Privacy Policy

QWS is operated by an independent freelancer in Saudi Arabia. For any question or request about privacy, write to hay@no.sa. For the purposes of the PDPL, we are the controller of the personal data described in this policy.

We collect only what the service needs. The main groups are:

• Account: your email address (stored in lowercase), your display name, and whether your email is confirmed. Your password is never stored as you typed it: only a hash made with Argon2id.
• Profile: username, tagline, bio, quote, location (free text, which you can hide), colour theme, vibe tags, profile and banner pictures, social links, the interests you pick, your favourites (titles, ratings and posters you choose), badges, level and recent activity.
• Content you create: posts, comments, polls and votes, reactions, reposts, saved and hidden posts, questions and answers, stickers you make or save, and community content such as the communities you create or join, their posts, roles, invites, join requests and bans.
• Your connections: follows, follow requests, blocks, mutes and muted words.
• Support: tickets, and the messages and pictures you send in them.
• Reports: reports you make about content or people (the reason and any note you add), and the moderation decisions made about them.
• Notifications: your notification settings, the notifications in your bell, and, if you turn on push notifications, the details of each browser or device: its push service address, its encryption keys, a label such as "Chrome on Windows", the site language it was set to, and when it was last used.
• Sign-in sessions: a session ID, the browser's user-agent text (up to 300 characters), when the session started, when it was last seen (updated about once an hour), and when it was signed out.
• Activity on the site: post views (one record per person per post per day, used to count views and deleted after two days), and a training log of feed impressions (see the next section).
• Security data: your IP address, which we use to limit how many requests you can make and to stop bots. It is held in the server's memory for a short time and is not written to our database. Guest profile visits are also counted by IP address, for 30 minutes, in memory only. When we check a bot-protection (Cloudflare Turnstile) token, your IP address is sent to Cloudflare as well.
• Pictures you upload (avatars, banners, post and favourite pictures, sticker images and attachments to support tickets), stored in object storage. A picture you upload but do not save is removed after about a day.
• Emails we send you: confirmation links, password reset links, and a notice if someone tries to register with an email address that already has an account.

For a share of viewers each day, chosen by us, we log each post shown to a signed-in viewer in the feed, search, a tag, a profile or the saved list (never their own posts). Each entry records the post, where it was shown (for example Explore or Following), its position in the list, how long it stayed on screen, whether it was opened, the post's popularity score and age at that moment, and whether the viewer follows its author. If a viewer is in the sample on a given day, the whole day is logged. We use this log to measure and improve how posts are ranked and suggested. Entries are deleted after 90 days. Only staff with access to the admin dashboard can read the log, and other users never see it.

We use personal data only for the purposes below. Each purpose has a legal basis under the PDPL and GDPR principles.

Public information is visible to everyone: your public profile, your posts and communities that are public, and questions you ask with your name. Search engines can index public profile pages. Your privacy settings decide what visitors and followers see, including whether your profile is private, which sections each group sees, and whether your location and view count are shown. Community owners and moderators see what happens in their community, and our moderation team sees reports.

We use outside providers to run the service. They act on our instructions and only receive what they need:

• Cloudflare: bot checks (Turnstile) on sign-in, registration and some forms, which receive your IP address and a token; and object storage (R2) for uploaded pictures. Uploaded pictures are served from a public address, so anyone with the link can see them.
• Email: a provider located in Saudi Arabia, which sends our emails through an SMTP server.
• Hosting: a provider located in Saudi Arabia, which hosts the application and its database.
• Web push services run by browser makers (such as Google, Mozilla and Apple): they deliver push notifications to your devices. The content is encrypted for your device.
• Media information providers: TMDB, AniList, the Apple iTunes Search API, IGDB (Twitch) and Wikipedia. We send them search words or titles, not your personal data. Posters from these services are linked from their own servers, so your browser loads them directly from there. Trailers play through YouTube (in its privacy-enhanced mode) or Dailymotion only when you open them.
• Public lists: our server downloads a public list of disposable email domains, and no personal data is sent with it.

We do not sell your personal data. We disclose data to authorities only when the law requires it or a valid order is made.

The application and its database are hosted in Saudi Arabia, and our email provider is located there too. Uploaded pictures are stored with Cloudflare (R2), which may process them outside Saudi Arabia. Cloudflare also runs our bot checks (Turnstile), and web push services run servers outside the Kingdom. Where data is processed outside the Kingdom, we use the conditions the PDPL sets for transfers out of the Kingdom and choose providers with suitable safeguards.

Under the PDPL, and the same principles under GDPR, you can:

• See your data. Most of it is visible in your Account page and on your profile.
• Correct it. Change your profile, display name and other details in Account.
• Delete your account. Go to Account > Account > Delete account (/account?tab=account). After a 30-day grace period, your account and its personal data are deleted.
• Get a copy of your data. There is no self-service download yet, so ask us at hay@no.sa and we will send your data in a readable form.
• Control notifications. Change or turn off notifications, and push on each device, in Account > Notifications.
• Control who sees what. Use the privacy settings in Account to set who sees your profile sections, your location, your views and whether your account is private.
• Object to processing based on our legitimate interests, including the feed impression log, and ask us to restrict it, by writing to us.
• Withdraw consent where we rely on it, for example push notifications. This does not affect what we did before you withdrew it.
• Complain to the competent authority: the Saudi Data & AI Authority (SDAIA), which oversees the PDPL.

We will reply within 15 days. We may ask you to confirm who you are first.

We use only the cookies and browser storage the site needs. We do not use advertising or analytics cookies, and the site loads no advertising or third-party analytics scripts. Cloudflare Turnstile, which loads on sign-in and some forms, may set its own technical cookies under Cloudflare's policy.

Feeds, trending tags and suggested people are ordered automatically, using things like engagement and how old a post is. This does not make decisions that have legal or similarly significant effects for you. You can object as described in Your rights and choices.

QWS is for people aged 16 and over. We do not knowingly collect personal data from anyone younger. If you believe a child under that age has an account, write to hay@no.sa and we will delete it.

• The site is served over HTTPS and sends HSTS, so browsers only connect securely.
• Passwords are hashed with Argon2id. Reset and confirmation links carry tokens that we store only as hashes.
• The sign-in cookie is HttpOnly, Secure in production and SameSite=Lax.
• You can sign out of one device, or of every device at once.
• Access to admin tools depends on permissions, and admin actions are recorded in an audit log.
• We limit request rates and check for bots on sensitive forms.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the competent authority as the law requires.

We may update this policy. For material changes, we will show a notice in the app before they take effect. The date at the top shows when the current version took effect.

Questions and requests: hay@no.sa. Controller: an independent freelancer, Saudi Arabia.