Privacy Policy

1. Who we are

SWODE Studio is the mobile apps division of NAPCo Group Pvt Ltd, a company registered in the Republic of Maldives (registration number C21812025), registered address G. Aakashvilla, Hadheebeemagu, K. Malé, 20098, Maldives. In this policy, "SWODE Studio", "we", "us" and "our" mean NAPCo Group Pvt Ltd acting through SWODE Studio. We are the party responsible (the "controller") for the personal information described here.

2. What this policy covers

This policy covers our website at swode.studio and the SWODE Studio apps we publish on the Apple App Store and Google Play: Torchless, Lost & Found QR, Keep the Change, Loose Change and Hidayath. Each new app we release is added here before anyone can download it, and section 8 sets out what each one handles.

Apple and Google handle downloads, payments and store reviews under their own privacy policies. We don't receive your store account details. If you choose Sign in with Apple or Sign in with Google in one of our apps, we receive only what you agree to share (see section 4).

3. The website

• No accounts, no forms, no analytics cookies. The site does not ask for your name, email or phone number.
• Server logs. Like every website, our hosting provider automatically records technical information when you visit: your IP address, browser type, the page requested and the time. We use this only to keep the site running and secure.
• Fonts and libraries. The typeface and the animation library are served from our own site, so your browser doesn't contact any third-party font or script service when you visit.
• Your browser's local storage. The site remembers which islands you've already seen open and which launch reminders you've added, so it doesn't repeat itself. This stays in your browser and never reaches us. Clearing your browser data removes it.
• Your device's clock. The 3D islands follow the time of day on your device. The time is read in your browser and is not sent to us.
• Calendar reminders. When you tap a reminder button, your device creates a calendar file on the spot. Nothing is sent to us, and we never learn that you added it.
• Email. If you email us, we receive your email address and whatever you write, and use it only to reply.

4. Accounts

Some of our apps ask you to create an account or sign in; section 8 shows which. When they do, we collect:

• Your email address, and a name if you choose to add one.
• Your password, which we never see or store in readable form. It is stored only as a secure, one-way hash by our sign-in provider.
• If you use Sign in with Apple or Sign in with Google, the name and email address that Apple or Google share with your permission. With Apple you can choose Hide My Email, and we will only ever see a private relay address.
• Basic account records, such as when the account was created, when you last signed in, and the device type, to keep your account secure.

We use this to sign you in, keep your data safe and in sync across your devices, and send you emails about your account, such as sign-in codes, password resets and security notices. We only send marketing emails if you ask for them, and every one has an unsubscribe link.

5. What you store with us

In apps with an account, what you save (for example notes, files, photos and documents) is stored in our cloud database so it is backed up and available on your devices.

• It is encrypted in transit (TLS) and encrypted at rest.
• Only you can see it in the app. Our team can access it only when it is needed to keep the service running, to help you when you ask us to, or when the law requires it, and that access is limited and logged.
• We do not use what you store to show you ads, we do not sell it, and we do not use it to train artificial intelligence models.
• In apps without an account, what you save stays on your device. Deleting the app deletes it, and we can't recover it, because we never had it.

6. Medical and sensitive information

Some of our apps let you store medical documents or other sensitive information, such as lab results, prescriptions and scans. We treat this information with extra care:

• Your explicit consent first. The app asks for your consent before you store sensitive information for the first time. You can withdraw it at any time by deleting that information or your account.
• Used only to store it and show it back to you. We process it only so you can keep, view, organise and share it when you choose to.
• Never for advertising. It is never used to choose or measure ads, never shared with advertising or measurement partners, never sold and never used to build a profile of you.
• Shared only by you. If you share a document from the app, you decide who receives it.

Our apps help you keep your documents organised. They are not a medical device, an official medical record or a substitute for your healthcare provider's own records.

7. Location

Some apps ask for your location, only for a feature that needs it, and only after you allow it. Your phone always lets you choose precise or approximate location, or none, and you can change this in Settings at any time.

• On your device where possible. When an app can work out what it needs on your phone (for example prayer times in Hidayath), your location stays on your phone.
• Sent to us only when the feature needs it, for example attached to a report you choose to send, and the app tells you when that is the case. We keep it only as long as that feature needs it.
• Never sold, and never shared with ad partners as precise location. Ad partners may infer an approximate area, roughly your city, from your IP address, as described in section 9.

8. What each app handles

Every app asks only for the permissions it needs to do its job, and both iOS and Android let you turn any permission off in Settings. Sections 4 to 6 apply only to apps that offer an account.

9. Advertising and measurement

Torchless, Lost & Found QR, Keep the Change and Loose Change are free and supported by ads. Hidayath has no ads and no tracking at all. Our ads come through Google AdMob and other ad networks that compete to fill each ad space. To show, limit and measure ads and to prevent fraud, these partners may collect your device's advertising identifier (IDFA on iPhone, Advertising ID on Android), IP address, approximate location derived from your IP, device and app information, and how you interact with ads. Each partner uses this under its own privacy policy.

When we advertise our own apps (for example on Google Ads), we use measurement tools to learn which ads led to an install or to a first use of the app. These tools receive device identifiers and app events such as "installed" or "opened", never the content you store or any sensitive information.

Your choices:

• On iPhone, the app asks for your permission before your advertising identifier is used to track you across other companies' apps and websites (App Tracking Transparency). If you say no, ads are not personalised with it. You can change this in Settings › Privacy & Security › Tracking.
• On Android, you can reset or delete your Advertising ID in Settings › Privacy › Ads.
• In the European Economic Area, the United Kingdom and Switzerland, the app asks for your consent before showing personalised ads, using a consent tool certified by Google, and you can change your choice later in the app's privacy settings.
• In the United States, some state laws describe sharing advertising identifiers with ad partners as a "sale" or "sharing" of personal information. You can opt out in the app's privacy settings or by emailing us, and we will stop it for your device.

We never sell your personal information for money, and we never share the content you store or any sensitive information with advertising or measurement partners.

10. Why we use data (legal bases)

• To provide the app or site you asked for, for example running your account, storing your documents and fetching exchange rates (performance of our agreement with you).
• To store medical and other sensitive information, and to use precise location (your explicit consent, which you can withdraw).
• To show personalised ads and measure our own ads, where the law requires your consent (consent, which you can withdraw).
• To keep things secure and working, for example account security, server logs and fraud prevention (our legitimate interests).
• To meet legal obligations when the law requires us to keep or disclose information.

11. Who we share it with

We share the minimum needed, with:

• Our cloud hosting, database and sign-in providers, who store and process data only on our instructions and under contracts that require them to protect it.
• Apple and Google, to distribute the apps, and when you choose to sign in with them.
• Advertising and measurement partners, as described in section 9. Never your stored content or sensitive information.
• Our exchange-rate provider, when Loose Change fetches rates.
• Our email provider, to send account emails.
• Authorities, only when Maldivian or other applicable law requires it.
• A future owner, if SWODE Studio or an app becomes part of another company, in which case this policy continues to protect your information and we will tell you before anything changes.

12. International transfers

Our service providers may process information outside the Maldives and outside your own country, including in the United States and the European Union. Where the law requires it, these transfers are covered by appropriate safeguards such as standard contractual clauses.

13. How long we keep it

• Your account and what you store are kept while your account is active. When you delete something, it is removed from our live systems straight away.
• When you delete your account, everything in it is erased from our live systems within 30 days and from our backups within 90 days.
• Information inside apps without an account stays on your device until you delete it or remove the app.
• Website server logs are kept for a short period, normally no longer than 30 days, unless needed to investigate a security problem.
• Emails you send us are kept for as long as needed to help you, and up to two years after our last exchange.
• Advertising and measurement data is kept by each partner under its own retention policy.
• We keep anything longer only where the law requires it, and only for that purpose.

14. Deleting your account

You can delete your account and everything stored in it at any time:

• In the app: Settings › Account › Delete account.
• Without the app: email support@swode.studio from the address on your account, with the subject "Delete my account" and the app's name. We confirm within 7 days.

Deleting an account cannot be undone, so download anything you want to keep first. Deleting the app from your phone does not delete your account.

15. Your choices and rights

Depending on where you live, you may have the right to ask what personal information we hold about you, to get a copy of it, to correct it, to delete it, to object to or restrict how we use it, to withdraw consent, and to opt out of the "sale" or "sharing" of personal information or the use of sensitive information. Most of these you can do yourself in the app: view, download, edit or delete what you have stored, change your ad choices, or delete your account. For anything else, email us and we will respond within 30 days, or sooner where the law requires. We will never treat you differently for using these rights. If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your local data protection authority.

16. Children

Our apps are made for a general audience and are not directed at children under 13. Apps that offer accounts are for people aged 16 and over, or older where local law requires. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

17. Security

We protect your information with encryption in transit and at rest, strict limits on who on our team can access data, multi-factor sign-in for our own systems, and monitoring for misuse. If a breach affects your personal information, we will tell you and the relevant authorities as the law requires. No system is perfectly secure, so please use a strong, unique password and keep your own copies of important originals.

18. Changes to this policy

When we launch a new app, its section is added here on its launch day. If we change how we handle information in a way that matters, we update the date at the top and, where the change is significant, tell you in the app or on the website before it takes effect. We will ask for your consent again where the law requires it.

19. Contact