Privacy policy

1. Who we are

Unplanned is a community website for women aged 18 and over in Riyadh to find company for activities. It is operated by Unplanned (Riyadh, Saudi Arabia). In this policy, "we" and "us" mean Unplanned.

For anything about your personal data, email [email protected].

2. What this policy covers

This policy explains what personal data Unplanned collects, why, who it is shared with, how long it is kept, and the rights you have under Saudi Arabia's Personal Data Protection Law.

It covers the Unplanned website (joinunplanned.com) and the Unplanned support and policy pages.

3. The data we collect

Your sign-in: your email address and your password. Your password is stored only as a one-way hash by our sign-in provider, so nobody at Unplanned can see it.

Your profile: the nickname you choose, and if you add them, a short bio, interests and a general area (such as "North Riyadh").

Joining: your own confirmation that you are a woman aged 18 or over and that you will follow the guidelines, and when you joined. Nobody checks these confirmations.

What you post: plans (including any time, place name and Google Maps link you add), comments, reviews you write after an outing, and private messages you send.

Safety records: reports you make or that are made about you (with a copy of the reported text), the members you block, any warnings, suspensions or removals, appeals, and a log of moderators' actions.

Account records: which version of the terms you accepted and when, when you joined, conversation settings (such as muted conversations and what you have read), and failed attempts to delete your account (kept for one day, to stop password guessing).

Technical records: our hosting providers (Supabase and Cloudflare) keep short-lived technical logs of requests to our servers (for example the time and type of request, your IP address and your account ID), for security and to fix problems.

On the website, your browser keeps your sign-in session in its own storage on your device until you sign out.

If you visit as a guest (without an account): a random identifier for your guest session, your acceptance of the guidelines, the comments and reports you make, and whether a moderator has suspended the guest session. We don't ask for your name or email. Supabase and Cloudflare logs may include your IP address, as for everyone.

When you sign up, sign in or reset your password, a security check (Cloudflare Turnstile) looks at technical information about your browser and connection, such as your IP address and browser type, to tell people from automated programs. Cloudflare says it uses this only to detect automated programs, not to identify, profile or target anyone.

We do not collect your real name, phone number, date of birth, photos, ID documents, biometric data, gender field or location. Unplanned has no adverts, and no analytics or tracking tools.

4. Why we use it

To run the service you signed up for: your sign-in, your profile, your membership, and showing your plans, comments, reviews and messages to the people they are meant for.

To keep the community safe: reviewing reports, enforcing blocks, holding or refusing content that breaks the guidelines, and dealing with accounts that break the terms.

To email you: a code to confirm your email address, and a code when you ask to reset your password. We do not send marketing emails.

To keep the service secure and working, and to meet legal requirements.

We do not sell your data, use it for advertising, or make automated decisions about you. Every decision about an account (a warning, suspension or removal) is made by a person.

5. Legal basis and consent

We process your data to provide the service under our terms of use, which you accept when you join; to protect members' safety, which is our legitimate interest; and where the law requires it.

Optional profile details (bio, interests, area) are shared with other members because you choose to add them. You can change or remove them at any time in your profile.

You can withdraw your consent at any time by removing optional details, or by deleting your account. Withdrawing consent does not affect what was done before.

6. Who can see or receive your data

Other members can see your nickname, profile, plans, comments and shared reviews. Your private messages are seen only by the member you are writing to. Your email address and membership details are never shown to members.

Guests (people using Unplanned without an account) see only the plans whose author turned on "Visible to guests": the plan as written (including its time and place), its comments, and the nicknames of the people who wrote them. They never see profiles, messages or anything else.

Moderators can see membership records, reports (including a copy of a reported message) and moderation records. They cannot read private conversations.

Service providers that run parts of Unplanned for us:

• Supabase stores Unplanned's data and runs sign-in.

• Cloudflare hosts the website and runs the security check on sign-up, sign-in and password reset.

• Resend sends our confirmation and password-reset emails, so it receives your email address.

• Apple iCloud stores an encrypted copy of our weekly backups, which Apple can't read.

We may share data with the authorities when the law requires it, or when it is needed to protect someone's safety.

Google Maps links in plans open in Google's app or website. Google's own privacy policy applies there.

7. Data stored outside Saudi Arabia

Our service providers do not offer hosting inside Saudi Arabia, so your data is stored and processed outside the Kingdom. Unplanned's database is hosted in Frankfurt, Germany (European Union). Cloudflare serves the website and runs the security check on its worldwide network. Resend keeps its email records in the United States.

We transfer only what is needed to run the service, use providers that protect data under written agreements, and follow the rules for transferring personal data outside the Kingdom. If these rules change, we will update this policy.

8. How long we keep your data

We keep your account data until you delete your account.

When you delete your account, we delete straight away: your email address, password, profile, membership record, plans (and other members' comments on them), your comments, the messages you sent, your reviews, your blocks and your appeals.

Reports made by you or about you are kept for up to 12 months after your account is deleted, without any link to your account, so moderators can keep the community safe. Moderation records keep the action taken, not your account.

Guest sessions are deleted, with their comments, 30 days after their last activity. "Clear guest session" deletes the visit and its comments straight away.

Failed attempts to delete an account are kept for one day. Technical logs are kept for a short time set by our hosting providers. Our weekly backups are encrypted and kept for 8 weeks, so deleted data can stay in them for up to 8 weeks before they are removed. An encrypted copy is kept in our cloud storage (Apple iCloud), where deleted files can stay up to 30 more days in its Recently Deleted folder.

9. How we protect your data

All connections between your device and our servers are encrypted (HTTPS).

Database rules decide who can read or change each piece of data, and these rules are tested before every release. People who haven't joined, suspended accounts and signed-out visitors cannot read community content. Guests see only plans their authors made visible to guests, and the comments on them.

Passwords are stored only as one-way hashes. The website shows what members post as plain text only.

Only a small number of people have administrative access to the systems, and each moderator action is logged.

No system is completely secure. Please use a password you don't use anywhere else, and keep your email account secure.

10. If there is a data breach

If personal data is lost, leaked or accessed without permission, we will act to contain it, notify the Saudi Data and AI Authority (SDAIA) as the law requires, and tell affected members without undue delay if the breach may harm them, with steps they can take.

11. Your rights and how to use them

Under Saudi Arabia's Personal Data Protection Law, you have the right to:

• Be told how your data is used: this policy.

• Access your data and get a copy: Settings → Download my data. The download leaves out reports other members made about you (to protect the people who reported) and failed attempts to delete your account (kept for one day only).

• Correct it: edit your profile at any time. For anything else, email us.

• Have it deleted: Settings → Delete account (or on the joining page if you haven't joined yet). Deletion needs only your password.

• Withdraw consent: see section 5.

For anything you can't do in Unplanned yourself, email [email protected]. We may ask you to confirm the request from the email address on your account. We aim to reply within 30 days.

If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA).

12. Age

Unplanned is only for women aged 18 and over. If we learn that an account belongs to someone under 18, we remove it.

13. Changes to this policy

If we change this policy, we will update the version date at the top. If a change affects how your data is used, we will tell you in Unplanned before it takes effect.

14. Contact

Unplanned (Riyadh, Saudi Arabia). Email: [email protected].