Privacy policy
Last updated:
In short
- 3achra never touches your money. The app works out who owes what and prepares the reminders. You pay each other outside the app.
- We keep the minimum to run your account and your shared groups: first name, email, groups, expenses and payments. Never your contacts, your location or the text of your reminders.
- We sell nothing and we don’t share your data for advertising.
- You can delete your account at any time, in the app or from the Delete my account page.
1. Who we are
3achra is a project run by Hamza El Mekkoudi (an individual, Salé, Morocco) until a company is registered. He is the data controller for the data described here.
Contact: contact@3achra.ma
2. The 3achra app
The data
- Your account: first name, email address, password (stored in a hashed form we cannot read), chosen language, and whether your email is verified. We email you a 6-digit code, valid for 10 minutes, to verify your address or change your password.
- Your groups: the group’s name and type, members’ first names or nicknames (including people who don’t have the app and whom the organiser adds), expenses, amounts, each person’s share, and who paid and when. If you add it, a member’s phone number, to open their WhatsApp chat directly.
- Reminders: when you tap “Send reminder”, the app opens WhatsApp with the message already written, and you send it. We only record that a reminder was prepared (date, chosen tone), never the text of the message.
- Usage measurement: no third-party analytics tool and no advertising ID. Our statistics come from the app’s own data: for example the number of active groups, the share of expenses settled, or the time spent on the “add a match” screen.
- Technical data: our server logs (IP address, date, request made, errors), for security and to fix bugs.
- Your messages: if you write to us (for example from “Give feedback” in the app), we receive your email address and your message, to reply to you.
What the app doesn’t do: it doesn’t ask for access to your contacts, location, camera or microphone, and it shows no ads.
Who sees what
- Members who have joined a group see its names, expenses and balances.
- With a group’s invite link, a person sees the group name, the organiser’s first name and the names not yet claimed, and can ask to join. The organiser sees who joined, can remove a person and can change the link at any time.
- On your phone, your session key is kept in the system’s secure storage.
Why, and on what basis
- To run the service you ask for (account, shared groups, splitting expenses, reminders): performance of the service you sign up to (law 09-08, article 4).
- Security and preventing abuse: our legitimate interest in protecting the service and its users.
- Improving the app with overall statistics, and replying to you when you write to us.
How long
- Your account and groups: as long as your account exists.
- When you delete your account, we delete your account and your group memberships. Groups you created are deleted for all their members, after a warning in the app. Technical backup copies are erased within 30 days.
- Technical logs: 30 days at most.
3. The 3achra.ma website and the waitlist
What we collect: your first name, your WhatsApp number, your city (optional), what you split most (optional), the page language, the sign-up date, your consent and the version of this policy, a random invite code, the code of the person who sent you the link (if you came through their link), and the visit source shown in the link (for example the video or the network).
Why:
- to tell you on WhatsApp when the app is out;
- possibly to invite you to try it before everyone else;
- to understand what people split most (overall statistics);
- to know which videos bring people in.
Legal basis: your consent (law 09-08). You can withdraw it at any time.
Messages: only about 3achra (launch, early access), never ads for anyone else. To stop them, reply “STOP” or email us.
How long we keep it: up to 12 months after the app’s public launch, then we delete it. Sooner if you ask.
Cookies: the website uses no cookies and no ad tracking. We measure visits with Cloudflare Web Analytics, without cookies or identifiers: overall numbers such as visits, country and device type.
4. Our providers, and transfers outside Morocco
Only the 3achra team (today, the founder) has access to your data. We use these technical providers, which process it on our behalf:
- Render: the app’s servers and database, in the European Union (Frankfurt, Germany);
- Resend: sending the code emails;
- Supabase: the waitlist database, in the European Union;
- Cloudflare: website hosting and security, and cookie-free audience measurement;
- WhatsApp (Meta): the messages you send, and the ones we send to the waitlist;
- Google Play and the App Store: downloading the app, under their own policies.
These providers are located outside Morocco. These transfers are made in line with articles 43 and 44 of law 09-08.
Security: connections are encrypted (HTTPS), passwords are never stored in plain text, and access to the databases is limited to the founder. The public waitlist form can only add a sign-up: it cannot read the list.
5. Your rights
Under law 09-08, you have the right to information, to access your data, to correct it and to object to its processing on legitimate grounds. You can also withdraw your consent and ask us to delete your data.
- Correct your first name: in the app’s profile.
- Delete your account: in the app (Profile → “Delete account”), or from the Delete my account page.
- Any other request: contact@3achra.ma. We reply within 30 days at most.
You can also contact Morocco’s data protection authority, the CNDP: www.cndp.ma.
CNDP declaration: in progress.
6. Age
3achra is for people aged 18 and over.
7. Changes
If this policy changes, we update the date at the top of the page. For an important change, we announce it in the app and, for the waitlist, on WhatsApp.