketing campaign for I was here. Publishing a public memory does not constitute advertising permission, and declining this use does not prevent you from using the service.
31. License termination on deletion
The license for content you delete ends when its deletion from our systems is complete, except for limited processing needed to carry out deletion, legally required retention or a specific dispute as described in Retention. Copies retained for those purposes are not used to republish the content or for marketing. Changing the audience restricts display according to your new choice. We cannot recall copies others saved outside the service. Acceptance of an earlier policy version does not automatically constitute acceptance of this new license; your acceptance of the new terms is required before they apply to you.
32. Use rules and reporting
Use I was here in accordance with Saudi law and others’ rights. Impersonation, threats, blackmail, fraud, harassment, unlawful content, intellectual-property infringement and unauthorized disclosure of others’ data are prohibited. Do not use the service to stalk people, expose homes or enter private property without permission, or operate the map while driving. User-contributed places and memories may be inaccurate. Report through a memory, message or support email. Content may be restricted or removed and accounts or publishing suspended to address violations, subject to law and a review request by email. These rules do not authorize unnecessary administrative access or independent reuse of content.
33. Governing law and statutory rights
This document and use of I was here are governed by the laws in force in Saudi Arabia, including the Personal Data Protection Law and its regulations. Competent authorities and courts handle disputes as provided by law. Nothing waives non-excludable liability or statutory user rights. English is provided for convenience; in case of a difference in meaning, Arabic prevails to the extent permitted by law without reducing your rights. This policy is not a service licence or accepted notification from CST, nor proof of SDAIA registration. Applicable regulatory procedures must be completed separately.