Privacy

Who we are

Sahraa is made by SolutionsCrafters, a sole proprietorship registered in the Netherlands (KvK 42003616). We are responsible for the data described here. Questions or requests: hello@sahraa.app

What we keep, and who can see it

Google sign-in is optional in the app and on the website. We receive your name, verified email and Google account identifier, and store the link to your Sahraa account. The Google button opens Google’s service under its privacy policy. Website deletion requires your password, or selecting the linked Google account after confirming deletion; an existing session alone is not enough.

• A gathering: its name, occasion, date and time, city, and the address or map pin if the host adds one

  Why

  To run the invitation

  Who can see it

  Anyone with the invitation link sees the name, time and city. The exact address: the host, and guests who answer “coming”.

• Your reply: the name and face you choose, your answer, and how many adults and children are coming

  Why

  So the host knows who is coming

  Who can see it

  Anyone with the invitation link

• The bring list: items, who is bringing what, and photos added on the website

  Why

  So nothing is brought twice

  Who can see it

  Anyone with the invitation link

• Games: the names and faces at the table, answers and scores

  Why

  To play

  Who can see it

  The players at that table. A gathering’s results also appear on “Tonight’s board” for the host and the guests who answered “coming”.

• An account, if you make one: your email, your password (stored only as a one-way hash), name, face and up to 30 recent game results

  Why

  So your gatherings and history follow you to any device

  Who can see it

  Only you

• Game ideas you send us: the idea, and a name to credit if you add one

  Why

  To read them

  Who can see it

  Only us

• Technical data: a random device ID to recognise your reply, a keyed hash of your IP address for up to a day to stop abuse, and our hosting provider’s access logs

  Why

  To keep Sahraa working and safe

  Who can see it

  Only us and our hosting provider

Levels and XP

Only with an account. Your account collects XP when you host a gathering, attend one, or finish a game (against the computer, on one phone or in the Score Book too), or win one with other people. Your level, badges and streak are worked out from it.

• XP record: what each point was for (hosting, attending, a finished game, a win), how many, and when. For a game: which game, how many rounds, whether you won, whether it was against the computer, or on one phone or in the Score Book (with the id your phone gave it and when it started and ended) and, in partner games, your partner’s account; for a gathering: its occasion and date, and for the host how many devices were there. With it, counters that cap XP per day and per week.
• Attendance: a gathering counts when you sit at one of its game tables in the app while signed in, from 30 minutes before it starts until it ends, as the host or a guest who answered “coming”. We keep which gathering, when you came in, and a one-way hash of your device’s random ID — so one phone cannot count as several guests — with the gathering’s host, occasion, date and end time.
• Friends board: each week it shows the name, face, weekly XP and level of you and of people with an account who were counted at the same gathering as you. “Hide me from the board” takes you off the board for everyone, and you can undo it.
• Level at the table: when you sit at a game table with your account, the players at that table see your level next to your name, even if you are hidden from the board.
• Your XP record, badges and streak: only you see them.

Online gatherings

When the host makes a gathering online, it has no address. Its room opens shortly before the start (15, 30 or 60 minutes, the host chooses) and closes when the gathering ends; the host and guests who answered “coming” or “maybe” can enter.

• Your time zone: the one your phone or browser reports when you enter the room, saved with your reply so the others see your local time.
• Presence: when you were last in the room and when you last opened the invitation, so the room can show who is here, on the way, or not there yet.
• Phrases and emoji: the ready-made phrases and emoji sent in the room, with who sent them and when. There is no free text. Only the latest 50 per gathering are kept; older ones are deleted as new ones arrive.
• Who sees it: the host and the guests who can enter the room. All of it is deleted with the gathering, or when your reply is deleted.

Tonight’s board and the gathering memory

Every finished game of a gathering becomes a line on “Tonight’s board”: which game, the names and faces, the scores and who won. With it come how many games each name played and won that night, and the star of the night. After the gathering ends, it becomes the “Sahra memory”: the name and date, the faces of the host and the guests who answered “coming”, the star of the night, the most played game and how many games were played.

• Who sees it: only the host and the guests who answered “coming”. Guests who answered “maybe” or “can’t make it”, and anyone else with the link, see none of it. It carries no address, no table or invitation code and no e-mail address.
• The gathering’s tables: the board reads the results of the gathering’s own game tables, and nothing new is stored for them. A computer player is shown on its line but never counted in the totals or made the star of the night.
• The score book: when the host keeps a score sheet for their gathering, the app sends us the game, the names and faces on the sheet, each player’s score and place, and when it ended. It stays hidden until the host puts it on the board.
• The memory card: the image is made on your phone when you share it, and we keep no copy. It has no address, link or QR code.
• Deletion: when the host deletes the gathering, the board disappears at once. All of it, score-book results included, is deleted with the gathering: 90 days after it ends, or 30 days after the host cancels it.

Purchases and subscription

If you buy something or subscribe to “Sahraa Plus” in the app, Google Play handles the payment; your card number and payment details never reach us. Our server checks the purchase with Google before it becomes yours.

• What we keep with your account: the purchase identifier Google gives, the order number, the product, when you bought it, and for the subscription its state (active, payment problem, cancelled, ended), the plan, until when it is paid and whether it renews.
• Why: to give you what you bought on any phone with your account, and to stop what was refunded (GDPR article 6(1)(b)).
• How long: until you delete your account, and they are deleted with it. Google keeps its own payment records under its own policy.
• Google Play processes the payment as its own controller (not on our behalf), under its own policy. We get only what is listed above.
• With each purchase we pass Google a scrambled tag of your account (not your email or name) so we know which account it belongs to, and Google sends us notifications when a subscription changes (renewed, cancelled, refunded), which we then check with it.
• Deleting your account does not cancel “Sahraa Plus”: cancel it first under “Manage subscription” in Google Play.

Why we’re allowed to

We use your data to provide the service you ask for — an invitation, a reply, an account, a game (GDPR article 6(1)(b)). Preventing abuse and keeping Sahraa secure rests on our legitimate interest in a service that works (article 6(1)(f)). We don’t use your data for anything else.

What we don’t do

• No advertising and no advertising networks
• No analytics or tracking tools
• No selling or sharing your data for marketing
• No access to your contacts, camera or background location

In the app

• Location: only when you tap “My current location” while choosing a place, and only while you do. It is saved only if you confirm the place.
• Notifications: only if you turn them on — the app itself tells you when a game starts while it is open. There is no push service.
• The app keeps your profile, host links, game history and unfinished games on your phone, encrypted where the system allows.

Cookies and storage on the website

Only what the site needs to work: sahraa_session keeps you signed in (30 days), sahraa_device recognises your reply (1 year), and NEXT_LOCALE remembers your language until you close the browser. The site also keeps your name, host links and games in your browser’s storage. There are no advertising or analytics cookies.

Who helps us run Sahraa

• Vercel — hosting; our servers run in Frankfurt (Vercel is a US company)
• Neon — database, in Frankfurt
• Cloudflare — our domain, and forwarding email sent to hello@sahraa.app
• PDOK, the Dutch government’s address service — receives only the address you type, from our server, not from your device
• Photon by komoot (Germany), the OpenStreetMap-based address search for the rest of the world — receives only the address you type and the app’s language, from our server, not from your device
• Google Play — if you install the Android app from there (for payments see “Purchases and subscription”)

They process data only on our instructions. Where a provider is outside the EU, the transfer is covered by the European Commission’s standard contractual clauses in its data processing agreement.

How long we keep it

• A gathering and everything in it — replies, bring list, photos, games, the online room, and attendance counted for XP: deleted 90 days after it ends, or 30 days after the host cancels it
• Game tables that are not part of a gathering: deleted 30 days after they close
• Your account: until you delete it, in the app or at sahraa.app/account/delete
• Your XP record: until you delete your account, and deleted with it
• Sign-ins: deleted when they expire after 30 days, or when you log out
• Abuse-prevention records: up to a day

Your rights

You can ask for a copy of your data, and ask us to correct, delete or restrict it, object to its use, or send it to you in a portable form. Email hello@sahraa.app; we answer within a month. You can delete your account yourself at any time. If you think we handle your data wrongly, you can complain to the Dutch data protection authority (Autoriteit Persoonsgegevens) or the one where you live.

Children

Sahraa is for people aged 16 and over. A host can say how many children are coming to a gathering; we don’t ask for their names.

Changes

If we change how we handle data, we update this page and the date at the top.