Nwly Privacy Policy

Effective date: 2026-10-05

Nwly is operated by Hawsabah ("we", "us"), based in the Kingdom of Saudi Arabia. We handle personal data in line with the Saudi Personal Data Protection Law (PDPL) and its regulations. This policy explains, in plain terms, what the Nwly app collects, why, how long we keep it, who processes it for us, and how you can exercise your rights. Questions: [email protected].

1. The short version

• You can use Nwly without an account. The app then identifies your installation with a random number it generates itself. It is not your name, your phone number or an advertising identifier.
• We do not use advertising identifiers, we do not track you across other apps or websites, and we do not sell your data.
• We use Google Firebase for crash reports, usage statistics and app performance measurements. None of it carries your name, email address or account, and Google is not given an advertising identifier. The usage statistics and performance measurements stop completely when you turn off "Share usage analytics" in Settings (sections 4 and 6).
• We do not collect your precise location, contacts, photos or microphone.
• For security and abuse prevention we record the IP address your requests come from. We keep it for 90 days, then erase it, and we also use it to work out your approximate country (section 3).
• You can turn analytics off in the app. You can delete your account and its data from inside the app, and you can access, correct or delete your data, or withdraw your consent, by writing to us (section 9).

2. What we collect and why

We use this information only to run Nwly, to support you and to understand and improve the product. We do not share it with advertisers or data brokers.

3. What we do not collect

• No advertising identifiers (IDFA or GAID) and no hardware serial numbers. The Google Firebase services in the app are set up not to collect an advertising identifier and not to use advertising personalisation signals.
• No precise location (no GPS, no Wi-Fi or cell-tower positioning). The only location we hold is your approximate country, derived from your IP address with a country-level database that runs on our own servers (your address is not sent to anyone for this), or taken from your phone's region setting. It is used for regional breaking news and for statistics by country. Separately, Google Analytics for Firebase derives an approximate location (country and city level) from the IP address of the connection, on Google's side, and does not store the IP address itself (section 4).
• No contacts, photos, files or microphone recordings. The only image we ever receive is a screenshot you choose to attach to a report (section 5).
• We do not use IP addresses to follow you around, to build a profile of you, or for advertising. They are visible only to the staff who handle abuse and support, and they are erased 90 days after they were recorded. (Earlier versions of the app kept only a one-way fingerprint of the address with each session; those are erased on the same 90-day schedule.)

4. Analytics and how to turn it off

We measure how the app is used in two ways: on our own servers (the activity records in section 2) and with Google Analytics for Firebase, a service of Google LLC.

Google Analytics for Firebase. It receives usage events (which screens you open and which features you tap, using the same fixed list of event names as our own analytics), device and app details (platform, operating system version, app version, device model, language), an approximate location that Google derives from the IP address of your connection, and an identifier of this app installation that Google creates. We do not send Google your name, email address, account ID or search text; for a search it receives only how long the query was. Advertising identifiers are not collected, advertising personalisation signals are switched off, and so is Google signals. We have also switched off every Google data-sharing option for this account (benchmarking, technical support, account specialists and Google's other products), so Google may not use the data for its own purposes. Event-level data is kept for 2 months and then erased. Our Analytics account is held in Saudi Arabia ("Hawsabah - Nwly"), but Google processes the data in other countries as well (section 7).

Turning it off. In the app's settings you can turn off "Share usage analytics". When it is off, the app stops sending everything to Google Analytics and to Firebase Performance Monitoring (section 6), and it stops sending our own activity records except three that are needed for the reading history you see in the app: which stories you opened, how far you read and which you finished. In particular, no search text, no screens, no sessions and no error records are sent, and navigation steps are not added to feedback you send. Crash reports (section 6) are not part of this switch.

5. Feedback and reports you send

When you send a report, suggestion or idea from inside the app, we receive:

• the type and reason you chose and the message you wrote;
• an email address, only if you choose to give one so we can reply;
• what the report is about (a story, a source or a comment), when you reported from there;
• technical context: app version and build, operating system version, device model, app language, the screen you were on and the last failed network requests (the request path and status code only, never the content or a query string);
• the last 30 navigation steps (screen names and times), only if analytics is turned on;
• a screenshot, only if you keep the one the app offers. You can remove it, and you can blur parts of it before sending. We re-encode it and remove all embedded metadata.

Screenshots can show whatever was on your screen, so we keep them for a shorter time. Our replies to you appear in the app under "My reports", and as a notification when your report is closed.

Retention: a report is kept for 12 months after we close it, then deleted. Its screenshot is deleted 90 days after we close it. The IP address a report was sent from is erased 90 days after it was sent. Reports are deleted with your account, and with an unused guest installation after 12 months.

6. Crash reports and app performance

Crash reports. We use Firebase Crashlytics, a service of Google LLC (Google Firebase), to receive crash reports so we can fix them. The service is switched on only in the released version of the app. A report contains the technical details of the crash (the stack trace, which is what the app was doing when it stopped) and the state of the device and app at that moment (device model, operating system version, app version, available memory and similar). It carries an identifier Crashlytics creates for the installation. We do not attach your name, email address or account ID to crash reports. Crash reports are kept for 90 days. Crash reporting is part of how the app keeps working and does not depend on the analytics switch (section 4).

App performance. We use Firebase Performance Monitoring, also a service of Google, to see how fast the app starts, how smoothly screens draw, and how long the app's network requests take. For network requests it records the address path, response code, response size and timing, never the contents of a request or response. It is not linked to your name, email address or account. It stops completely when you turn off "Share usage analytics" in Settings (section 4).

Google processes both services on our behalf, under its own terms (section 7).

7. Who receives your data

We do not sell your personal data. We share it only with the processors below, who handle it on our instructions and may not use it for their own purposes, and with authorities where the law requires.

• Our hosting provider, which runs the servers that store the data described above.
• Google LLC (Google Firebase): crash reports and app performance measurements (section 6), usage statistics (Google Analytics for Firebase, section 4) and, if you enable notifications, the delivery of push notifications (Firebase Cloud Messaging), which uses your push token. Data sharing with Google for its own purposes is switched off for our account.
• The Apple App Store and Google Play, which tell us about downloads and, if you rate Nwly, ratings, under their own policies.
• Public authorities, if the law requires it, or to protect Nwly and its readers from abuse.

Some of these processors may handle data outside the Kingdom of Saudi Arabia. In particular, Google processes Firebase data (usage statistics, performance measurements, crash reports and push delivery) on servers in other countries. When data leaves the Kingdom we do so only as the PDPL allows, with the safeguards it requires: the data we send to Google is limited to what is described in this policy and carries no name, email address, account ID, advertising identifier or search text, and Google processes it under its data processing terms for Firebase, which bind it to protect the data and to use it only to provide the service to us.

This product includes IP to Country Lite and IP to City Lite data created by DB-IP.com, licensed under CC BY 4.0. The lookup runs on our own servers. Weather data is provided by MET Norway (CC BY 4.0), and city names in Arabic come from OpenStreetMap, © OpenStreetMap contributors (ODbL); for the weather card we send those services only the approximate coordinates of your city, never your IP address or any identifier.

Stories in Nwly come from news publishers. When you open an original article, you leave Nwly and that publisher's own policy applies.

8. Security

All traffic between the app and our servers uses HTTPS. Passwords are stored only as salted one-way hashes. Access to our systems, and to IP addresses in particular, is restricted to people who need it to run Nwly and handle abuse. If a breach puts your personal data at risk we will notify the authority and you as the PDPL requires.

9. Your choices and rights

• Delete your account and data: in the app, open Settings and choose to delete your account (you will be asked for your password). This deletes your account and everything linked to it: follows, saves, likes, comments, reading history, feedback and its screenshots, notifications, your installations with their device details and push tokens, and their activity records. Replies other readers wrote to your comments remain as separate comments. A source you suggested stays in our review queue without any link to you.
• Clear your reading history in the app at any time.
• Mute or unmute news sources in the app at any time. Your muted sources are a list of publisher names (up to 100) kept with your settings, so they sync between your devices. A guest's list moves to the account when the guest signs up or signs in. It is used only to hide those publishers' cards from Today and Following; it does not unfollow them and is not used for anything else. It is deleted with your account, or with an unused guest installation after 12 months.
• Export your data: in the app you can download a file (nwly-data.json) with your own data: your settings, follows, muted sources, saves, likes, reading history, the reports and source suggestions you sent, your notifications and, for an account, your profile and your own comments. It contains only data tied to you, never another reader's data, and it leaves out IP addresses, usage-analytics records, password hashes, session tokens, screenshots and our internal notes. The file is created for you on request and saved on your device through your phone's file picker; we do not send it anywhere else and it is not stored by us afterwards.
• Turn analytics off in the app (section 4). This also stops what is sent to Google Analytics for Firebase and Firebase Performance Monitoring. Data already held by Google is not linked to your account or name, so it is not part of account deletion; it is erased on the schedule in sections 4 and 6.
• Turn notifications off in the app or in your phone's settings.
• Your rights under the PDPL: you may ask to know what personal data we hold about you and to receive a copy, to have it corrected or completed, to have it deleted, and to withdraw any consent you gave (for example for analytics, notifications or a screenshot). Where we rely on your consent, withdrawing it does not affect what was done before. Write to [email protected] and we will answer within the period the law sets. If you do not have an account, tell us the installation details we can use to find your data, or use the in-app deletion that covers your installation.
• If you are not satisfied with our answer you may complain to the competent authority in the Kingdom of Saudi Arabia, the Saudi Data and AI Authority (SDAIA), or to the authority where you live.

10. Children

Nwly is a news app for a general audience and is not directed at children under 13. If you believe a child has given us personal data, contact [email protected] and we will delete it.

11. Changes to this policy

If we change what we collect or why, we will update this page and its effective date, and where the change matters we will tell you in the app.

Recent changes:

• 2026-10-05: added Google Analytics for Firebase (usage statistics) and Firebase Performance Monitoring (app performance), and set out what Firebase Crashlytics collects, how long Google keeps each, and that the analytics switch stops the first two. Also described muted news sources and the personal data export.

12. Contact

Hawsabah, based in the Kingdom of Saudi Arabia. Email: [email protected].

Operational error journal

Nwly keeps a small operational error journal to diagnose connection failures and outages. This journal is sent to our server even when “Share usage analytics” is off. It is independent of usage analytics, is not used for advertising or tracking across apps, and is not sent to an advertising service.

The journal contains a random installation ID, a session ID, entry and request IDs, device and monotonic timestamps, an error count and category, the HTTP method and a fixed endpoint template, our API host, response status, connection timings, the server IP returned by DNS and the server’s Date header when available. It can also contain the network type, whether connectivity is validated or a captive portal is detected, expensive or constrained network flags, a banner’s internal code and short support code, retry or dismiss actions, connectivity probe results, and hourly counts of successful and failed requests with median and 95th percentile timings. We derive the upload’s approximate country and network operator (ASN) on our server; we do not store the user’s IP address in this journal. Native device metadata indicates whether the installation runs on an emulator or simulator.

The journal never includes URL query strings, request or response bodies, search terms, news titles or article text, email addresses, passwords, authentication tokens or the Authorization header. Connectivity checks may contact Google’s connectivity service on Android or Apple’s captive portal service on iOS, and our health endpoint. Those services receive the network information necessary to answer the check, such as its source IP. When the independent connectivity check succeeds but Nwly remains unreachable, a limited non-fatal NwlyUnreachable report may be sent to Firebase Crashlytics at most once an hour, containing only the failure category, endpoint template, network type and whether the DNS server address mismatches our published server addresses.

On the device, the journal retains at most 300 entries or three days, whichever is less, in local storage excluded from device backups. Pending entries upload only when a connection is available; deleting the app before it reconnects loses them. Server journals, correlated API/proxy failures and minute-by-minute service health records are retained for 30 days. Deleting an account deletes its associated journals, and deleting local app data removes the local journal. Signing out retains the device journal. Inactive guest installations and their associated records are deleted after 12 months. Authorized administrators can inspect the journal for support, and access to installation details is audited. A diagnosis is an inference from available evidence and is labelled confirmed, likely or unknown.

To deliver offline library actions once, we retain the operation’s random request ID, action type, creation time and a cryptographic fingerprint under the installation or account. These essential delivery receipts are independent of usage analytics, contain no raw action payload or news text, and are removed when that owner is deleted (including inactive guest cleanup). Reusing the same request ID does not repeat an already completed action. Your in-app data export includes the request ID, action type and creation time.