Privacy policy

The short version

Who runs Sebaway	Mohamed Mohamed Atwa (AtwaLabs), based in Egypt. Because our users are in Spain, our representative in the EU is being appointed, address published here by 30 November 2026, Spain.
No account needed	You can use Sebaway without an account. Then everything stays on your phone.
If you sign in	We keep your email address. Your setup answers, Track, your permit and your dates are encrypted on your phone and then copied to your account, so you get them on a new phone. Our server makes the key, so this is not "end-to-end" encryption. Our servers are in Frankfurt, Germany.
What always stays on your phone	My documents, your chats with Sebaway, your form answers and your location.
AI	When you ask Sebaway a question, we send it, with the guide text and your region and province, to our AI provider, Anthropic, in the USA. We ask you first. We don't store your question. Anthropic deletes it within 30 days (longer only if it is flagged for misuse) and doesn't use it to train AI.
Health	Before a question about your health goes to the AI, we ask for a separate OK. You can take it back at any time.
Purchases	If you buy the Sebaway Pro or a form, Google Play takes the payment. We never see your card. We and RevenueCat (USA) keep a record of what you bought and when, never what you wrote in a form.
Never	No ads, no statistics tools, no tracking. We never sell your data. We don't give it to immigration authorities or the police unless the law forces us to.
Your rights	See, download or delete your data in Profile and settings › Privacy centre. You can complain to Spain's data protection authority (AEPD).
Questions	privacy@sebaway.app

1. Who we are

Sebaway is run by Mohamed Mohamed Atwa (AtwaLabs) ("we", "us"), Al-Eglal Building, Al-Hoda wa Al-Nour, Mansoura, Dakahlia, Egypt. Registration: none (a private person, not a registered company). We decide why and how your data is used, so we are the "controller" under the EU General Data Protection Regulation (GDPR).

Our representative in the EU. We are not established in the EU, so we have appointed a representative in Spain (GDPR art. 27): being appointed, address published here by 30 November 2026, until then privacy@sebaway.app. You, and Spain's data protection authority, can contact them about anything in this policy.

Privacy contact. Write to privacy@sebaway.app. We answer in Arabic, English or Spanish.

2. What Sebaway does

Sebaway explains paperwork in Spain, helps you prepare forms that you submit yourself, and keeps track of your procedures and dates. It gives information, not legal advice. It never files anything for you and never acts for you. Sebaway is not a government app. We built it to keep as much as possible on your phone.

3. What we use, why, and our legal reason

The GDPR says we need a legal reason for each use of your data. We use four:

To give you the service you asked for (GDPR art. 6(1)(b)).
Your consent (art. 6(1)(a)), and your explicit consent for health information (art. 9(2)(a)). You can withdraw consent at any time. This does not affect what we did before you withdrew it.
Our legitimate interests (art. 6(1)(f)): keeping Sebaway safe, working and accurate. You can object to this (section 11).
A legal obligation (art. 6(1)(c)): for example, answering your requests and keeping records the law asks for.

What	What we use	Why	Where it is kept	Legal reason
Account (optional)	Your email address, a user number, sign-in tokens, the date you joined and the last time you signed in.	To sign you in with a 6-digit code sent by email, and to copy your data to a new phone.	Our servers (Frankfurt). The code email goes through our email provider (section 7).	Service, 6(1)(b)
Setup answers	Who Sebaway is for. The reason you are in Spain (a group and the closest situation, for example "I applied in the 2026 regularisation" or international protection). Your town. Whether you have a permit or are waiting for one. Your household: partner, parents, other family, and for each child an age and whether the child lives abroad. No names.	To show the guides and official local links that fit you. Your answers never decide anything about you.	On your phone. If you sign in, also an encrypted copy in your account (see "Sync" below).	Service, 6(1)(b)
Location (optional)	Your phone's approximate location, once, when you tap "Use my location". Never your precise location, never in the background.	To find your town.	Your phone matches the position to Spain's official town boundaries, which are inside the app. The position is not saved and not sent to us. We keep only the town you confirm.	Service, 6(1)(b). Your phone asks your permission first.
Track	The procedures you follow, the steps and documents you tick, your own lists. Your permit: type, start and end dates, the date you applied or got a refusal, and your fingerprint appointment. Your dates: kind, label, date and time.	To show your next steps and remind you of dates.	On your phone. If you sign in, also an encrypted copy in your account (see "Sync" below).	Service, 6(1)(b)
Sync (only if you sign in)	Your setup answers, Track, permit, dates, and your reminder and calendar settings, each encrypted on your phone before it is sent.	So the same data is on every phone where you sign in.	Our servers (Frankfurt), as items we can't read without the key. The key is made on our server for you and given only to you after you sign in.	Service, 6(1)(b)
Reminders	The times of your reminders.	To remind you of dates.	On your phone only. Reminders are notifications your phone schedules itself. We don't use push notifications.	Service, 6(1)(b)
Phone calendar	The dates you choose to add.	To put them in your phone's calendar.	In your calendar app. Sebaway reads only the list of your calendars, never your other events.	Service, 6(1)(b)
Ask Sebaway (AI)	Your question (typed, or spoken and turned into text by your phone). The guide text needed to answer, chosen on your phone. Your language. Your region and province, if you chose a town. Never your town, address or name.	To answer you.	Sent through our server to the AI and not stored on our server. Your chat history is on your phone.	Service, 6(1)(b). The app asks your permission before the first use (section 6).
Install code	A random code made by the app on your phone. It says nothing about you and is not your phone's advertising or hardware ID. We receive it with each question, and keep only a scrambled form of it (a salted hash) with a count. We do the same with your network (IP) address.	To apply the daily limit on questions, show how many you have left, and stop abuse.	Our servers, deleted after 2 days. "Delete all my data" makes a new code.	Legitimate interest, 6(1)(f)
Voice	Your voice while you hold the microphone.	To turn your speech into text.	Your phone's own speech recognition does this. We never receive the sound. If your phone has no speech model for your language on the phone, the speech service of your phone's system (Google on most Android phones, Apple on iPhone) may process the sound under your settings with them.	Service, 6(1)(b)
Forms	The answers you give to prepare a form. This can include your name, passport or NIE number, address and family details.	To make a PDF that you check, sign and submit yourself.	On your phone only, encrypted. The PDF is made on your phone. We never receive your answers.	Service, 6(1)(b)
My documents	Photos and PDFs you add, for example your passport, TIE card or rental contract, and the expiry dates you type.	To keep your papers in one place and remind you before they expire.	On your phone only, encrypted. They are never sent to the AI.	Service, 6(1)(b)
Backup (optional)	A backup file of what Sebaway keeps on your phone, encrypted on your phone with 8 recovery words that only you have.	So you can restore your data on a new phone.	A file you save where you like, or, if you sign in, one file in your account. We can't open it.	Service, 6(1)(b)
Purchases (Sebaway Pro and single forms; only if you buy)	What you bought (Sebaway Pro by month or year, or one form), the date and price, whether Sebaway Pro is active, when it renews or ends, cancellations and refunds, the Google Play order number and purchase token, the country and currency of your Google Play account, your user number, and which form each purchase unlocked and when. Never your card or bank details. Never what you wrote in a form.	To give you what you paid for on every phone where you sign in, restore it, remind you 15 days before each renewal, handle cancellations, refunds and refund reviews that Google asks for, stop abuse, and keep the records the law asks for.	Google Play takes the payment. The record is kept on our servers (Frankfurt) and by RevenueCat (USA).	Service, 6(1)(b). Legitimate interest for refund reviews and stopping abuse, 6(1)(f). Legal obligation for tax and accounting records, 6(1)(c).
Health information	Health details you write in a question to Ask Sebaway.	Only to answer that question.	As for Ask Sebaway.	Explicit consent, 9(2)(a)
"Report a mistake" (guides)	Which guide, the kind of problem, your note if you write one, your language and the app version. Not your account or install code.	To fix mistakes in the guides.	Our servers.	Legitimate interest in correct guides, 6(1)(f)
"Report this answer" (AI)	The AI answer, the reason you choose (offensive, harmful, wrong or other), your note if you write one, your language and the app version. Your question only if you tick "Include my question". Not your account or install code.	To find and fix harmful or wrong answers, and to test the AI against them.	Our servers. Only our team can read reports.	Legitimate interest in safe and correct answers, 6(1)(f)
"Notify me"	Which coming service you want to hear about.	To learn what people need. Your phone keeps your list and tells you when the service is ready.	Our servers keep only a count per service and day, not who asked.	Legitimate interest, 6(1)(f)
Support	Your email and message, if you write to us.	To help you and answer your requests.	Our email inbox.	Service, 6(1)(b). Legal obligation for rights requests, 6(1)(c).
Security logs	IP address, times and technical details of requests to our servers. Never the content of your questions or documents.	To protect accounts, stop abuse and look into incidents.	Our servers, run by Supabase.	Legitimate interest, 6(1)(f)

What

What we use

Why

Where it is kept

Legal reason

Account (optional)

Your email address, a user number, sign-in tokens, the date you joined and the last time you signed in.

To sign you in with a 6-digit code sent by email, and to copy your data to a new phone.

Our servers (Frankfurt). The code email goes through our email provider (section 7).

Service, 6(1)(b)

Setup answers

Who Sebaway is for. The reason you are in Spain (a group and the closest situation, for example "I applied in the 2026 regularisation" or international protection). Your town. Whether you have a permit or are waiting for one. Your household: partner, parents, other family, and for each child an age and whether the child lives abroad. No names.

To show the guides and official local links that fit you. Your answers never decide anything about you.

On your phone. If you sign in, also an encrypted copy in your account (see "Sync" below).

Service, 6(1)(b)

Location (optional)

Your phone's approximate location, once, when you tap "Use my location". Never your precise location, never in the background.

To find your town.

Your phone matches the position to Spain's official town boundaries, which are inside the app. The position is not saved and not sent to us. We keep only the town you confirm.

Service, 6(1)(b). Your phone asks your permission first.

Track

The procedures you follow, the steps and documents you tick, your own lists. Your permit: type, start and end dates, the date you applied or got a refusal, and your fingerprint appointment. Your dates: kind, label, date and time.

To show your next steps and remind you of dates.

On your phone. If you sign in, also an encrypted copy in your account (see "Sync" below).

Service, 6(1)(b)

Sync (only if you sign in)

Your setup answers, Track, permit, dates, and your reminder and calendar settings, each encrypted on your phone before it is sent.

So the same data is on every phone where you sign in.

Our servers (Frankfurt), as items we can't read without the key. The key is made on our server for you and given only to you after you sign in.

Service, 6(1)(b)

Reminders

The times of your reminders.

To remind you of dates.

On your phone only. Reminders are notifications your phone schedules itself. We don't use push notifications.

Service, 6(1)(b)

Phone calendar

The dates you choose to add.

To put them in your phone's calendar.

In your calendar app. Sebaway reads only the list of your calendars, never your other events.

Service, 6(1)(b)

Ask Sebaway (AI)

Your question (typed, or spoken and turned into text by your phone). The guide text needed to answer, chosen on your phone. Your language. Your region and province, if you chose a town. Never your town, address or name.

To answer you.

Sent through our server to the AI and not stored on our server. Your chat history is on your phone.

Service, 6(1)(b). The app asks your permission before the first use (section 6).

Install code

A random code made by the app on your phone. It says nothing about you and is not your phone's advertising or hardware ID. We receive it with each question, and keep only a scrambled form of it (a salted hash) with a count. We do the same with your network (IP) address.

To apply the daily limit on questions, show how many you have left, and stop abuse.

Our servers, deleted after 2 days. "Delete all my data" makes a new code.

Legitimate interest, 6(1)(f)

Voice

Your voice while you hold the microphone.

To turn your speech into text.

Your phone's own speech recognition does this. We never receive the sound. If your phone has no speech model for your language on the phone, the speech service of your phone's system (Google on most Android phones, Apple on iPhone) may process the sound under your settings with them.

Service, 6(1)(b)

Forms

The answers you give to prepare a form. This can include your name, passport or NIE number, address and family details.

To make a PDF that you check, sign and submit yourself.

On your phone only, encrypted. The PDF is made on your phone. We never receive your answers.

Service, 6(1)(b)

My documents

Photos and PDFs you add, for example your passport, TIE card or rental contract, and the expiry dates you type.

To keep your papers in one place and remind you before they expire.

On your phone only, encrypted. They are never sent to the AI.

Service, 6(1)(b)

Backup (optional)

A backup file of what Sebaway keeps on your phone, encrypted on your phone with 8 recovery words that only you have.

So you can restore your data on a new phone.

A file you save where you like, or, if you sign in, one file in your account. We can't open it.

Service, 6(1)(b)

Purchases (Sebaway Pro and single forms; only if you buy)

What you bought (Sebaway Pro by month or year, or one form), the date and price, whether Sebaway Pro is active, when it renews or ends, cancellations and refunds, the Google Play order number and purchase token, the country and currency of your Google Play account, your user number, and which form each purchase unlocked and when. Never your card or bank details. Never what you wrote in a form.

To give you what you paid for on every phone where you sign in, restore it, remind you 15 days before each renewal, handle cancellations, refunds and refund reviews that Google asks for, stop abuse, and keep the records the law asks for.

Google Play takes the payment. The record is kept on our servers (Frankfurt) and by RevenueCat (USA).

Service, 6(1)(b). Legitimate interest for refund reviews and stopping abuse, 6(1)(f). Legal obligation for tax and accounting records, 6(1)(c).

Health information

Health details you write in a question to Ask Sebaway.

Only to answer that question.

As for Ask Sebaway.

Explicit consent, 9(2)(a)

"Report a mistake" (guides)

Which guide, the kind of problem, your note if you write one, your language and the app version. Not your account or install code.

To fix mistakes in the guides.

Our servers.

Legitimate interest in correct guides, 6(1)(f)

"Report this answer" (AI)

The AI answer, the reason you choose (offensive, harmful, wrong or other), your note if you write one, your language and the app version. Your question only if you tick "Include my question". Not your account or install code.

To find and fix harmful or wrong answers, and to test the AI against them.

Our servers. Only our team can read reports.

Legitimate interest in safe and correct answers, 6(1)(f)

"Notify me"

Which coming service you want to hear about.

To learn what people need. Your phone keeps your list and tells you when the service is ready.

Our servers keep only a count per service and day, not who asked.

Legitimate interest, 6(1)(f)

Support

Your email and message, if you write to us.

To help you and answer your requests.

Our email inbox.

Service, 6(1)(b). Legal obligation for rights requests, 6(1)(c).

Security logs

IP address, times and technical details of requests to our servers. Never the content of your questions or documents.

To protect accounts, stop abuse and look into incidents.

Our servers, run by Supabase.

Legitimate interest, 6(1)(f)

Not used in this version. This version of Sebaway has no app statistics, no crash-reporting tool, no advertising, no push notifications, no letter photos or letter translation, no speech-to-text company, and no "Sign in with Apple" or "Sign in with Google". Purchases (the Sebaway Pro and single forms) are described in this policy so you know how they work before they open in the app. If we add anything else, we will update this policy first, and ask for your consent where the law requires it.

4. Where your data is kept

Your data is kept in four places.

On your phone. Everything Sebaway knows about you is on your phone, protected by your phone's encryption and Sebaway's own. My documents, your chat history, your form answers and your location never leave it. If you lose your phone or delete the app without a backup, your data is gone.
On our servers in Frankfurt, Germany. Run by Supabase on Amazon Web Services. Only if you sign in: your account, the encrypted copy of your setup and Track, and your encrypted backup if you saved one there. For everyone: scrambled install codes and counts (2 days), reports you choose to send, "Notify me" counts and security logs. If you bought something: the record of your purchases.
On the way to the AI. When you ask a question, it passes through our server to Anthropic, the AI provider, and the answer comes back. It is not written to our database, and it is not in our logs.
With RevenueCat in the USA, only if you buy something: the record of your purchases (section 7). Google Play keeps its own record of the payment.

About the encryption of your synced data. Your phone encrypts each item (with XChaCha20-Poly1305) before it is sent. Our database only sees unreadable items under scrambled names. The key for your account is made by our server from a secret master key, which we keep apart from the database, and given only to you after you sign in. This protects your data if the database leaks, but it is not end-to-end encryption: technically, we could make your key again and read your synced data. We don't, and our team never looks at it. The backup protected by your 8 recovery words is different: only you can open it.

We run Sebaway from Egypt. When we look after the service or answer your request, we may access data on our servers from Egypt (section 8).

5. Sensitive information

Health. Health information is a "special category" under the GDPR. Before a question about your health goes to the AI, the app asks for a separate OK that explains what happens. The box is never ticked for you. If you say no, you can still use everything else. You can withdraw your consent in Profile and settings › Privacy centre at any time. Documents you mark as health in My documents stay on your phone.

Your residence status. Your permit and the reason you are in Spain are not a "special category" in law. We still treat them as highly sensitive. Without an account, they never leave your phone. With an account, they are synced only in encrypted form (section 4), we never put them in logs or statistics, and the AI receives only your question, not your setup answers.

Criminal record certificates. Some procedures ask for one. If you store one in My documents, it stays on your phone, and in your backup if you make one. It is never sent to the AI.

What you write in Ask Sebaway. Please don't write about your health, religion, sexual life, political views or criminal matters unless you need to for your question. If you do, we use it only to answer you, and we don't store it. If you report an answer and tick "Include my question", that question is stored with the report for 90 days (section 9), so leave the box empty if your question is personal.

Information about other people. If you add your partner, children or parents to your household, you give us information about them. Please tell them. We don't ask for their names: only an age and whether a child lives abroad.

6. AI in Sebaway

Ask Sebaway uses artificial intelligence (AI): Claude, made by Anthropic. Every AI answer has an "AI" label, so you always know you are dealing with AI (EU AI Act, art. 50). It also carries the note "Information, not legal advice."
Answers are built from Sebaway's guides. People check the guides against official sources, and each answer shows the guides it used. AI can still make mistakes. Always check the official source before you act.
Before your question goes to the AI for the first time, the app tells you what is sent and to whom, and asks your permission. If you say no, you can still use guides, Track, forms and My documents. You can change this in the Privacy centre.
What is sent: your question, the guide text needed, your language and, if you chose a town, your region and province. Never your town, your setup answers, your documents or your account.
Our AI provider is Anthropic PBC, in the USA. Under its commercial terms, it does not use your data to train its models. We have asked it not to keep our data at all ("zero data retention"). Until that is approved, it deletes our data within 30 days, unless it must keep it longer to look into misuse of its service.
We do not use your data to train any AI.
The AI does not make decisions about you. It doesn't decide whether you qualify for anything, and it has no legal or similar effect on you (GDPR art. 22). Questions about appeals, refusals, expulsion or asylum decisions open a screen that points you to free legal help.
If an answer is offensive, harmful or wrong, tap "Report this answer". The report goes to our team without leaving the app. Your question goes with it only if you tick "Include my question". "Was this helpful?" stays on your phone.

We share only what each provider needs to do its job for us. Each one works under a contract with us (a data processing agreement) that stops it using your data for anything else.

Provider	What it does for us	Data	Where	Protection
Supabase, Inc. (servers run by Amazon Web Services)	Database, sign-in, file storage, server functions	Account, encrypted synced items, encrypted backups, scrambled install codes and counts, reports, security logs. Questions to the AI pass through.	Frankfurt, Germany	Data processing agreement. Standard contractual clauses for any access from outside the EU.
Anthropic PBC	AI answers	Your question, guide text, language, region and province	USA	Data processing agreement with standard contractual clauses. No training. Zero retention requested.
Google (Gmail)	Sends the sign-in code email	Your email address and the code	USA and EU	Data processing agreement
RevenueCat, Inc.	Keeps the record of your purchases and checks it with Google Play	Your user number, what you bought, dates, price and currency, renewal and refund status, the Google Play order number and purchase token, the country of your Google Play account	USA	Data processing agreement with standard contractual clauses. Not used for advertising.

Provider

What it does for us

Data

Where

Protection

Supabase, Inc. (servers run by Amazon Web Services)

Database, sign-in, file storage, server functions

Account, encrypted synced items, encrypted backups, scrambled install codes and counts, reports, security logs. Questions to the AI pass through.

Frankfurt, Germany

Data processing agreement. Standard contractual clauses for any access from outside the EU.

Anthropic PBC

AI answers

Your question, guide text, language, region and province

USA

Data processing agreement with standard contractual clauses. No training. Zero retention requested.

Google (Gmail)

Sends the sign-in code email

Your email address and the code

USA and EU

Data processing agreement

RevenueCat, Inc.

Keeps the record of your purchases and checks it with Google Play

Your user number, what you bought, dates, price and currency, renewal and refund status, the Google Play order number and purchase token, the country of your Google Play account

USA

Data processing agreement with standard contractual clauses. Not used for advertising.

Companies that decide for themselves. Apple and Google run the app stores. Your phone's system speech service (Google or Apple) may process your voice if your phone has no on-device speech model (section 3). Your calendar provider (for example Google, Apple, Samsung or Microsoft) handles the events you add to your calendar, and so do the people you share that calendar with. This is why event titles are neutral ("Appointment") unless you change the setting. Each of these follows its own privacy policy.

Google Play. Google runs Google Play and takes the payment when you buy the Sebaway Pro or a form, under its own terms and privacy policy. Google tells us what was bought, when, for how much and from which country, but never your card details. When Google asks us to review a refund request, we may tell Google which forms were made with that purchase and when, never what was in them.

Our representative and advisers. Our EU representative, and lawyers or auditors who must keep it confidential, when they need it to help us follow the law.

Authorities. We do not share your data with immigration authorities, the police or any other public body unless the law requires it, for example because of a valid court order. If that happens, we check the request with a lawyer, give only the minimum, and tell you unless the law forbids it. Most of what you keep in Sebaway is on your phone, so we don't have it to give.

If Sebaway changes owner. If Sebaway moves to a company the owner sets up, or is sold, your data moves with it under this policy. We will tell you before that happens.

A planned lawyer marketplace. We plan a paid service, later, that connects you with lawyers and gestorías. It is not part of Sebaway today and this policy does not cover it. Before it starts, we will update this policy, and we will never share your case with a professional without your clear permission.

We never sell your data. We don't show ads, we don't share your data with advertisers or data brokers, and we don't track you across other apps or websites.

8. Data outside the EU

USA. Anthropic (AI) and RevenueCat (purchase records) are in the USA. Support staff of Supabase may also access data from outside the EU. Each contract includes the European Commission's standard contractual clauses (Decision (EU) 2021/914). Where a provider is certified under the EU–US Data Privacy Framework, that applies too.
Egypt. We run Sebaway from Egypt, which has no EU "adequacy decision". When we access data held for us in Frankfurt from Egypt, we rely on standard contractual clauses and the protections in section 10: encryption, strict access limits and keeping data to a minimum.
We have written a risk assessment for each of these transfers. You can ask for a copy of the safeguards at privacy@sebaway.app.

9. How long we keep data

Data	How long
Account and synced items	Until you delete your account. When you delete one item (a date, a procedure, your permit), its content is removed at the next sync, and a small empty marker stays for up to 180 days so your other phones know. If you don't open Sebaway for 24 months, we email you; if you still don't open it within 30 days, we delete the account.
Encrypted backup in your account	Until you save a new one (it replaces the old one) or delete your account.
Purchase records	While your account exists, so what you paid for keeps working and can be restored. When you delete your account, we delete your purchase history on our servers and at RevenueCat. We keep only a locked record of each payment (order number, product, date, price, refund), without your email, for 6 years, for tax and accounting and in case of a claim.
Questions to the AI on our servers	Never stored. They pass through and are discarded once the answer is sent.
At Anthropic	Zero retention requested. Until it is approved, up to 30 days, longer only if flagged for misuse.
Scrambled install codes, network addresses and counts	2 days.
"Report this answer"	90 days after the report arrives.
"Report a mistake"	Until the guide is checked, and at most 2 years.
"Notify me"	Only counts per service and day, with nothing about you.
Support messages	2 years after the last message.
Records of your requests and consents	3 years after the request is closed or the consent ends.
Security logs	As long as our hosting provider keeps them, at most 7 days, without content.
Server backups	Up to 7 days, then overwritten.
Everything on your phone (My documents, Track, chats, form answers)	Until you delete it, use "Delete all my data", or delete the app.

Data

How long

Account and synced items

Until you delete your account. When you delete one item (a date, a procedure, your permit), its content is removed at the next sync, and a small empty marker stays for up to 180 days so your other phones know. If you don't open Sebaway for 24 months, we email you; if you still don't open it within 30 days, we delete the account.

Encrypted backup in your account

Until you save a new one (it replaces the old one) or delete your account.

Purchase records

While your account exists, so what you paid for keeps working and can be restored. When you delete your account, we delete your purchase history on our servers and at RevenueCat. We keep only a locked record of each payment (order number, product, date, price, refund), without your email, for 6 years, for tax and accounting and in case of a claim.

Questions to the AI on our servers

Never stored. They pass through and are discarded once the answer is sent.

At Anthropic

Zero retention requested. Until it is approved, up to 30 days, longer only if flagged for misuse.

Scrambled install codes, network addresses and counts

2 days.

"Report this answer"

90 days after the report arrives.

"Report a mistake"

Until the guide is checked, and at most 2 years.

"Notify me"

Only counts per service and day, with nothing about you.

Support messages

2 years after the last message.

Records of your requests and consents

3 years after the request is closed or the consent ends.

Security logs

As long as our hosting provider keeps them, at most 7 days, without content.

Server backups

Up to 7 days, then overwritten.

Everything on your phone (My documents, Track, chats, form answers)

Until you delete it, use "Delete all my data", or delete the app.

When you delete your account, your account, synced items, backup in the account and purchase history are deleted at once, and they disappear from our server backups within 7 more days. If the law requires us to keep something, for example the record of a request you made or of a payment, we keep it locked and use it only for that reason. Deleting your account does not cancel the Sebaway Pro: cancel it in Google Play first.

10. How we protect your data

My documents and your form answers stay on your phone, encrypted with a key kept in your phone's secure storage.
If you sign in, your setup, Track, permit and dates are encrypted on your phone before they are sent (section 4). We never call this "end-to-end", because our server makes the key.
The optional backup is encrypted on your phone with a key made from 8 recovery words that only you have. We can't read it, and we can't recover it if you lose the words.
Our servers are in Frankfurt. Data is encrypted in transit and at rest.
Every table in our database has rules so each person can reach only their own data. Reports and counts can't be read through the app at all.
Our AI calls go only through our own server functions. No secret keys are in the app.
Our team uses hardware security keys to sign in to every system that holds data. We don't keep real user data on laptops.
No question, answer or document content goes into our logs. We have no statistics or crash-reporting tools.
An independent security company tests the app and servers before the beta.
If we have a data breach, we tell the AEPD within 72 hours of finding out, unless it is unlikely to put anyone at risk. If the risk to you is high, we also tell you without undue delay, in your language, and say what you should do.

11. Your rights

You can:

See your data and get a copy (access).
Correct it.
Delete it.
Limit how we use it (restriction).
Take it with you in a common file format (portability).
Object to uses based on our legitimate interests, for example the reports and security logs.
Withdraw consent at any time, for example the health OK. You can also turn off the AI permission in the Privacy centre, and location and calendar access in your phone's settings.
Not be subject to decisions made only by a machine that have legal or similar effects on you. Sebaway makes no such decisions.

How to use your rights

In the app: Profile and settings › Privacy centre. There you can download a copy of your data ("Download my data"), change your choices, and delete everything ("Delete all my data"). If you are signed in, "Delete all my data" also deletes your account on our servers. To correct your data, change it where you entered it (setup, Track, My documents).
Without the app: see https://sebaway.app/delete-account, write to privacy@sebaway.app, or write to our EU representative.
We answer within one month. If your request is complex, we can take up to two more months, and we will tell you why within the first month. It is free.
To protect you, we check that the request comes from your account's email address. We only ask for more if we cannot confirm it is you that way.
Reports and counts are not linked to you, so we can't find them for you. Data on your phone is under your control: you can see, export and delete it in the app at any time.

Complaints. You can complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, online at sede.aepd.es. It is free. You can also complain to the data protection authority of the EU country where you live or work. We'd like the chance to fix the problem first, but you don't have to contact us before you complain.

12. Your choices

All of these are in Profile and settings › Privacy centre, or in your phone's settings, and you can change them at any time:

AI permission (needed for Ask Sebaway)
Health OK
Location
Calendar access, and neutral event titles ("Appointment"), on by default
Reminders
Account and sync (sign in or out)
Backup

13. Age

You must be 18 or over to use Sebaway. If we learn that someone under 18 has created an account, we delete it.

14. Guest mode

You can use Sebaway without an account. In guest mode, your setup answers and everything else stay on your phone, and we don't receive them. If you use Ask Sebaway, your question goes to the AI as described in section 6, with the install code for the daily limit. Reports you choose to send work as described above. If you delete the app, your guest data is gone and we cannot recover it, unless you saved a backup file.

15. Our website

Our website, sebaway.app, has this policy, our terms and the page about deleting your account. It has no cookies, no statistics and no trackers. Fonts are loaded from Google Fonts, so your browser connects to Google to get them.

16. Changes to this policy

If we make an important change, we will tell you in the app at least 30 days before it applies. If a change needs your consent, we will ask for it again. Past versions are available on request.

17. Languages

This policy is in Arabic, English and Spanish. All three say the same thing.

18. Contact

Privacy questions and requests: privacy@sebaway.app
Our EU representative: being appointed, address published here by 30 November 2026, until then privacy@sebaway.app
Post: Mohamed Mohamed Atwa (AtwaLabs), Al-Eglal Building, Al-Hoda wa Al-Nour, Mansoura, Dakahlia, Egypt

The short version

1. Who we are

2. What Sebaway does

3. What we use, why, and our legal reason

4. Where your data is kept

5. Sensitive information

6. AI in Sebaway

7. Who we share data with

8. Data outside the EU

9. How long we keep data

10. How we protect your data

11. Your rights

12. Your choices

13. Age

14. Guest mode

15. Our website

16. Changes to this policy

17. Languages

18. Contact