Privacy policy

1. What we collect

• When you create an account: your name, your email address, your password (stored encrypted — we cannot read it) and your phone number.
• When you book: the dates, the place, the number of people and the payment method you choose.
• When you apply to verify a host account: your ID or passport number and photos of the document, your governorate and how you want to receive your payouts, as well as your listings' details, photos and location.
• Location: only your approximate location, and only if you allow the app to use it, to show places and transfer offices near you.
• Technical data: device type, language, network address and a log of sign-in attempts, to protect your account from intrusion.

2. How we use your data

We use your data to run each booking from request to stay, to verify bookings by phone, to verify hosts, to calculate commission and transfer payouts, to detect fraud and duplicate accounts, and to answer support requests over WhatsApp or email.

Your phone number is not shown to the other party in a booking until payment is complete, and the exact address of a place is not shown to the guest until then. We do not use your data for targeted advertising and we do not sell it to anyone.

3. Signing in with Apple and Google

You can create your account or sign in with Sign in with Apple or a Google account instead of an email and password. When you do, the provider sends us a stable identifier for your account, plus your email address and name if you allow them to be shared — we never get your password with them or anything else from your account. If you choose to hide your email with Apple, we receive an Apple relay address instead of your real email, and we treat it as your email.

The app also uses Google's Firebase to verify your phone number by text message and to manage social sign-in. In that case Firebase receives your phone number and your device identifier, under the Firebase Privacy Policy.

4. Notifications

If you allow notifications, we send news about your booking to your device: a new request reaching the host, the host accepting or declining, payment opening and its deadline approaching, payment being confirmed, and the team's decision on a verification or a listing. To do this we keep your device's notification token — an identifier that does not reveal who you are and is deleted when you sign out or delete your account. Notifications pass through Apple Push Notification service and Firebase Cloud Messaging. We do not send marketing notifications.

You can turn them off at any time in your device settings, or inside the app under Profile → Notification settings — the app works fully without them.

5. Payment

Payment by transfer goes through the Katfi office, and we keep the transfer number and the receipt photo you upload as proof of payment. Card payments are handled by Stripe: your card details never pass through our servers, and we never see or store them — you enter them in Stripe's own window, and we receive only the result of the transaction and its identifier, under the Stripe Privacy Policy.

6. Storage, sharing and retention

Your data is stored on Katfi's servers. Photos of identity documents are kept in protected storage that only authorised verification staff can access; they are never published or shared with anyone else.

We share only the minimum data, and only when needed:

• your name and number with the host or the guest after payment;
• your name and the amount with the transfer office, to carry out a payment or a refund;
• official authorities, when there is a binding legal request.

We keep records of bookings, payments and payouts for five years for financial and accounting purposes, even after an account is deleted. Document photos are deleted when the account is deleted or closed, unless the law requires otherwise.

7. Your rights and deleting your account

You can view and correct your data from “Edit profile” in the app, change your password, and end your sessions on all devices.

You can delete your account from inside the app, in your profile. Your sessions are then revoked, your listings are hidden and your profile is deleted within 30 days — except for the financial records mentioned above and any ongoing bookings that have not ended yet.

You can withdraw the location, photos or camera permission at any time in your device settings. To request a copy of your data, or for any question, contact support.

8. Security, contact and changes

All traffic between the app and our servers is encrypted (HTTPS), passwords are stored hashed, and your session is kept in your device's secure storage. We do not accept accounts from anyone under 18 and we do not knowingly collect children's data.

To contact us about your privacy, use the “Contact support” screen in the app to reach us on WhatsApp, or email us at support@katfi.app.

We may update this policy when our services change, and we will let you know inside the app and update the date below.