عJoin free

Privacy notice

What data Tiswa uses, why, who helps us process it, how long we keep it, and how to exercise your rights.

Last updated: 28 October 2026

Who we are

Establishment ALF CHEAR For Trading (commercial registration 4030600062, Jeddah 23623, Saudi Arabia) runs Tiswa and is responsible for your personal data as its controller. This notice explains what data Tiswa uses in the Tiswa iPhone app, on tiswa.app and support.tiswa.app, and in Tiswa emails, why we use it, who helps us, how long we keep it, and your rights under Saudi Arabia’s Personal Data Protection Law (PDPL). For any privacy question, write to partners@tiswa.app.

Some features and the details below may change. We will update this page when they do.

Delete your account

  • You can delete your account at any time in the app: open Profile and tap Delete my account. Your account closes straight away and every device is signed out.
  • We then erase the personal data linked to your account within 30 days: your profile, verification details, saved offers, history, friends, invites, plans, taste answers, search history and usage data.
  • What remains: totals that no longer identify you (for example, how many times an offer was used, which businesses already saw as counts), crash and performance reports that were never linked to you, records we must keep by law (for example, commission and accounting records), and a record that the deletion happened.
  • If you cannot open the app, send a deletion request to partners@tiswa.app or through the support form from the email linked to your account.

What we collect, at a glance

This list matches the App Privacy section of Tiswa’s App Store page. Each item is explained further below.

  • Contact details: the name you give us and your university or work email.
  • Identifiers: your Tiswa account ID, a random install ID the app creates, the record of the one phone linked to your account, and an App Attest key.
  • Rough location: an area of about 5 km, or the ID of your campus. Never your exact location.
  • Photos and documents you send to verify, and support reports you send from the app.
  • Purchase history: the Tiswa offers you use and, only if you allow tracking, purchases that affiliate networks report back to us.
  • Search history in the app.
  • Usage data: screens you open, taps and time in the app (our own analytics).
  • Diagnostics: crash and performance reports, not linked to you.
  • Other data: your taste answers (major, study year, things you like) and, if you join Tiswa Nights, whether you join women’s or men’s sessions.
  • Only your account ID and purchase history are used for tracking, and only if you allow it (see “Tracking and affiliate offers”).

Your account

  • To create an account, we use your university email address, the university it belongs to, your verification status, and when you verified. We never ask for your university password or read your mailbox.
  • Sign-in codes expire after 10 minutes. If you use a passkey, it stays on your device; we keep only the public part needed to check it.
  • Your account has an account ID, a member number, the name you give us, and whether you join women’s or men’s Tiswa Nights sessions. Your name appears on your member card.
  • Confirming a university email shows that you control the mailbox. It does not by itself prove enrolment.

Student checks and ID scans

  • Student ID scan: if you choose it, the app uses your iPhone camera to read both sides of your student card on your phone. The photos stay on your phone. Only the results of the checks (for example, that the name matches your account, the university was found and the card has not expired) and a one-way fingerprint of your student number are sent to Tiswa.
  • Document upload: if we ask you to prove enrolment, you can upload one document such as a student card or enrolment letter (PDF or photo, up to 10 MB). The app may read it on your phone first and send only yes or no checks to help staff. Only authorised Tiswa staff review the file. It is deleted 30 days after you submit it, or after 2 days if you start an upload and never submit it. We keep the review result.

Staff and faculty

  • If you are a university staff member or professor, you confirm your work email the same way students do and choose your role (staff or faculty). We keep that role and show it on your profile and member card.
  • If you don’t have a work email, you can instead sign in with a personal email and send one document that shows you work at the university: a staff ID card, an employment letter or a payslip (photo or PDF, up to 10 MB), with your university, your role and, if you like, your job title. You can cover salary figures and ID numbers. Only authorised Tiswa staff review it. The document is stored privately and deleted once staff approve or reject it; we keep the decision, university, role and job title while the account exists.

Age: 18 and over

Tiswa is for people aged 18 and over. Sign-up for high school students under 18 is closed, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has a Tiswa account, write to partners@tiswa.app and we will close it and delete its data.

High school students aged 18 and over can join with their school ID instead of a university email. They send their school name, city, grade, date of birth and one photo of their school ID. Only authorised Tiswa staff review it. The photo is stored privately and deleted once staff approve or reject the application; we keep the decision, the school name, city, grade and date of birth while the account exists.

Your phone

Each account works on one phone at a time. To enforce this, we store an identifier Tiswa creates for your phone, the phone’s name and model, and when it was linked. The app also creates a random install ID for our own analytics; it changes if you reinstall the app. On supported iPhones, Apple’s App Attest confirms that requests come from the real Tiswa app on that phone; it does not share your personal data with us. Tiswa does not use Apple’s advertising identifier (IDFA).

Using offers

When you save or redeem an offer, we record which offer, where, and when. This lets us check that an offer is used once and within its rules, and lets businesses see how many students used their offer. The business whose offer you use sees your name and that the redemption is valid; it does not get your university email.

Tiswa also stores your answers to the question of the day, invites you send or accept, and your notification choices.

Friends, group deals and plans

Friends are optional. You become friends with another student only when one of you accepts the other’s invite link, or after you use a group deal together, and you can remove a friend at any time. Friends see your first name only.

If you share where you are heading tonight, we store the place, the offer if you pick one, when the post ends (3am at the latest) and who joins. Only your friends see it. We never collect or share your live location, and a setting in the app hides all of your activity from friends.

For group deals we store who started the group, who joined, each member’s confirmation and the group’s code. Members of a group see each other’s first names. The business sees only how many students are in the group. For group gifts we also store who receives the gift, the share each friend agreed to and the bill amount entered. Tiswa does not take payments; friends settle up between themselves. The person receiving a gift does not see who paid.

Weekend plans you save are stored with your account. Anyone you send a plan link to can see the places in that plan. The campus league shows each university’s total deals used and number of verified students, never individual students. Your yearly recap is built from your own offer history and only you see it unless you share it. When you share an offer, the link includes your invite code so the friend who opens it can join through your invite.

Location, maps and voice search

  • Location is optional. If you allow it, the app works out on your phone which offers are near you and whether you are on your campus.
  • To fill Discover and Home with places near you, the app sends Tiswa only a rough area of about 5 km (a five-character geohash) or the ID of your campus, never your exact location. Campus passes are checked on your phone and send only the campus the phone confirmed. We use the rough area to choose and order offers for that area, and store it with your usage data.
  • “Deals near me” alerts are checked on your phone using iOS location features; your position is not sent to Tiswa for them.
  • When you ask for a route, Apple Maps plans it. Where Apple has no routes, including in Saudi Arabia, Stadia Maps plans it instead and receives only your start point, rounded to about 100 metres, and the destination, with no account details.
  • Voice search uses Apple speech recognition, on your iPhone when it can. Tiswa never receives your voice.

Search, usage and the For You feed

  • Search history: we store what you search for in the app, in a normalised form (for example, without extra spaces or letter case), with your account. We use it to improve results and suggestions and to order offers for you. Popular searches that others see are totals and never show who searched.
  • Our own analytics: the app records how it is used, such as the screens you open, your taps, the offers and Home sections you see, and your time in the app. These events are stored by Tiswa with your account and install ID. We use them to fix problems, see what works and order Home for you. The app has no advertising tools.
  • Google Analytics in the app: the app also sends Google the screens you open, the offers you view and use (with the saving), and your time in the app, so we can see what works. It uses a random ID made by Google, never your name, email, Tiswa account or advertising ID, and all advertising features are off. Google keeps this data for 14 months. It is on unless you turn off Share usage analytics in Settings, which also clears Google's ID for your phone.
  • The For You feed and Home are ordered for you from your taste answers (major, study year, things you like), whether you joined women’s or men’s Nights, the offers you open, save and use, your searches, and your rough area. This runs on Tiswa’s servers, is used only inside Tiswa, and is never shared with businesses. It decides only the order of offers, nothing with legal or similarly significant effects.
  • Taste answers are optional: you can skip them or change them in the app, and you can clear items from your history in the app.

Crash and performance reports

When the app crashes, hangs or runs slowly, it sends a technical report to Sentry, which stores it in the European Union (Germany), and Apple’s MetricKit reports go to Tiswa. Reports contain the device model, iOS and app version and technical traces. They are sent without your name, email, account ID, sign-in token or screenshots and are not linked to you. We use them only to find and fix problems.

Tracking and affiliate offers

  • Some online offers are affiliate links through the networks Admitad, Awin and Impact. When you buy through one, Tiswa may earn a commission. The offer tells you before you leave the app.
  • The first time you continue to one of these offers, iOS asks whether Tiswa may track you (App Tracking Transparency).
  • If you allow it: the link also carries your Tiswa account ID, a random code that is not your name or email. The network and the brand receive it with your visit and report purchases you make on the brand’s site against it. We use those reports to confirm the offer worked, reconcile commissions and learn which offers students use. The network and the brand handle your visit and purchase under their own privacy policies.
  • If you ask Tiswa not to track, or never answer: the link carries only a random click reference that changes every time, without your account ID, email, university or verification details, and purchases cannot be tied to you.
  • You can change your choice at any time in your iPhone’s Settings, under Privacy & Security, then Tracking.

Notifications and emails

If you allow notifications, Apple gives us a push token for your phone, which we use with the topics you choose. We send emails through Resend. Every Tiswa email has a link to change your email preferences or unsubscribe. We keep a record of emails sent to you, and whether they were delivered, for 13 months.

Apple Wallet member card

If you add your member card to Apple Wallet, the card holds your member number, display name, university, and the date your student verification ends. It has no barcode and cannot redeem offers. The card expires with your verification.

Tiswa in ChatGPT and Claude

If you use the Tiswa deals app inside ChatGPT, Claude, or another AI assistant, the assistant sends Tiswa only your search words, an offer ID, and a language. It does not send your name, email, or account, and the app cannot see your conversation. We do not store your search words; we keep only a count of how often each tool is used. The app shows public offer details and never shows promo codes. The assistant provider handles your conversation under its own privacy policy.

Forms on tiswa.app

  • Students page: your university email and page language, to put you on the waitlist and send a confirmation link. An unconfirmed address is deleted after 7 days. A confirmed address is used to tell you when Tiswa launches, and is deleted after that message, when you unsubscribe, or after 12 months, whichever comes first.
  • Universities page: your name, role, university, and work email, sent to our team so we can reply.
  • Business page: your business name, your name, work email, and the category, area, and figures you chose, so our team can follow up.
  • Every form uses an hCaptcha security check and keeps a check receipt and a non-reversible identifier to stop abuse.

The business page map

The business page map uses CARTO map tiles based on OpenStreetMap. If you share your location there, the page rounds it to about 1 km and our server uses that rounded point to look up the area name and nearby roads from OpenStreetMap services. We do not log or store the point with anything about you.

Website statistics and cookies

  • tiswa.app counts visits with Cloudflare Web Analytics, which sets no cookies and does not identify you.
  • Google Analytics loads only if you choose Allow in the cookie banner. It then sets first-party cookies (named _ga) to count visits and see how the site is used: the pages you open, the campaign link that brought you, and actions such as joining the waitlist, confirming your email or tapping the App Store button. It never receives your name, email or the private part of email links. Google signals and all advertising features are off, and Google keeps this data for 14 months. We use these reports in aggregate and never for advertising. If you decline or ignore the banner, Google Analytics does not load.
  • If you allowed cookies and then join the waitlist, we keep with your sign-up the campaign tags of the link that brought you, the website you came from (only its name, such as google.com) and the first page you opened on tiswa.app. This shows us which posts and posters work. It never includes your name or contact details.
  • You can change your choice at any time with the Cookies link at the bottom of every page.
  • Necessary storage, which needs no consent: your language choice, your cookie choice, and a random identifier the support form keeps in your browser to limit abuse.
  • Ads on guide and deal-list pages: blog guides, the /deals/ browse pages and city pages show up to three labelled Google AdSense ads (longer pages only; most show one or two). They load only as you scroll near them, never on sign-up, business or partner pages, and never in the app. If you chose Allow, Google may use cookies to personalise them; otherwise Google is asked for non-personalised ads, which may still use cookies for frequency capping, fraud prevention and counting. Google acts as an independent controller for these ads under its own privacy policy (policies.google.com/technologies/ads), and you can manage ad personalisation at adssettings.google.com.

Support requests

A support request, from the website or from the app, stores your message, the email you give us for a reply, a security-check receipt, and a non-reversible identifier used to limit abuse. Reports sent from the app also include the app version and phone model. Only the Tiswa team reads them. Do not include passwords, sign-in codes, or student documents.

Why we may use your data

  • To provide Tiswa to you under our terms: your account, verification, offers, friends, plans, notifications you asked for and support.
  • With your consent, which you can withdraw at any time: tracking for affiliate offers, Google Analytics cookies, personalised ads on the website, location, notifications, the taste answers you choose to give, and the student ID scan.
  • For our legitimate interests, where they do not override your rights: keeping Tiswa secure, stopping fraud and misuse of offers, our own analytics, Google Analytics in the app, crash reports and improving the service.
  • To meet legal obligations, such as accounting records and requests from competent authorities.

Who processes data for us

These providers process personal data for Tiswa under contract, only on our instructions:

  • Supabase: database, sign-in, file storage and backend, hosted in Mumbai, India.
  • Vercel: hosting for the Tiswa admin and partner consoles, United States.
  • Hostinger: website hosting and the Tiswa mailboxes.
  • Cloudflare: network security, DNS and cookieless site statistics, global network, United States company.
  • Sentry: crash and performance reports, stored in Germany (EU).
  • Google: Google Analytics on tiswa.app, only after you allow it, and in the app unless you turn it off, United States.
  • Resend: email delivery, United States.
  • hCaptcha: security checks on forms, United States.
  • Apple: notifications, App Attest, Wallet, maps and speech recognition, United States.
  • Stadia Maps: routes, United States.
  • CARTO and OpenStreetMap: map tiles and place lookups on the business page, European Union and United Kingdom.

Affiliate networks are not our processors. When you allow tracking, Admitad (Germany), Awin (Germany and United Kingdom) and Impact (United States) and the brands you visit receive your account ID and handle it as independent controllers under their own privacy policies. Businesses on Tiswa see only what “Using offers” describes. We do not sell personal data.

Transfers outside Saudi Arabia

Our main database is in India, and some providers above are in the European Union, the United Kingdom and the United States, so your data is transferred outside the Kingdom. We transfer only the data each provider needs for its task, and each provider is bound by contract to protect it and use it only for Tiswa.

How long we keep data

  • Account, profile and verification decisions: while your account exists, then erased within 30 days of deletion.
  • Verification documents and photos: as described in the sections above, at most 30 days.
  • Sign-in codes: 10 minutes.
  • Search history, usage events and rough area: 13 months, then deleted or made anonymous, and always deleted with your account.
  • Crash and performance reports: up to 90 days.
  • Email delivery records: 13 months.
  • Affiliate reports and commission records: as long as Saudi accounting and tax law requires.
  • Support requests: 2 years.
  • Backups: our database host (Supabase) keeps daily backups for 7 days, and we keep our own encrypted backup copies for up to 30 days. Data you delete leaves the backups when they expire, so it is gone from every copy within 30 days.

Your rights

  • Under the PDPL you can ask to know what data we hold about you and how we use it, get a copy in a readable format, correct it, or have it deleted, and you can withdraw any consent you have given.
  • To withdraw consent: tracking in iPhone Settings, location and notifications in iPhone Settings or the app, Google Analytics with the Cookies link on the site or Share usage analytics in the app's Settings, and taste answers in the app. Withdrawing consent does not affect what was done before.
  • Send other requests to partners@tiswa.app or through the support form, from the email linked to your account so we can confirm it is you. We answer within 30 days.
  • If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA).

Keeping data safe

We protect data with encryption in transit, access controls on every table, and limited staff access; only authorised staff can see verification documents. If a breach is likely to harm you, we will tell you and the competent authority as the law requires.

Changes to this notice

We will update this notice when Tiswa changes. We will change the date at the top, and tell you in the app or by email before an important change takes effect.

Contact

Establishment ALF CHEAR For Trading, commercial registration 4030600062, Jeddah 23623, Saudi Arabia. Privacy questions and requests: partners@tiswa.app.

Email partners@tiswa.app

Send a privacy or deletion request through support