Privacy Policy

chacha is a place to discover things to buy from Egyptian brands and the people who wear them. To do that we hold your account details, what you post and save, who you follow, and the messages you send.

We never see your card details. When you buy something, checkout happens on the brand's own Shopify store. Your payment goes to them directly and no card number ever reaches chacha.

Direct messages are end-to-end encrypted. Since 18 September 2026, direct messages are encrypted on your phone with keys that only your phone holds, and our servers store and deliver only the encrypted form: we cannot read them, and neither can anyone who obtains our data. There is no copy of your keys anywhere else, so a message history lives on the phone that received it and cannot be recovered for you if that phone is lost. Direct messages sent before that date, and group conversations, are stored as sent and can be seen only by the people in the conversation; we do not read or analyse them.

No ads, no tracking, no location. We do not sell personal data, do not build advertising profiles, do not track you across other apps or websites, and do not collect your location.

Your account. An email address or phone number, a username, a display name, and a password. Passwords are stored hashed — we never hold the original. Optionally a profile photo and bio. If you sign in with Apple or Google, we receive the name and email address they share with us (for Apple, that may be a relay address) and an identifier for your account with them — never your password there.

What you create. Posts and the photos or videos in them, captions, the products you tag, comments, likes, mood boards and the items saved to them, who you follow, and follow requests. The camera and photo library are used only when you choose a photo for a post or your profile; we do not scan your library.

Messages. Direct messages and group conversations, including posts you share into them, together with the metadata needed to deliver them — who is in a conversation and when a message was sent. Direct messages are stored as ciphertext we cannot read; group conversations and direct messages from before 18 September 2026 are stored as sent. When you delete a message, its content is erased from our systems, not just hidden.

Shopping. What is in your cart, the orders placed through chacha, and — where a creator is credited for a sale — which post led to it, so their commission can be calculated.

How you use the app. We record a small set of events: tapping a product tag, opening a product, saving to a board, sharing a product or a brand and which app you shared it to, and opening or closing a brand's checkout. This tells us and the brand whether people are finding things worth buying, and whether the checkout is working. It is not sold and not used to build an advertising profile. Your recent searches are kept on your device only.

Technical. A device token so we can send you notifications, your language setting, and crash reports when the app fails — which include what the app was doing at the time and the account it happened on, so we can fix it. Our servers keep ordinary request logs.

To run your account and show you a feed. To deliver messages and notifications. To put items in a cart and hand you to the right brand to check out. To credit creators for sales they drove, and to show brands how their products perform. To find and fix faults. We do not sell personal data, and we do not use it to target advertising.

Brands you buy from. When you check out, you are on that brand's Shopify store and are their customer for that order. What you give them — name, address, payment — is held under their privacy policy, not this one. Brands see their own sales and how their products are tagged, saved and shared; they do not see your messages or your private boards.

Shopify. Powers the brand storefronts and checkout.

Google Firebase. Delivers push notifications and receives crash reports.

Apple and Google sign-in. If you use them, Apple or Google know that you signed in to chacha.

Amazon Web Services. Hosts the service, stores uploaded photos and videos, and sends our emails.

Creators, in aggregate. A creator sees how their posts performed and what they earned. They do not see who bought.

We also disclose information where the law requires it.

chacha runs on Amazon Web Services in data centres outside Egypt: the live service in Frankfurt, Germany, and the test version our beta testers use in the United States. Your data therefore leaves Egypt to be processed, and it is protected there by the same safeguards described here. It is encrypted in transit and at rest. Database backups are kept for 7 days.

Your account and content. For as long as the account exists. See Delete your account below for what happens after.

Creator attribution. The link between a post and an item in your cart expires 30 days after you add the item, and is removed once an order is placed.

Crash reports. Kept by Firebase for 90 days.

Server logs. 30 days.

Device tokens. Until you sign out on that device or delete your account.

Orders and commissions. The fact that an order happened, and any commission paid on it, for as long as tax and accounting law requires.

Deletion records. When an account is deleted we keep a record of the email address, phone number and username it used and when it was deleted, so the deletion can be shown to have happened and the same details can be used for a new account.

Your username, display name, profile photo, posts, and public mood boards are visible to anyone using chacha. Private boards are visible only to you and anyone you invite to collaborate. Your email address and phone number are never shown to other users.

Delete your account. Settings → Delete Account, in the app. Your account is deactivated at once: your email address, phone number and username are released, your profile is anonymised, your devices stop receiving notifications, and your Apple or Google sign-in link is removed. Within a few minutes your posts, photos, comments, likes, saves, boards, follows, the content of the messages you sent, your cart and wishlist, and your notification history are removed from our systems as well. Records we are required to keep for tax or accounting — the fact that an order happened, and any commission paid on it — are retained.

Notifications. Turn categories off in Settings, or turn them off entirely in your phone's settings.

Access, correction and objection. Write to us and we will tell you what we hold, correct it, or delete it. Egypt's Personal Data Protection Law (Law 151 of 2020) gives you these rights.

chacha is not for people under 18. We do not knowingly collect data from anyone under 18, and will delete the account if we learn we have.

A brand connects its Shopify store through the chacha app. From the store the app reads the products the brand publishes to chacha, their stock, the store's name, currency and time zone, and the orders and fulfilments of sales made through chacha. It does not request the store's customers' names, email addresses, phone numbers or addresses. We use this only to show the brand's products, complete chacha sales, bill the brand and report its results to it.

We keep the brand's copy of its catalogue while the app is installed. When the brand uninstalls, Shopify asks us 48 hours later to erase the store's data, and we delete its contact details, access tokens and catalogue copy; the record of each chacha sale and its billing is kept as long as tax and accounting law requires. Records of individual webhook deliveries are deleted after 30 days. The Merchant Terms set out the rest.

If this policy changes in a way that matters, we will tell you in the app before it takes effect rather than quietly updating the date at the top.

Questions, or a request about your data: privacy@chacha-eg.com.