About this notice
Nubadir (نبادر) is a volunteering app and website for Kuwait, run by its founders Mahmoud Albustan and Fahad AlHajeri. This notice covers the Nubadir app for iPhone and Android, nubadir.com and its launch waitlist. It explains what we collect and why, who can see it, which companies process it for us, how long we keep it and how to delete it. Questions and requests: info@nubadir.com.
Your account
You sign in with your mobile number, using a one-time code or a password if you set one. We store the number, your first and last name, the name shown on your profile and, if you add them, your city and profile photo. A password is stored only as a one-way hash. We also store your language, when the account was created and when it was last used. Your phone number is never shown on your profile.
Initiatives, organisations and participation
We record the initiatives you join, leave or wait for, and whether you attended. Your verified hours, points, badges and streak come from attendance that an organiser approved. If you create or help run an organisation or an initiative, we store what you publish about it (its name, description, times, place, cover and logo) and who its members, admins and helpers are. Invitation links record who used them.
Check-in: your location and a selfie
When you check in, the app reads your location once, at that moment, and sends the coordinates, their accuracy and the time. We compare them with the initiative’s site and keep them with the check-in, together with your distance from the site. You then take a selfie with the camera.
Check-in selfies are private. They never appear on your profile, in the feed or at a public link. Only the people who review attendance for that initiative can open them: the owner and admins of its organisation (or its organiser, for an older initiative that has no organisation), the helpers added to it, until the initiative is cancelled or 7 days after it ends, and Nubadir administrators allowed to review attendance. Reviewers see how far you were from the site, not your exact coordinates. A person always makes the attendance decision.
Other uses of location
- Nearby initiatives: to show how far each initiative is and list the closest first, the app uses your position on your phone. It is not sent to us for this.
- Post locations: a post has no location unless you add one. You can attach your current position, or a point you choose on the map with its place name. The location is published with the post, and everyone who can see the post can see it.
- Place names: to name a point you chose, the app asks your phone’s built-in geocoding service (Apple’s on iPhone, usually Google’s on Android), which receives that point.
- Arrival nudge (iPhone only): if you turn on Arrival nudge and allow “Always” location, iOS lets the app notice when you reach an initiative you joined and show a reminder to check in, even when Nubadir is closed. The check runs on the iPhone itself: the app gives iOS only the coordinates of those initiatives, and no location is sent to us from the background. Turn it off in Profile → Settings, or in the iPhone’s location settings. The Android app does not use location in the background.
- Maps and directions: the maps in the app come from Nubadir’s own map server. If you tap Directions, the app opens the map app you choose (Apple Maps, Google Maps or Waze), and that app’s own policy applies.
Posts, photos and videos
Other people using Nubadir can see your profile (name, photo, city, verified hours, points, badges and streak), your posts and your comments. A post shared only with an initiative’s participants is visible only to them. Photos and videos in public posts, profile photos and initiative covers can be opened by anyone who has their link. Before a photo or video you publish is stored or shown, we remove its hidden metadata, such as the GPS position, the device and when it was taken. Photos and videos uploaded before we added this step may still carry it until they are replaced or deleted. Videos keep the sound you recorded. You can delete your posts and comments at any time.
Reports, blocks and moderation
If you report a post or comment, we keep the report and the reason you gave; the person you reported is not told who reported them. If you block someone, we store that so neither of you sees or can interact with the other’s posts and comments. Nubadir administrators can review reports, hide or remove content and suspend accounts, and every administrative action is recorded in an audit log.
Messages we send you
Sign-in codes are sent by SMS through Twilio, which also creates and checks the codes. Reminders, changes to initiatives you joined and messages from their organisers appear in the app and may also be sent by SMS, from Nubadir’s own number or through Twilio. Twilio receives your phone number and the message. We do not use your number for marketing. We do not use WhatsApp today; sign-in codes may be sent by WhatsApp, through Meta’s WhatsApp Business Platform, only if we switch it on in future.
AI features
Translate, and the assistant that drafts a report of a problem, send the text you give them to an open AI model (Llama) that Cloudflare Workers AI runs on Cloudflare’s servers; the text is not sent to Meta. We do not log that text, and a translation is cached for 24 hours so that asking again costs nothing. When selfie screening is switched on, an image classifier on Workers AI checks each check-in selfie for signs that it is a photo of a screen or of a printed picture, shows the result to the reviewer, and can refuse an upload that is clearly a photo of a screen.
Who can see what
- People using Nubadir: your profile, your public posts (with any location you attached), your comments, and public initiatives and organisations.
- The owner and admins of the organisation running an initiative you joined (or its organiser, for an older initiative that has no organisation): your name, phone number, participation status, check-in time, distance from the site and check-in selfie.
- The helpers they added to that initiative: the same, except your phone number, until the initiative is cancelled or 7 days after it ends. By default, a link that makes someone a helper works for one person and expires after 48 hours.
- Nubadir administrators: what they need to run the service, answer requests and moderate content. Their access depends on their role and their actions are recorded.
Service providers
- Cloudflare: hosting for the app’s servers, database, photo and video storage and this website; the website’s bot check (Turnstile); the AI features (Workers AI); and routing of email sent to info@nubadir.com.
- Twilio: SMS sign-in codes and SMS messages.
- Meta (WhatsApp): not used today. Only if we switch on WhatsApp sign-in codes in future would Meta receive your phone number and the code.
- Apple and Google: place names for points you choose on the map, through your phone’s geocoding service.
- Google: the website’s fonts come from Google Fonts, which receives your IP address when a page loads, and email sent to info@nubadir.com is forwarded to the founders’ Gmail inboxes.
These companies may process information outside Kuwait. We do not sell personal information, and neither the app nor the website contains advertising or analytics trackers.
The waitlist and the website
The launch waitlist on nubadir.com collects your email, phone number, the role you chose, your language, when and from where you signed up, and your IP address, and Cloudflare Turnstile checks that you are not a bot. We use this only for launch invitations and to prevent abuse. The website keeps your language choice in your browser.
On your device
The app keeps your sign-in in your phone’s secure storage, with settings such as language and appearance and, on iPhone, the initiatives it watches for Arrival nudge. It asks for location, camera, microphone (for video sound), photos and notifications only when you use a feature that needs them, and you can refuse or withdraw each one in your phone’s settings. Without location and the camera you cannot check in.
How long we keep information
- Your account and profile, posts, comments, notifications and check-in selfies: until you delete them (where the app allows it) or delete your account.
- Sign-in codes: they stop working within minutes, and our records of them are deleted 24 hours after they expire.
- Sign-in sessions: 30 days, or until you sign out or delete your account.
- Photos and videos you uploaded but never posted: 24 hours.
- Translations: cached for 24 hours.
- Technical logs of requests to our servers, which can include your IP address and the address requested: kept by Cloudflare for up to 7 days.
- Waitlist entries: until you ask us to remove them. They are separate from app accounts, so deleting your account does not remove one.
- Attendance records and the administrative audit log: kept without your name after you delete your account, so that organisers’ records stay correct. They have no fixed end date yet.
- Backups: the database is backed up weekly and each backup is deleted after 90 days, so deleted information can remain in a backup until then.
Deleting your account
You can delete your account in the app at any time: Profile → Settings → Account → Delete account. It takes effect immediately. Your name, phone number, photo, posts, comments, votes, follows, blocks, notifications, badges, memberships and check-in selfies are removed, and you are signed out everywhere. Attendance records stay without your name. If you own an organisation, ownership passes to its longest-serving admin; if it has no admin, the organisation is closed and hidden. The initiatives of an organisation that continues stay with it. Before deleting, you are asked to cancel only initiatives that have not ended yet, including any already in progress, of two kinds: those you organise that belong to no organisation, and those of an organisation you own that would close. The Delete your account page has the full list, and how to ask by email if you no longer have the app.
Your choices and requests
In the app you can edit your profile, delete your posts and comments, block people, turn off Arrival nudge and delete your account. To ask for a copy of your information, a correction, or the removal of a waitlist entry, email info@nubadir.com with the phone number or email address concerned. We may ask you to confirm that it is yours, and we reply within 30 days.
Changes to this notice
We will update this page when our data practices change, and change the date at the top.