1. Who We Are

The KASH mobile application is owned and operated by

KASH (FZC)
A Free Zone Company registered in the Sharjah Research Technology and Innovation Park Free Zone, Sharjah, United Arab Emirates
Address: Block C, VL10 131, SRTIP, Sharjah, United Arab Emirates
Email: Info@kash-app.com
Website: www.kash-app.com

KASH (FZC) is the controller responsible for the personal information described in this Privacy Policy.

2. Scope and Applicable Standards

2.1 This Privacy Policy explains how KASH collects, uses, stores, shares, protects, and deletes personal information when a person creates an account, uses the App, enters a competition, purchases a virtual item, contacts support, or receives a prize.

2.2 KASH is established in the United Arab Emirates and currently offers the App to players in Egypt. KASH processes personal information under the UAE Federal Decree Law Number 45 of 2021 concerning the Protection of Personal Data and other mandatory privacy laws that apply to the relevant processing and player location, including the Egyptian Personal Data Protection Law Number 151 of 2020 where applicable.

2.3 A Privacy Policy is a notice. Where consent is legally required, KASH will request consent separately from acceptance of the Terms.

3. Information KASH Collects

3.1 Account and Identity Information

KASH may collect:

1. Full name.
2. Chosen display name or username.
3. Public player code or internal account identifier.
4. Date of birth.
5. Email address.
6. Phone number.
7. Authentication credentials or identifiers associated with email registration, Google Sign In, Sign in with Apple, or another login provider.
8. Optional profile image.

3.2 Guardian Information

Where a player is aged 13 through 15, KASH may collect information needed to record or verify parent or legal guardian consent, including the guardian full name, email address, mobile number, relationship to the player, confirmation records, and payment information where a prize is paid to the guardian. KASH may contact the guardian by telephone or electronic communication to confirm consent.

KASH does not routinely request a guardian identification document. KASH may request reasonable additional proof only where necessary to address fraud, identity concerns, guardian authority, a dispute, or a legal requirement.

3.3 Gameplay and Competition Information

KASH may collect:

1. Quizzes entered.
2. Questions shown and answers submitted.
3. Correct and incorrect answers.
4. Points, rankings, and competition results.
5. Hint and life balances and usage.
6. Question timing and session timing required to operate the quiz timer and investigate technical issues, even though response speed does not add leaderboard points.
7. Fair play, security, and fraud indicators.

3.4 Public Competition Information

KASH may publicly display:

1. First and last name.
2. Optional profile image uploaded by the player.
3. Rank.
4. Leaderboard points.
5. Cash prize amount.

KASH does not publicly display email addresses, phone numbers, dates of birth, payment details, guardian contact information, or identification documents.

Public names and profile images may be reviewed through automated or manual moderation. KASH may collect and retain reports concerning inappropriate profile content, the reported account or content identifier, the reporting account identifier, the reason for the report, supporting information, and the action taken.

3.5 Purchase Information

When a player purchases a hint, life, or other virtual item, KASH may receive:

1. Item purchased.
2. Purchase date and status.
3. App store transaction identifier.
4. Country, currency, or limited purchase information supplied by the app store.

Payments are processed by Google Play or the Apple App Store. KASH does not receive or store the payment card number used for an app store purchase.

3.6 Prize and Payment Information

When a player requests payment of a cash prize, KASH may collect:

1. Full legal name.
2. Phone number.
3. Date of birth.
4. Mobile wallet number.
5. Bank name, account holder name, account number, or IBAN.
6. Payment request, approval, and transfer records.
7. Guardian payment information where applicable.

3.7 Conditional Identity Verification

KASH does not routinely request a national identification document from every player.

KASH may request an identification document where reasonably necessary to verify identity, age, guardian authority, payment ownership, suspicious activity, fraud, or legal compliance.

KASH does not currently use selfie or facial recognition verification unless a future process is introduced with an updated notice and any required consent.

3.8 Device, Technical, and Usage Information

KASH and its service providers may collect:

1. Device model and operating system.
2. App version and language.
3. Internet Protocol address.
4. Approximate location derived from the Internet Protocol address. KASH does not currently request precise GPS location for ordinary gameplay.
5. Device, installation, application, and push notification identifiers where available and permitted.
6. Session, navigation, feature, quiz, and product interaction information.
7. KASH managed advertising information, including campaign and advertisement identifiers, views, clicks, unique viewer measurement, placement, date and time, approximate region, device type, and an internal account or user identifier.
8. Security, performance, diagnostic, and technical logs where available.
9. Push notification token and delivery information where notifications are enabled.

3.9 Support and Communications

KASH collects information included in support requests, complaints, profile content reports, advertisement reports, reviews, emails, and other communications with KASH.

4. How KASH Uses Personal Information

KASH does not sell personal information.

5. Advertising and Tracking Choices

5.1 KASH may display advertisements and sponsored content selected and delivered directly through KASH systems, including before, during, or between quiz questions. KASH does not currently use a third party advertising SDK to deliver these advertisements.

5.2 To measure campaign performance, KASH may record the campaign or advertisement shown, views, clicks, unique viewers, date and time, placement, approximate region, device type, and an internal account or user identifier. Advertising interaction data may therefore be linked internally to a KASH account.

5.3 KASH uses this information to calculate reach, unique viewers, engagement, regional distribution, placement performance, and other campaign statistics.

5.4 Reports provided to advertisers are aggregated or anonymized. KASH does not provide advertisers with player names, email addresses, phone numbers, dates of birth, account credentials, payout details, guardian information, identification documents, exact location, or player level lists of who viewed or clicked an advertisement.

5.5 KASH does not sell personal information to advertisers or data brokers and does not share player level identifiers with advertisers for their independent advertising purposes.

5.6 KASH does not currently use IDFA or track players across applications, websites, or services operated by other companies for this advertising model. Campaign selection may use non sensitive contextual factors such as App placement or broad approximate region.

5.7 If KASH introduces third party advertising technology, cross application tracking, or another materially different advertising practice, KASH will update this Policy and obtain any consent or device permission required before the relevant processing begins.

5.8 KASH does not currently award hints or lives for watching advertisements.

5.9 Players may report an advertisement they consider inappropriate, misleading, or unsuitable for the App age rating through the reporting feature available in the App or by contacting Info@kash-app.com. KASH may review and remove the advertisement or take other reasonable action.

6. How KASH Shares Information

KASH may share personal information only where reasonably necessary with the following categories of recipient:

1. Cloud hosting, database, storage, infrastructure, and security providers.
2. Real time communication providers, currently including Pusher, to deliver quiz, tournament, and live event information. Current Pusher event data includes quiz identifiers, timing, descriptions, questions, answer options, correct answers, and aggregate participant or viewer counts. KASH does not intentionally send Pusher player names, email addresses, phone numbers, dates of birth, payout details, guardian information, or identification documents.
3. Push notification providers, currently including Firebase Cloud Messaging, which may process notification tokens and delivery information.
4. Authentication providers, currently including Firebase Authentication, Google Sign In, and Sign in with Apple where the relevant login method is used.
5. The Apple App Store and Google Play, where applicable, for purchases, refunds, account services, and platform compliance.
6. Banks, mobile wallet providers, and other payment providers used to send an approved cash prize.
7. Email, notification, communications, and customer support providers.
8. Professional advisers, auditors, insurers, investors, and corporate transaction parties under appropriate confidentiality obligations.
9. Courts, regulators, law enforcement, and public authorities where disclosure is required or legally permitted.
10. A successor entity in connection with a merger, restructuring, financing, sale, or transfer of the App, subject to applicable law.

KASH requires service providers to handle information only for authorized purposes and under appropriate confidentiality, security, and data protection obligations where applicable.

7. International Storage and Transfers

7.1 KASH primarily hosts its production systems using cloud infrastructure located in the United Arab Emirates.

7.2 KASH and its providers may maintain limited operational logs or recovery copies for security, continuity, and restoration, subject to applicable access and retention controls.

7.3 Because KASH players are currently located in Egypt, personal information is transferred from Egypt to systems hosted in the United Arab Emirates. Certain third party services, including Firebase services, Pusher, authentication providers, app stores, purchase processors, notification providers, and payment services, may process limited information in other countries where those providers operate.

7.4 KASH applies measures required under applicable law for international processing and transfers. Depending on the legal requirement and processing activity, these measures may include contractual protections, access restrictions, encryption, security reviews, transfer records, consent, regulatory approvals, or another recognized safeguard.

7.5 Service providers may process limited information from other countries where their support, security, or infrastructure personnel operate. KASH requires appropriate protection for such access.

8. Retention

KASH retains personal information only for as long as reasonably necessary for the purpose described in this Policy, including the following periods:

1. Account information remains while the account is active.
2. After a valid account deletion request is processed, personal information that is no longer required is deleted or anonymized within a reasonable period, subject to applicable law, verification, prize payment, accounting, disputes, security, fraud prevention, enforcement of the one account rule, and technical system cycles.
3. Information retained in system logs, provider managed recovery systems, or technical records is removed, anonymized, or made inaccessible through the applicable deletion and rotation processes and is not used for ordinary account activity after a valid deletion request, except where retention is permitted or required for the purposes described in this Policy.
4. Prize, purchase, payment, accounting, and transaction records may be retained for 5 years from the relevant transaction, or longer where required for an active dispute, investigation, legal hold, tax, or accounting obligation.
5. An identification document collected for verification is deleted within 90 days after verification is completed unless a longer period is required for an active fraud investigation, dispute, or legal obligation. KASH may retain a limited record that verification was completed.
6. Support communications may be retained for up to 24 months after closure, or longer where required for an active dispute or legal obligation.
7. Security, duplicate account, suspension, ban, and fraud records, including limited identifiers reasonably needed to prevent repeat registration or access, may be retained for a reasonable period required to protect KASH, players, payments, and competitions, subject to applicable law.
8. An inactive account may be closed after 24 months of inactivity and reasonable notice where practical.

9. Security

9.1 KASH applies reasonable technical and organizational measures appropriate to the nature of the information and the risks of the processing.

9.2 KASH currently uses secure API connections to protect information in transit. Other measures may include access controls, secure credentials, logging, restricted access to payment and identification information, secure software development practices, monitoring, and incident response procedures. KASH reviews and may strengthen its security measures as its systems develop.

9.3 Access to personal information is limited to authorized personnel and service providers with a business need.

9.4 No internet or storage system is completely secure. If a personal information breach requires notification under applicable law, KASH will notify the relevant authority and affected individuals as required.

10. Player Rights

Subject to applicable law, a player may have the right to:

1. Request access to personal information.
2. Request correction of inaccurate or incomplete information.
3. Request deletion of information.
4. Request restriction of certain processing.
5. Object to certain processing.
6. Withdraw consent where processing is based on consent.
7. Request a portable copy of information where applicable and technically feasible.
8. Request review of a decision based solely on automated processing where applicable.
9. Submit a complaint to a competent privacy or consumer authority.

To submit a request, contact Info@kash-app.com. KASH may require reasonable identity verification before responding.

11. Account and Data Deletion

11.1 A player may initiate account deletion inside the App through Settings, Account, Delete Account.

11.2 KASH may verify the request before deleting the account to prevent unauthorized deletion.

11.3 The normal minimum withdrawal is 100 EGP. A player requesting account closure may request a final payment of any verified cash prize balance even where the amount is below 100 EGP, subject to identity and payment verification.

11.4 Following deletion, KASH deletes or anonymizes information that is no longer required. KASH may retain limited information for payment, accounting, fraud prevention, security, dispute, legal, and regulatory purposes as described in Section 8.

11.5 If the account uses Sign in with Apple or another external login provider, KASH will take the account side steps required for deletion. The player may also need to manage permissions through the external provider settings.

12. Younger Players

12.1 KASH is intended for players aged 13 or older.

12.2 KASH does not knowingly permit an account for a person under 13. If KASH learns that an account belongs to a person under 13, KASH will take reasonable steps to close the account and delete information that is not required by law.

12.3 A player aged 13 through 15 may use KASH only with the prior consent of a parent or legal guardian.

12.4 To record or verify that consent, KASH may request the guardian full name, email address, and mobile number and may contact the guardian by telephone or electronic communication. The guardian will also be informed that the player first and last name, leaderboard points, cash prize amount, and optional profile image may be displayed publicly.

12.5 A cash prize for a winner under 16 is paid through a verified parent or legal guardian.

12.6 A winner aged 16 or 17 may receive a prize through a verified account held in the winner name where legally and operationally permitted, or through a verified parent or legal guardian.

12.7 KASH aims to collect only information reasonably necessary to provide the App, administer competitions, protect players, and process prizes. KASH does not routinely request a guardian identification document.

12.8 Personalized advertising and tracking for younger players will be restricted where required by applicable law, device rules, or app store policies.

13. Automated Fraud and Security Review

13.1 KASH enforces a one person, one account rule. KASH may use account, device, installation, authentication, gameplay, contact, identity, payment, and other relevant indicators, together with rules or automated tools, to identify possible duplicate accounts, cheating, fraud, or security threats. A person may not avoid this rule by using different email addresses, phone numbers, devices, payment details, identities, or sign in methods.

13.2 A duplicate account or security flag may result in temporary access restrictions, a score or payment hold, or a request for verification. Where a violation is reasonably confirmed, KASH may link, restrict, suspend, or close affected accounts, block future registration or access using relevant identifiers, and support the disqualification, prize, recovery, or permanent ban actions described in the Terms and Game Rules. A reasonable human review will be available before a final disqualification or permanent prize cancellation where appropriate.

14. Third Party Services and Links

The App may integrate with or link to third party services. Those services may process information under their own privacy notices. KASH is responsible for selecting and managing its service providers as required by applicable law, but is not responsible for an independent third party service that a player chooses to access outside the App.

15. Changes to This Privacy Policy

15.1 KASH may update this Privacy Policy to reflect changes in law, platform rules, vendors, security, technology, business operations, or App features.

15.2 If a change is material, KASH will provide notice through the App, email, or another reasonable method before the change takes effect where required.

15.3 Consent for a new optional purpose will be requested separately where required.

16. Contact

For privacy questions or requests:
KASH (FZC) Data Protection Contact
Email: Info@kash-app.com
Website: www.kash-app.com
Address: Block C, VL10 131, Sharjah Research Technology and Innovation Park Free Zone, Sharjah, United Arab Emirates