Privacy Policy

The short version

We collect what we need to find you activities, verify your hours and give you rewards. We never sell your data, show you third-party ads or track you across other apps. When you check in, we check once that you are near the activity, if you allow it, and keep only near or not near. You can download your record or delete your account in the app at any time.

1. Who is responsible for your data

[COMPANY LEGAL NAME] (commercial registration [CR NUMBER]), [REGISTERED ADDRESS, KINGDOM OF BAHRAIN], is the data controller under Bahrain's Personal Data Protection Law (Law No. 30 of 2018). Contact for anything about your data: privacy@tou3.app, [PHONE NUMBER].

Organisations and businesses you deal with through Tou3 also handle the details they receive about you, for their own activities and offers, and are responsible for how they use them.

2. Who can use Tou3

Tou3 is for people aged 18 and over. We ask for your date of birth to check this and refuse anyone younger. If you think someone under 18 has an account, tell us and we will delete it.

3. What we collect and why

• Account: name, email, date of birth, gender, password (stored hashed) and, if you add them, phone number and profile photo. To create your account, check your age and show organisers who signed up. If you sign in with Google or Apple, we receive your name and email from them.

• Volunteer profile: interests, the kind of volunteer you are, your organisation if you add one, your personal goal and reminder settings. To show relevant activities and count hours toward your goal.

• Activity: sign-ups and cancellations, check-ins, approved hours, corrections and their reasons, problems you report, your tier, and a dated history of what you do in Tou3: activities, hours, offers, clubs, invitations, posts and hearts, records you share, and whether you finished the welcome tour. To keep your volunteer record and, if we add things like badges or streaks later, to count what you have already done.

• Clubs: membership, join requests, plans you share, your posts and photos, and reports and blocks you make. To run clubs and keep them safe.

• Rewards: offers you claim and use. To give you rewards and stop misuse.

• Camera: only while you scan a check-in code. We do not keep the images. Photos: only those you choose to upload.

• Location: one reading when you open the check-in scanner, if you allow it. Our server compares it with the place the organiser set for the activity and keeps only the result, near or not near, which the organiser sees when approving your hours. We do not store your coordinates, follow your movements or use your location in the background. You can refuse, or turn it off in your phone settings, and still check in.

• Notifications: a push token, if you allow notifications. To remind you of activities and tell you about your hours.

• Device and technical data: device model, operating system, app version, IP address and crash reports. To keep Tou3 secure and fix faults. Crash reports do not include your name or email.

• Messages you send us, such as support requests and reports.

• Waitlist: if you join the waitlist on our website, your name, email, whether you are joining as a volunteer, organisation or business and its name, and your WhatsApp number if you add it. Only to tell you when Tou3 opens for you. Ask us and we will remove you.

• How you use the app: which screens you open and what you do there, such as opening an event or claiming an offer, tied to your account when you are signed in and to a random id for this install when you are not. To see what works and decide what to build next. It stays on our own servers, is never sold or used for advertising, and is deleted after 13 months or with your account. We keep only the days you opened the app, as part of your activity history, until your account is deleted. Turn it off in Settings, Help improve Tou3.

We do not collect your contacts or browsing history, we do not keep your location, and we do not use advertising tools or analytics from other companies.

4. Our legal basis

• To perform our contract with you: running your account and the features you use.

• Your consent: notifications, the location check at check-in, optional details such as phone and photo, and sharing plans with your club. You can withdraw consent at any time in Settings. This does not affect anything done before.

• Our legitimate interests: security, preventing fraud and abuse, and fixing faults, balanced against your rights.

• Legal obligations: when the law requires us to keep or disclose something.

5. Who can see your data

• Organisers of activities you join: your first name, the initial of your family name, your photo, your club if you came with one, your attendance and your hours. Not your email, phone or date of birth.

• Businesses, when you claim or use an offer: your first name and initial, and the code. Not your contact details or your history.

• Your club: your first name, your hours this month, your posts and photos and, if you allow it, your plans. The leader also sees when you joined, and any request you make to join.

• Anyone you give a record link or QR code to: your name, your hours and the activities on that record. This is how employers check it. Only share it with people you want to see it.

• Tou3 staff: only the small team who need access to run the service. Changes they make are logged.

• Service providers who work for us under contract: Supabase (database, sign-in, file storage), Vercel (website hosting), Expo (app updates, push notifications), Sentry (crash reports), Apple and Google (sign-in, app stores, push delivery).

• Authorities, when the law requires it, and a company that takes over Tou3, which must keep to this policy.

We do not sell your personal data.

6. Where your data goes

Our providers store and process data outside Bahrain, in places including [PRODUCTION DATABASE REGION], the European Union and the United States. We rely on the transfer routes the Personal Data Protection Law allows, including contractual safeguards. Ask us for details.

7. How long we keep it

• While your account is open, we keep your data so the service works.

• When you delete your account, your profile, hours, sign-ups, activity history, rewards, posts and photos are deleted right away, and your record links stop working. Copies in backups are gone within 30 days.

• Records of staff actions stay in our security log for up to 5 years, without your name. Anything the law requires us to keep stays only as long as it requires.

• Clubs you led continue under a new leader, without your data.

8. Your rights

You can ask us to tell you what we hold and give you a copy, correct it, delete it, stop or restrict using it, or stop using it for a purpose you object to. You can withdraw consent, and you can ask not to be subject to decisions made only by a computer. We do not make such decisions about you.

Most of this is in the app: Profile, Settings, Edit profile; Settings, Download my record; Settings, Delete account. You can also delete your account at tou3.app/delete-account. For anything else, email us. We reply within 30 days.

If you are not happy, you can complain to the Personal Data Protection Authority in Bahrain (pdp.gov.bh).

9. Security

Data is encrypted in transit and at rest. Database rules limit each person to the data they are allowed to see, and admin changes are logged. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the authorities as the law requires. Tell us at once if you think your account has been misused.

10. Changes to this policy

We change the date at the top whenever we update this policy. For important changes we tell you in the app or by email before they apply.