Privacy & terms.

This policy covers the gynny website and our two products, nawa chat and nawa business. Where the two products behave differently, we say so.

What we collect

Account information

Both products sign you in with a username and password. There is no phone number, no email requirement for sign-in, and no social or third-party login. For nawa chat we store your account identifier, username, display name, avatar URL, and creation and update timestamps.

What you put into the software

nawa business stores the records you create: products and stock, sales and purchase orders, invoices and payment records, contacts and customer notes, employee records including salary history and payslips, and — where those modules are enabled — student, guardian and attendance records, or clinical records for dental practices. This data is yours. We do not mine it, sell it, or use it to train anything.

nawa chat stores your conversations, messages, media, and call records as described below.

Payment card data

We do not collect or process payment card details in either product. nawa business records the payment amounts and methods you enter as bookkeeping; it is not a card processor and no card numbers pass through it.

Device information

nawa chat records one row per installed device so that notifications and calls reach you: a device identifier, device type and name, platform, app version, and push notification tokens. This is used to deliver messages and calls, not to profile you.

What we do not collect

• No location data. Neither product requests any location permission.
• No analytics or tracking. No analytics, crash reporting, advertising, attribution or session-recording SDKs are present in either product.
• No contact list upload. nawa chat can access your contacts only when you tap to share one into a conversation. It does not read, enumerate, upload or hash your contact list in the background.

Encryption in nawa chat

Message bodies and attached media are end-to-end encrypted on your device before they are sent, using ECDH key agreement on the NIST P-256 curve with AES-256-GCM. Your private key is generated on your device, stored in the platform keystore (iOS Keychain / Android Keystore) and never transmitted to us. Only your public key is uploaded, so that others can encrypt to you. Group conversations use a per-group key, wrapped individually for each member and rotated when membership changes.

Local storage is not encrypted

Both products keep a local database on your device. That database is not encrypted at rest. In nawa chat, this means decrypted message content is readable by anyone with access to the device's file system; media files cached locally are encrypted separately. In nawa business, it means the business records listed above — including salary and any clinical data — sit in an unencrypted local database file. Use your operating system's disk encryption and device lock. We are working on encrypting the local database; until we ship it, we are not going to claim otherwise.

Voice calls

nawa chat supports voice calls. Video calling is not currently available. Calls use WebRTC and connect directly between devices where the network allows, with media encrypted in transit (DTLS-SRTP). When a direct connection is impossible — a minority of calls — media is relayed through a third-party TURN server, which sees connection metadata such as both participants' IP addresses, timing and data volume, but not the decrypted content.

We store a call record for each call: participants, whether it was audio, its status and outcome, timestamps and duration. This is a call log. It is not a recording — call audio is never recorded or stored.

Push notifications

Notifications are delivered through Apple and Google's push services, which necessarily see that a notification was sent, to which device, and when. We deliberately keep content out of the payload: notification bodies are generic (“New message”, “Missed call”) and never contain message text. The sender's display name is included as the notification title, so those services can observe who contacted whom and when.

Link previews

When a link is shared in a conversation, the app fetches that page to build a preview. This reveals your IP address to the linked website. If you would rather not, do not open or send links you do not trust.

Who else sees your data

We use a small number of infrastructure providers. They process data on our behalf; none of them are permitted to use it for their own purposes.

How long we keep it

nawa chat message content: 24 hours

An automated database job removes message content and media from our servers within 24 hours, and sooner once a message has been delivered and read. This runs regardless of delivery status, so nothing lingers because a recipient never opened it. Your own copy stays on your device until you delete it.

To be precise about what remains: the message record — its identifier, which conversation it belonged to, who sent it, and its timestamps — is retained after the content is wiped. So conversation metadata persists even though the content does not.

Everything else

Business records in nawa business are kept for as long as your account is active, because they are your operating records. Account information and device records are kept while the account exists. Call logs are retained on a rolling basis and cleared automatically.

Your choices

• Delete your account. nawa chat provides account deletion in-app, which removes your account and associated records. For nawa business, write to us and we will action it.
• Get a copy of your data. Ask us and we will provide what we hold.
• Correct it. Most information is editable directly in the products; if something is not, tell us.
• Turn off notifications. Revoke the permission in your operating system; no push tokens are then used.

To exercise any of these, write to hello@gynny.io.

Children

Our products are sold to businesses and are not directed at children. nawa business includes modules for nurseries and schools, in which case the institution — not gynny — is the controller of student records, and is responsible for the lawful basis of processing them and for obtaining guardian consent where required. We process that data on the institution's instructions.

Changes to this policy

If we change how the products handle data, we will update this page and move the date at the top. Material changes affecting your rights will be notified in the product.

These terms govern your use of the gynny website and our products. If you are agreeing on behalf of a business, you confirm you are authorised to do so.

Licence

We grant you a non-exclusive, non-transferable right to use the products for your own business purposes, for as long as your subscription or licence is current. You may not resell, sublicence or redistribute them without a written agreement with us, and you may not decompile or reverse-engineer them except where law expressly permits it.

Your data is yours

You keep all rights to the data you put into the products. We claim no ownership of it. We access it only to operate the service, to fix a fault, or where you ask us to — and never to build a competing product or to train models.

Your responsibilities

• Keep your credentials secure, and tell us promptly if an account is compromised.
• Make sure your use of the products complies with the law that applies to you — including tax and record-keeping obligations, and data protection law where you hold records about other people (customers, employees, students, patients).
• Where you hold personal data about others in our products, you are the controller of that data and we are your processor.
• Do not use the products to break the law, to send unsolicited bulk messages, or to interfere with the service or other users.
• Keep your own backups of anything you cannot afford to lose.

Availability

Both products are designed to keep working without a connection, and the local-first design means an outage on our side does not have to stop you trading. That said, we do not promise uninterrupted availability of the synchronising and messaging services, and we may take them down for maintenance.

What we don't warrant

The products are provided as they are. We do not warrant that they are free of defects, nor that they fit a particular purpose you have in mind. Nothing here excludes liability that cannot lawfully be excluded.

Specifically: nawa business is a record-keeping and operations tool, not accounting, tax or legal advice. Its reports are only as accurate as the data entered. Where a module holds clinical or student records, you remain responsible for meeting the professional and regulatory standards that apply to you.

Limitation of liability

To the extent the law allows, we are not liable for indirect or consequential loss, for lost profit or revenue, or for lost or corrupted data where you have not kept your own backups. Our total liability for any claim is limited to the fees you paid us in the twelve months before it arose.

Fees

Fees, billing periods and any trial terms are those set out in the offer or agreement we make with you. Where we change pricing for a renewing term, we will tell you before the renewal so you can decide.

Advisory services

Where we provide advisory or consulting work, that engagement is governed by the separate written scope we agree with you. Advice is given on the information available to us at the time; commercial decisions remain yours.

Ending it

You may stop using the products at any time. We may suspend or end access if these terms are seriously or repeatedly breached, or if fees go unpaid after we have asked. On termination you may export your data — ask us and we will help.

Governing law

These terms are governed by the laws of Lebanon, and the courts of Lebanon have jurisdiction, unless we have signed something with you that says otherwise.

Contact

Questions about either document: hello@gynny.io.