Privacy Policy for Rihla

Last updated: August 28, 2026

Rihla ("the app", "we", "us") is a mobile application that encourages people to visit and learn about historical and cultural sites, starting in Egypt. This Privacy Policy explains what information the app handles, how it is used, and the choices you have. It reflects the app exactly as it currently works — it does not describe features the app does not have.

Information We Collect

1. Information stored only on your device

The following is saved locally on your device and is never transmitted to us or anyone else:

• Your progress — the list of heritage sites you have discovered.
• Your language preference — English or Arabic.
• An optional display name — if you choose to type a name on the Profile screen. This stays on your device only.
• Your token wallet and story unlocks — the tokens you have earned and spent, which stories you have opened, and the record of what earned each token.
• Your reading position, streak and mission progress — how far through a story you are, your daily streak, and progress toward in-app missions.
• A record of your rewarded-ad activity — which rewards you have claimed and when, so daily limits and cooldowns can be applied.
• Downloaded country packs — which country content packs you have installed, and the story text and images belonging to them.
• A short history of your verified visits — see the note below.

About the visit history. To stop tokens being farmed with a fake-location app, the last 50 visits you were paid tokens for are kept on your device as a site identifier, a timestamp, and the coordinates the check was made at. The app compares them locally to spot impossible travel between two visits. This is the one place the app keeps coordinates. It is stored only on your device, it is never transmitted to us or to anyone else, and each new visit pushes the oldest one out of the list.

All of the information in this section is removed when you uninstall the app or clear its data.

2. Usage and diagnostic analytics (Firebase Analytics)

We use Google Firebase Analytics to understand how the app is used in aggregate. This includes events such as: opening the app, viewing a screen, opening a site or a reading, completing a reading, starting or completing a guided journey, starting or completing a visit verification, changing the app language, and the outcome of a location-permission request. Your selected app language is recorded as an analytics property.

Firebase Analytics also automatically collects standard technical information, which typically includes a Firebase-generated app instance identifier, device model, operating system version, app version, and an approximate location (country/region) derived from your IP address. We do not link this data to your name or identity.

3. Visit records (Supabase)

When you successfully verify that you are physically at a heritage site, the app records the identifier of that site in a database hosted by Supabase. These records contain no coordinates and no device identifier. The connection is insert-only, so the app cannot read individual records back.

• Signed out — the record is anonymous. It contains the site identifier and nothing that could identify you or your device.
• Signed in — the record additionally carries your account's user id, so a verified visit is linked to your account. This is the one place an account id is attached to your activity.

4. Account information, if you sign in (Supabase Auth)

Accounts are optional and off by default; see the "Accounts" section below for what an account does and does not do. If you do sign in, authentication is handled by Supabase Auth:

• What we collect: your email address and a password. The password is handled by Supabase and stored only as a salted hash — we never see it.
• What we create: a profile record holding your account id, an optional display name, your language preference, and the dates the record was created and last updated.
• What we do not collect: your real name, phone number, contacts, photos, precise location history, or any payment information.

5. Advertising (Google AdMob)

Rihla shows rewarded ads only — a short video you choose to watch in exchange for something in the app, such as tokens, a hint toward a nearby site, or a preview of a story chapter. There are no banner ads, no interstitial ads, no app-open ads, and no ad is ever shown without you tapping to start it.

Ads are served by Google AdMob. When you choose to watch one, Google's advertising SDK receives information needed to serve, measure and protect that ad — which typically includes your device's Advertising ID, device and operating-system information, coarse location derived from your IP address, and ad interaction and delivery data. The app declares the com.google.android.gms.permission.AD_ID permission for this reason.

Rihla requests non-personalised ads. That means Google is asked not to use profile-based targeting to select the ad; it does not stop Google collecting the data above for delivery, frequency capping, measurement and fraud prevention. Google's use of this data is governed by its own policies, linked below. We do not receive your Advertising ID, and we do not use it for any purpose of our own.

Your consent to ads

If you live somewhere that requires consent before an app may use your information for advertising — the European Economic Area, the United Kingdom, and certain US states — Rihla asks for that consent using Google's User Messaging Platform, the consent tool built into the advertising SDK. The consent form is presented by Google, not by us.

• The check happens the first time you choose to watch a rewarded ad, not when you open the app. If you never watch one, you are never asked.
• No ad is requested until that check has completed. If consent is required and not given, or if the check cannot be completed at all, no ad is requested and the reward is simply unavailable. Everything else in the app carries on working.
• Where consent applies, you can change your answer at any time from Profile → Settings → Ad privacy settings. That entry appears only for people whose region requires it.
• Outside those regions no consent form is shown, because none is required.

Requesting non-personalised ads does not remove this requirement, and we do not treat it as though it does.

6. Crash and stability reports (Firebase Crashlytics)

We use Google Firebase Crashlytics to find out when the app crashes or breaks. When that happens, Crashlytics collects a crash report, which typically includes the stack trace of the failure, the device model and manufacturer, the operating-system version, the app version, device state such as free memory and whether the device is rooted, and a Crashlytics installation identifier used to group crashes from the same installation. Reports are collected automatically when a crash or a handled error occurs. We do not attach your name, email, or account id to crash reports.

How We Use Information

• To provide the core feature — location is used to confirm you are at a heritage site so a visit can be unlocked.
• To remember your progress and preferences — stored on your device.
• To improve the app — anonymous, aggregated analytics help us understand which features are used and where the experience can be improved.
• To measure real-world visits — the site-only visit records help us understand which sites are being explored.
• To keep the app working — crash reports tell us when and where the app failed.
• To show the rewarded ads you choose to watch — and to keep the reward system fair, by applying daily limits and by detecting faked locations on your device.
• To sign you in — if, and only if, you choose to create or use an account.

We do not sell your information, and we do not build advertising profiles of you. Rewarded ads are served by Google AdMob as described above; Rihla itself does not use your information to target advertising.

Location Data

Rihla requests foreground (while-in-use) location permission (approximate and precise). Location is used for a single purpose: to calculate, on your device, whether you are within range of the heritage site you are verifying.

• We do not collect location in the background. The app has no background-location permission and runs no geofencing service; a location reading is taken only while you have the app open.
• We do not transmit your coordinates to our servers or to any third party.
• A successful verification sends only the identifier of the site (not where you are).
• Your coordinates are stored on your own device, for the last 50 token-earning visits only, purely to detect faked locations and impossible travel. See "About the visit history" above.
• The app reads your device's last known position when you open an undiscovered site, so it can decide whether a verification is even plausible. This also happens on your device, only when location permission has already been granted, and it is not transmitted.
• On Android, the app reads the operating system's "mock location" flag on a reading, so token rewards can be refused when a fake-location app is in use.

You can deny or revoke location permission at any time in your device settings. Visit verification will be unavailable without it, but the rest of the app continues to work.

Directions. If you tap to get directions to a site, your device opens Google Maps or Apple Maps with the site's coordinates as the destination. Rihla does not send your own position to those services; what happens after the maps app opens is governed by that app's own privacy policy.

Firebase Analytics

Analytics are provided by Google Firebase. Google processes this data as described in its own policies:

• Google Privacy Policy
• How Google uses data from apps that use its services
• Firebase Privacy and Security

You can limit analytics identifiers at the operating-system level (for example, by resetting or deleting your advertising ID in your device's privacy settings).

Accounts

Rihla supports optional accounts, provided by Supabase Auth. You are never asked to create one, you are never prompted to sign in, and the app is fully usable signed out. The sign-in form lives in Settings, reached from the Profile screen.

What an account does not do is as important as what it does:

• Your progress — discovered sites, tokens, story unlocks, streak, missions — stays on your device. It is never uploaded to your account, and signing in, signing out, or never signing in at all leaves it untouched.
• An account does not sync your data to another device, and it is not a backup. If you uninstall the app, your progress is gone whether or not you have an account.
• Signing in does not change what ads you see or what analytics are collected.

No feature, site, story or reward is locked behind signing in.

If you are signed in, visits are linked to your account

When you verify a visit while signed in, the site identifier recorded in our database is stored together with your account id, so those records are no longer anonymous for you. Signed out, the record remains anonymous exactly as described above. In both cases we store only the site identifier — never coordinates.

Session storage

Sessions are held in memory only. No sign-in token is written to your device's storage, so you are signed out again when the app is fully closed and reopened.

Deleting your account

You can delete your account at any time from Profile → Settings → Delete account inside the app. Deleting your account permanently removes your authentication record, your email address and your profile row, and removes the association between your account and any visit records — those records remain as anonymous site identifiers with your account id cleared, which is exactly what a signed-out visit leaves behind.

Your on-device progress is not deleted, because it was never part of the account. To remove that, clear the app's data or uninstall it. If you cannot access the app, you may request deletion using the contact details at the end of this policy, or follow the instructions on our account deletion page.

Third-party Services

• Google Firebase Analytics — usage analytics (see above). Firebase Privacy and Security.
• Google Firebase Crashlytics — crash and stability reports (see above).
• Google AdMob — serves the rewarded ads you choose to watch (see above). How AdMob uses data.
• Supabase — stores the visit records described above, hosts optional account sign-in, and serves downloadable country content packs. Supabase Privacy Policy.

The app does not include push notifications, social-media SDKs, in-app purchases or billing, camera or photo access, microphone access, contacts access, or any analytics or advertising provider other than the Google services listed above.

Downloadable content packs

Country packs — the places, stories and images for a country you choose to add — are downloaded from Supabase storage to your device when you tap to install them. This is a download only: the request tells the server which pack you asked for and, as with any internet request, your device's IP address, but no progress, location or account data is sent with it. Installed packs are stored in the app's own private storage and are deleted when you remove the pack or uninstall the app.

Permissions

The app requests or declares only these Android permissions:

• Approximate and precise location (while in use) — to verify you are at a site. Requested the first time you verify a visit.
• Advertising ID — used by Google AdMob to serve and measure the rewarded ads you choose to watch.
• Internet and vibration — network access and haptic feedback.

The app does not request camera, microphone, photos or media, contacts, files, notifications, Bluetooth, or background location.

Data Retention

• On-device data (progress, language, optional display name, tokens, unlocks, streak, missions, ad activity, downloaded packs) is kept until you uninstall the app or clear its storage.
• The on-device visit history holds the most recent 50 token-earning visits only; each new one removes the oldest.
• Analytics data is retained by Google Firebase according to the retention period configured for the project and Google's own policies.
• Crash reports are retained by Firebase Crashlytics according to Google's own retention policy.
• Advertising data is retained by Google AdMob according to Google's own policies. We have no access to it and cannot delete it.
• Visit records (site identifiers) are retained in the Supabase database. Records created while signed out contain no personal or device identifier and cannot be traced back to an individual. Records created while signed in carry your user id.
• Account records (your email address and profile row) are retained until the account is deleted.

Children's Privacy

Rihla is not directed at children under the age of 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children, and Rihla does not build advertising or behavioural profiles of its users. The app does show rewarded ads served by Google AdMob, and it requires no account, so if a child uses the app we hold no identifying information about them.

Security

We minimize the data the app handles. Information sent to Firebase, AdMob and Supabase is transmitted over encrypted connections (HTTPS/TLS). Your progress never leaves your device, and accounts are optional — so for most users we hold no personal identifier at all, which limits the risk to you by design. Where you do create an account, authentication is handled by Supabase Auth and we never store your password.

Your Rights

• On-device data: you can delete all locally stored data at any time by uninstalling the app or clearing its storage in your device settings.
• Location: you can grant or revoke location permission at any time.
• Advertising: you can reset or delete your device's Advertising ID, or turn off ad personalisation entirely, in your device's privacy settings. Android also offers an option to remove the Advertising ID altogether.
• Your account: if you have created one, you can delete it yourself in the app — Profile → Settings → Delete account. This deletes the account and its profile record. If that fails for any reason, email us and it will be done for you. See the data deletion page for what deletion does and does not cover.
• Questions or requests: contact us using the details below. For activity recorded while you were signed out, the data is anonymous and not linked to your identity, so we may be unable to locate records specific to you; we will respond to any privacy request to the extent we are able.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. We honor applicable rights to the extent they apply to the data described here.

Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Significant changes will be reflected here before they take effect. Continued use of the app after an update means you accept the revised policy.

Contact Information

If you have any questions about this Privacy Policy or how the app handles data, contact:

Rihla — Seif Tarek
Email: seiftarek1044@gmail.com
Application ID: com.seiftarek10.rihla