Privacy Policy

v1.0.0
Last updated: 25 October 2026

1. Introduction

Welcome to Ghaya (غاية) ("Ghaya", "we", "our" or "us"), operated by Anytech General Trading LLC ("Anytech"), a company registered in Dubai, United Arab Emirates. Anytech is the data controller for the personal data described in this policy.

This Privacy Policy explains how we collect, use, share and protect information when you use:

• the Ghaya app for iPhone and iPad, and for Android when it is available;
• our website at https://getghaya.com, including the families' library of published tasks and goals; and
• related services, such as Connect your AI and Ideas and help

(together, the "Service").

Ghaya is a family app. A parent creates a family, adds their children and may invite another parent and helpers. Children use Ghaya under their parent's account. Because of that, this policy speaks mostly to parents. Section 6 explains how we handle children's data, and section 7 explains who in a family can see what.

Please read this policy carefully. If you are a parent, you are also agreeing to it for the children you add. If you do not agree, please do not use the Service.

2. The short version

• We collect only what a family needs to run Ghaya: first names, birthdays, the tasks, goals, rewards and points you set up, and what people send each other in the app.
• Children never need an email address, phone number or Apple or Google account. Their profile is created and controlled by a parent.
• Family content is private to the family. Nothing a family writes is public unless a parent chooses to publish a saved task or goal, and published items carry words only, never photos or children's names.
• We do not sell personal data. We do not show advertising. We do not use third-party analytics or advertising tools in the app.
• We do not use your family's data to train general-purpose AI models.
• Ghaya never holds or moves money. Pocket money and cash-outs are records only.
• You can download your family's data and delete your account from inside the app at any time, free on every plan.

3. Information we collect

3.1 Parents and helpers

When you sign in and use Ghaya as a grown-up, we collect:

• Sign-in details from Apple or Google: a stable account identifier, your email address (which may be an Apple private relay address if you choose Hide My Email), whether the provider has verified it, and which provider you used. We never receive your Apple or Google password.
• Profile details you enter: your first name, what the children call you (for example "Mum" or "Baba"), your relation to the family, and your role (parent or helper).
• An optional photo for your picture (Ghaya Plus).
• A screen name, only if you are a parent and choose to publish to the families' library (section 9).
• An email address a parent adds to an invite, used only to recognise the invited person when they sign in. We never send anything to it.
• Settings, such as language, appearance, notification choices and quiet hours.
• Your activity, such as tasks and goals you set up, work you approve or send back, rewards you hand over, shout-outs, notes and messages.

3.2 Children

A parent provides the following when creating or editing a child's profile:

• first name;
• birthday (we work out the child's age from it);
• a colour, a picture style (a letter or a built-in critter face or mark) and the app's look for their age;
• optionally, the child's gender, used only so the Arabic app can address the child with correct grammar;
• the language of the children's app (children from 13 can choose their own);
• optionally, from age 13 only, an email address, added by a parent and used only to recognise the teenager when they sign in with their own account. We never send anything to it. If a birthday is corrected to under 13, the email is removed.

As the child uses Ghaya, we also hold what they do in the app: tasks they send, the level they reached, notes, chat messages, stickers and voice notes, reward and goal ideas, cheers to siblings, and the points they earn and spend.

Children do not need an email, phone number or Apple or Google account to use Ghaya. Children never see a price or a purchase screen.

3.3 Family content

Everything a family creates in Ghaya, including:

• tasks, goals, levels, schedules, rewards, prices, packs, and "Our tasks" and "Our goals";
• the points history (approvals, bonuses, shout-outs, pocket money, rewards, corrections);
• pocket money and cash-out records (section 12);
• chat on tasks and goals: text, emoji, stickers, reactions, voice notes (up to 60 seconds) and photos (Ghaya Plus);
• photos on tasks, rewards and goals (Ghaya Plus), which we store at reduced size, never the original;
• birthday gifts and family cards;
• the family's name, currency and points rate, school days, and the choices a parent makes for task ideas (up to three values, what's at home such as a pet, garden or instrument, and whether the home has help).

We use the idea choices only to suggest tasks. We never infer anything from names, language, region or ethnicity.

3.4 Devices

• Linked devices. When a child's device is linked with a code, we record the link, a label for the device and when it was linked. Parents can see and remove linked devices.
• The PIN a child chooses stops a brother or sister opening their profile. On a child's own device it stays on that device. Where a PIN is checked by our servers, for example on a shared family iPad, we keep only a protected (hashed) form of it, never the PIN itself.
• Push notifications. If you allow notifications, we hold a device token so Apple's push service can deliver them.
• Technical information, such as device model, operating system and app version, and IP addresses in server logs, used to run the Service securely. We do not use a third-party crash reporting tool; if you allow it in your device settings, Apple may share crash reports with us.

3.5 Subscriptions

If a parent subscribes to Ghaya Plus, the purchase is made through Apple's App Store. Apple sends us a signed record of the transaction: the product, dates, renewal status and an anonymous family reference, so we can turn Plus on for the whole family. We never receive or store card details.

3.6 Messages to us

When a grown-up sends an idea, problem or question through Ideas and help, we hold what they write, any screenshot they attach and our replies. A teenager's idea reaches us only if a parent chooses to send it on.

3.7 The website

The website does not require an account. We count visits as totals only. To count views of published items without storing who you are, we use a visitor fingerprint that changes every day (a "salted hash") and we do not store IP addresses for this purpose. Link-preview fetchers and bots are excluded. See section 15 for cookies.

4. How we use information

We use information to:

• provide the Service: run each family's tasks, goals, rewards, points, chat, birthdays, badges and notifications;
• create and manage accounts, families, invites and linked devices;
• turn Ghaya Plus on and off for the family, based on Apple's records;
• suggest tasks and goals that suit a child's age and what the parents chose;
• run the families' library, including automatic and AI checks of what parents publish (section 9);
• answer Ideas and help messages;
• keep the Service secure, prevent abuse (for example, guessing invite codes or faking likes) and fix problems;
• meet legal obligations and enforce our Terms of Service.

We may produce statistics that cannot identify any person or family (for example, how many tasks are added from the library), and use them to improve Ghaya.

We do not use children's data for advertising, profiling for marketing, or any commercial purpose beyond providing the Service to their family.

4.1 Legal bases

Where the law requires a legal basis, we rely on:

• Contract: to provide the Service a parent or helper signs up for;
• Consent: a parent's consent for their children's data, and consent for optional features such as notifications, photos, the AI connector and publishing. You can withdraw consent at any time (section 14);
• Keeping the Service safe: protecting the security of the Service and preventing abuse, as the law allows (under the GDPR, our legitimate interests);
• Legal obligation: for example, keeping tax records.

5. Sharing and disclosure

We do not sell personal data.

We share information only:

• Within your family, as described in section 7.
• On the website, when a parent publishes a saved task or goal (section 9).
• With your chosen AI, if a parent connects their own AI assistant (section 10).
• With service providers that help us run Ghaya, under contracts that require them to protect it and use it only for us:
• Supabase (database, sign-in, file storage and server functions);
• Apple (Sign in with Apple, App Store payments, push notifications);
• Google (Google sign-in);
• Cloudflare (our domain, website delivery and view counting);
• an AI model provider, for checking items parents publish to the families' library. Only the published words are sent, never the family's other data;
• Microsoft (our support and privacy email).
• For legal reasons: if required by law, regulation, court order or a government authority, or to protect the safety of children, users or the public.
• In a business transfer: if Anytech is involved in a merger, acquisition or sale of assets, under the same protections as this policy.

Under the UAE Child Digital Safety Law, we may also be required to report harmful content involving children to the competent authorities.

6. Children's data and parental consent

6.1 Parents create and control children's profiles

Only a parent can add a child to Ghaya. Before a child is added, the parent ticks a box confirming that they are the child's parent or legal guardian and that they agree to this policy for the child. We record that consent: which parent gave it, when, and which version of this policy it was for. Parents can see the record on the child's page, and it is included when they download their data.

If we change this policy in a way that affects children's data, we ask a parent to confirm again before we rely on the new terms for that child.

Parents can at any time:

• see everything their children have in Ghaya;
• change a child's name, birthday, colour, gender setting, language and email;
• remove a device, reset a PIN, or put a child on a break;
• turn off features such as brothers and sisters, birthdays and shout-outs;
• download all of their children's data;
• remove a child from the family, or delete the whole family.

Withdrawing consent is simple: remove the child (Family → the child → Remove) or delete the family (Settings → Delete account). Either stops all processing of that child's data, except for the limited retention in section 13.

6.2 What we collect from children, and why

We collect from children only what Ghaya needs to work: their first name, birthday, settings, and what they do in the app (section 3.2). We do not ask children for contact details, location, photos of themselves or any other information. Children are not offered photos in chat on the Free plan, and children's pictures are never their own photo.

6.3 Privacy by default

• A child's device can read only that child's own data.
• Brothers and sisters see each other's wins only if a parent turns this on, and each child can keep their wins to themselves.
• Children never see the website or the families' library at launch, and nothing a child creates is ever published.
• Children never see a price, an advert or a purchase screen.
• No streaks that break, no rankings between children, nothing deducted for missed work.

6.4 Teenagers

From 13, a teenager may sign in with their own Apple or Google account, with a parent's permission (a parent adds their email or shows them the code). The teenager's profile stays in the family, and the parents keep the controls in section 6.1. A teenager can choose their own app language and can share ideas for the app, which reach us only if a parent sends them on.

6.5 If you're located in the United States

Ghaya is designed for families with children under 13. We collect children's personal information only with a parent's consent, as described above, and use it only to provide the Service to the family. We share children's personal information with third parties only as listed in section 5 (service providers acting for us) and, if a parent chooses, with the AI assistant that parent connects (section 10), which is a separate choice from creating the child's profile. We never disclose children's personal information for advertising or for training AI models. A parent can review, delete or stop the collection of their child's information at any time (section 6.1), or by contacting us (section 17). Our retention policy is in section 13.

7. Who in a family can see what

Parents can hide any chat message. People can delete their own.

8. Helpers

A parent can invite a helper (Ghaya Plus). The helper signs in with their own Apple or Google account. A helper can set up tasks and goals, check work, give shout-outs, hand over rewards and chat, for the children they can see. Helpers cannot change rewards and prices, children's settings, the family or the plan, and cannot invite anyone.

What a helper does in Ghaya stays in the family's history after they leave, shown as "Former helper". A helper's data download contains only their own activity.

9. The families' library (the public website)

9.1 What is public

The website shows Ghaya's own tasks and goals, and saved tasks and goals that parents choose to publish. Only parents can publish. A published item is a frozen copy containing:

• the title, what "done" means, how often, the ages it suits, levels and points (on Ghaya's own scale), and for a goal its tasks;
• Ghaya's built-in picture, never a family's photo;
• the byline the parent chose: their screen name, or their first name and the first letter of their last name.

It never includes children's names, due times, chat, family photos or any other family data.

Published pages can be indexed by search engines and shared as links.

9.2 Checks before anything goes public

Before an item is published, automatic checks refuse names of people in the family, phone numbers, email addresses and links. An AI check then reads the words (section 10.1). If it raises a concern, a person on our team reviews the item before it goes live. We keep the AI's verdict and each approved version.

9.3 Screen names

A screen name is chosen at the first publish, not at sign-up. It must be unique, cannot be a child's name, and can be changed once a month. An author page lists an author's published items and their totals. It links by a public author ID, never your account.

9.4 Likes, views and reports

Signed-in grown-ups can like an item (once each) and report it. Views are counted once a day per grown-up and shown only to the author's family. The public number is "Added by N families". We log likes and reports with the account that made them, to prevent fake likes and abuse. Any grown-up can hide an author, which affects only what they see.

9.5 Unpublishing and copies

A parent can unpublish an item at any time. Deleting the original, leaving the family, or being removed from it also takes the parent's items down. Removal from our website is immediate, but search engine caches may take time to clear and are outside our control. Families who saved or added a copy while it was published keep their copy. Copies cannot be republished as someone else's.

10. AI features

We do not use family data to train general-purpose AI models, and we only use AI providers whose terms do not allow them to do so.

10.1 The AI check of published items

When a parent publishes or updates an item, we send only the item's published words to an AI model, which checks them against our library rules. Clean items go live; flagged items wait for a person on our team.

10.2 Connect your AI (optional, Ghaya Plus)

A parent can connect their own AI assistant (for example Claude or ChatGPT) to Ghaya. The parent signs in and approves the connection on Ghaya's consent page, and the assistant then acts as that parent, under the same rules as the app. It can read the family's information and, if the parent allows, make changes such as creating tasks or approving work. It cannot undo approvals, pay out, correct points, delete anything, publish, invite people or change the plan.

When a parent chats with their AI about the family, the family's information, including children's names, tasks and progress, is sent to that AI provider and processed under that provider's own terms and privacy policy, not ours. The parent chooses the provider. Changes made this way are marked in history ("Created by Claude for Rana"). A parent can disconnect at any time in Settings, and access ends at once; the account holder can disconnect any connection.

10.3 Replies from our team

Replies to Ideas and help messages (Ghaya Plus) may be drafted by an AI assistant. Those replies are labelled as from the Ghaya assistant. To prepare a reply, the assistant sees only that request and its thread.

11. Payments

Ghaya Plus is sold through Apple's App Store. Apple processes the payment under Apple's terms and privacy policy. One subscription covers the whole family. We receive transaction records (section 3.5), never card details. Cancelling, changing plans or refunds are handled by Apple.

12. Pocket money and cash-outs are records only

Ghaya can show points as money at the family's own rate, track pocket money, and record when a parent pays a child for points (a "cash-out"). Ghaya never holds, transfers or receives money. These are records the family keeps for itself. We do not collect bank, card or payment details for them.

13. Data retention and deletion

We keep personal data only as long as needed for the purposes in this policy.

Downgrading from Plus to Free never deletes anything.

14. Your rights

Depending on where you live, you may have the right to:

• access your personal data and receive a copy;
• correct it;
• delete it;
• restrict or object to some processing;
• take it to another service (portability);
• withdraw consent at any time, without affecting what was done before.

Most of these are built into the app:

• Download your data (Settings → Privacy and help): one ZIP with a JSON file, a spreadsheet per part, photos and voice notes, and a README. Parents get the whole family, including their children's data. Helpers get their own activity. It never includes codes, other grown-ups' emails, other people's messages to our team, or deleted content. Free on every plan.
• Delete your account (Settings → Delete account). If you are the only parent, this deletes the family. Otherwise you leave the family.
• Correct names, birthdays and settings at any time.

Parents exercise these rights for their children.

14.1 If you're located in the UAE

We process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and Federal Decree-Law No. 26 of 2025 on Child Digital Safety. You may complain to the competent UAE data protection authority.

14.2 If you're located in the EEA or the United Kingdom

You have the rights listed above under the GDPR or UK GDPR, and the right to complain to your local data protection authority. Where a child is below the age of digital consent in your country (13 to 16), we rely on the parent's consent.

14.3 If you're located in the United States

See section 6.5. Residents of some states may have additional rights; contact us to use them.

To use any right, contact us (section 17). We may need to confirm your identity first, and we answer within 30 days.

15. Cookies and similar technologies

In the app we use only what the app needs to work, such as keeping you signed in. We do not use advertising identifiers or tracking across other apps.

On the website we use only strictly necessary cookies, for example to keep a parent signed in when they like, report or copy an item. We do not use advertising or tracking cookies. Visits are counted without cookies. If we ever add optional cookies, we will ask first. You can also control cookies in your browser.

16. Security, data location and transfers

We built Ghaya so that each person can reach only what their role allows, and we check this on our servers, not just in the app:

• Sign-in. Parents and helpers sign in with Apple or Google; we never see or store their passwords. Children's devices are linked with a code that lasts 15 minutes and a PIN the child chooses. The PIN keeps brothers and sisters out of each other's profiles on a shared device; the family's account is protected by the parents' sign-in.
• Access rules on the server. Every table has row-level security, and every change goes through a server function that checks who you are and what your role allows. A child's device can read only that child's own data. Helpers can read only the children a parent chose for them.
• Codes. Invite and device codes come from a secure random source, avoid look-alike characters and expire (invites after 7 days, device codes after 15 minutes).
• Photos and voice notes are kept in private storage, reachable only through short-lived signed links, and are made small before upload.
• Encryption. Data is encrypted in transit (TLS) and at rest by our hosting provider.
• Our team. Only a small number of people at Anytech can access production systems, with two-factor sign-in, and only to run and support the service. Team actions, such as reviewing published items, run through separate functions only the team can use.
• Payments are handled by Apple. We never see card details, and Ghaya never holds or moves money.
• Testing. Our access rules are covered by automated tests that run against the real database rules before every release.

No system is completely secure, and we cannot guarantee absolute security. If a personal data breach puts you at risk, we will tell you and the UAE authorities without undue delay, as the PDPL requires.

Our servers are hosted by Supabase, and may be located outside the UAE. Some providers (such as Apple, Google, Microsoft, Cloudflare and the AI provider) may process data in other countries. Where the law requires, we use appropriate safeguards for transfers outside the UAE, such as contractual protections.

17. Contact us

If you have questions about this policy or your data, please contact us:

Anytech General Trading LLC
Sharaf Building, Al Mina Road, Dubai, United Arab Emirates
Trade licence no. 565024 (Dubai Department of Economy and Tourism)
Email: privacy@getghaya.com or support@getghaya.com
Website: https://getghaya.com

18. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date. If a change affects how we use children's data, we will tell parents in the app first and, where the law requires, ask for consent again.

19. Language

This policy is available in English and Arabic. If the two differ, the Arabic version prevails for consumers in the UAE, and the English version prevails elsewhere.