Wavilu Privacy Policy

1. Your consent

When you create a Wavilu account, you confirm that you are 18 or older and you accept this policy and the Terms of Service. This gives us your consent to collect and use your information as this policy describes, including the sign-language landmarks in section 3. Your phone also asks you before Wavilu can use the camera, the microphone or notifications. You can withdraw a consent at any time (see sections 3 and 8).

2. Information we collect and how we use it

• Account information: your display name, your mobile number (every account needs one, verified with a code by text message) and your email address if you add one (verified with a one-time code), an optional username and password, your language, your confirmation that you are 18 or older, sign-in records and your settings. We store your password only as a one-way hash. We use this information to create and secure your account, sign you in, help you recover access, send you account notices and show Wavilu in your language.
• Malka and Maple team sign-in: if you use Malka or Maple VRS, you can sign in to Wavilu with your Malka or Maple email address and password. Wavilu passes these details to the Malka or Maple sign-in service to confirm them. Wavilu does not store that password. For enrolled teams, we receive your organization, account identifier, display name and email address. We use them to connect your team identity to your Wavilu account. This link does not give your organization access to your Wavilu conversations.
• Friends and connections: you can find a person when you enter their phone number or email address. That person then sees a connection request from you. In Settings you can choose that nobody can find you this way. When a search finds nobody, you can send that number or email an invite from your own Messages or mail app. You can also share an invite link through your phone's share sheet or a text message that you send. Phone contacts is off until you turn it on in Settings and allow Contacts. Then Wavilu reads the names, numbers and emails in your phone's address book on the phone. To find which contacts use Wavilu, it sends only a one-way scrambled code (a SHA-256 hash) of each number and email. We compare the codes with the accounts that let others find them, answer with the matches, and keep none of the codes. Names never leave the phone. Turning it off removes the matches from the phone. We keep your connections, blocks and group memberships so that you can message the people you choose.
• Messages: your video messages (with sound if you record it), a poster frame, captions, reactions, Keep choices, watch progress, delivery status and group membership. We use this information to deliver your messages, show who watched them, keep the videos you choose to keep and run the features that you use.
• Captions: when a video has sound and captions are on, we send only the audio track to our captions provider to make captions. We do not send the picture. You can turn captions off in Settings.
• Play (sign games), when we offer it: a display name for Play, the sign languages that you choose, an optional listing on the leaderboard, and your answers and points. We use this information to run the games and the leaderboard. Your answers also help us improve Wavilu's sign-language models.
• Device information: a random installation ID for each copy of the app (we store it only as a one-way hash), your phone's platform, a push notification token and your app language. We use this information to send notifications, keep your sign-in secure and tell you when your account signs in on a new phone.
• Support requests and reports: your contact details, the text that you send, and a reference to a video if you report one. We use this information to answer you, review reports, keep Wavilu safe and give beta access information.
• Service records: event identifiers, times, session and delivery status, errors, security records and your network address. We use these records to operate, protect, fix and improve Wavilu, and to stop misuse.

We also use the information above to understand how people use Wavilu, to develop new features, to communicate with you about Wavilu, and to meet our legal obligations. We can use information that is aggregated or de-identified, so that it does not identify you, for any lawful purpose.

3. Improving Wavilu, research and AI

We build technology for Arabic sign languages, such as the sign languages of Kuwait, Saudi Arabia and the other Gulf states. For this, Wavilu uses sign-language landmarks: numbers that give the positions of your hands, face and body in a video. After you send a video, your phone reads these landmarks from it. For this purpose only the numbers leave your phone: not the picture and not the sound. We do not read landmarks from the videos that we store on our servers.

We collect landmarks from a video that you send only when all of these are true: you confirmed that you are 18 or older; your mobile number is in Kuwait, Saudi Arabia, the United Arab Emirates, Qatar, Bahrain or Oman; every other person in the conversation also has a mobile number in one of these countries; and "Help improve Wavilu" is on in Settings. If a person in the conversation is in the United States or Canada, or we do not know their country, we collect no landmarks from that video. We do not collect landmarks for American Sign Language.

With the landmarks of each video we keep your account, the video they come from, the country of your number and the date. We use the landmarks, and information that we derive from them (for example labels of signs), to improve Wavilu and to develop and train sign-language models. We can use these models in Wavilu and in our other products and services, including commercial ones, such as our sign-language services in the Gulf (MalkaVCS). When our research team uses landmarks, a random research number replaces your account.

"Help improve Wavilu" is on when you start. You can turn it off at any time in Settings. When you turn it off, we stop collecting landmarks, and we delete the landmarks that we kept from your videos, also from our research copies. You can also mark one video "Keep out of research", or delete it, and we delete its landmarks. Models that we trained before you withdrew keep what they learned.

Wavilu may keep, store, and learn from anonymized data for quality and training purposes.

4. Who receives information

The people you send messages to can watch them. Recipients can save or share copies outside Wavilu. Our team can access information when we need it for support, reports, safety, security or legal obligations. We use these service providers to run Wavilu:

• DigitalOcean hosts our servers and stored messages in New York, United States.
• Resend sends email, for example sign-in codes, account notices, invitations and support replies.
• Twilio sends text-message codes when you use phone sign-in.
• Deepgram receives the audio track of a video to make captions. We set Deepgram's model-improvement opt-out on these requests.
• TypeSafe receives the text of support requests and reports to sort them by topic and urgency.
• Apple (APNs) and Google (Firebase Cloud Messaging) receive your device's notification token and the notification content, for example the sender's name and the group name, to deliver alerts. Google also uses a Firebase installation ID.
• Let's Encrypt issues the security certificates for our HTTPS connections.

We may also share information when the law requires it, to answer a valid legal request, or to protect the safety and rights of people, Wavilu and the public. If we join with or sell all or part of our business to another company, information can transfer to that company, and this policy will continue to apply to it.

We do not sell personal information. Wavilu does not show third-party advertising today. We may tell you about Wavilu's own features and offers in the app or by email.

5. Where we store information

Our servers are in New York, United States. If you use Wavilu in Kuwait or another country, we transfer your information to the United States. Our service providers can process information in other countries under their own service terms. We choose providers that protect information in line with this policy.

6. How long we keep information

• Videos: a video expires 24 hours after all its recipients watch it. A video that nobody watches expires after 30 days. The sender can choose 7 days or 30 days after viewing, or Keep. A kept video stays until the Keep choice ends. The sender can delete a sent video for everyone. When a video expires or is deleted, we remove the video, its poster frame and its captions. A short record can stay to show that the message is no longer available.
• Account information: we keep it while your account is open. We delete it when you delete your account (see section 8).
• Support requests, reports and service records: we keep them for as long as we need them to answer you, operate and protect Wavilu and meet legal obligations. Then we delete or de-identify them.
• Sign-language landmarks: we keep them until you turn off "Help improve Wavilu", delete the video or your account, or until we no longer need them for the purposes in section 3.
• Backups: we copy the database and configuration to snapshots on the same server. Each snapshot stays for about 7 days, and we always keep the newest complete snapshot. Video files are not part of these snapshots. Information that you delete can stay in a snapshot until that snapshot expires. Wavilu may later keep encrypted backups with its hosting provider.

7. How we protect information

Wavilu connects to our servers through TLS (HTTPS). We store passwords as one-way hashes. The app keeps your sign-in session in your phone's secure storage. We use technical and organizational safeguards that are appropriate to the service, and we will improve them over time. If a security incident affects your personal information, we will tell you and the authorities as the law requires.

8. Your rights and choices

You have the right to:

• see the personal information that we keep about you
• correct information that is wrong or out of date
• delete your information and your account
• restrict or object to how we use your information
• withdraw a consent that you gave, including the use of your sign-language landmarks (Settings → Help improve Wavilu)
• get a copy of your information.

To use these rights, email robert@malkacomm.com. We can ask you to confirm your identity. We answer within the time that the law requires. You can also contact your local data protection authority.

Delete your account in the app: select Settings → Request account deletion. After a 24-hour grace period, we delete your account. We remove your sign-in details, contacts, devices and sessions. Videos that you already sent stay with their recipients until they expire. To remove them sooner, delete them for everyone before you delete your account. We send a confirmation to your email address if we have one.

Other choices: you can change notification permissions, captions and message expiry in the app and in your phone settings. You can block a person and report a video. If we send you marketing messages, you can stop them with the link in the message or by email to us.

9. Age

Wavilu is for adults aged 18 or older. If you think that a person under 18 has an account, contact us. We will review it and remove an account that is not eligible, together with its information.

10. Changes to this policy

We update this policy when Wavilu changes. Before an important change takes effect, we tell you in the app or by email. The date at the top shows when this version took effect.

11. Contact

Malka Communications Group, Inc. — robert@malkacomm.com. You can also use Settings → Support / report in the app.