Privacy policy

What we collect if you have an account

The email of the Google account you sign in with, your items and stickers (random codes that reveal nothing about you), and the alerts you received.

If you sign in with Apple: Apple gives us your email (or a private relay address if you choose one) and your Apple account identifier. We also keep the sign-in token Apple issues, encrypted, so that deleting your account also tells Apple to cut KLAKS off from your Apple ID.

We never see your password. If your older account was opened with a phone number, that number is stored encrypted — even we don't see it in plain text in the database.

A plate number is stored only if you type it, and shown to no one unless you turn that on. An address is stored only if you order a printed sticker (below). A name is optional: if you enter one in settings it shows inside your own account only, and nobody who scans the code sees it.

If you switch "car for sale" on from the car's page, the asking price you entered is shown to anyone who scans the code — only while selling is on, and it disappears from the page the moment you switch it off.

If you reply to someone who scanned your code, they can report your reply. We then keep that report, and which account wrote the reply, so we can review it.

What happens when you scan a code

No account and no personal details are asked of you. We set an anonymous device cookie in your browser, kept for a year — a random identifier tied to nothing about you — whose only job is to stop repeated spam and cap how many alerts one device can send.

We use your IP address for the same reason, and it is deleted from the alert within 72 hours (one copy is kept for our admins — see the next section).

That cookie is never used for advertising and never sold, and the car owner sees nothing about you.

If you scan from inside the KLAKS app while signed in, the app uses a random device identifier issued by our server instead of the cookie, for exactly the same limit — your account is not attached to the alert, and the owner sees nothing about you.

The one exception is yours to choose: you may leave your number with any message so the owner can call you back. The field is optional and always starts empty; the number is stored encrypted, shown only to that owner, and deleted automatically after 30 days.

If you write your name with the message, only that car’s owner sees it, it is stored encrypted, and it is deleted after 30 days — the name is optional, and letters only.

If you tap «Notify me when they reply» while you wait, your browser gives us a push address for that browser only (not your number, not your name). We keep it in short-term memory, not in the database, tied to the anonymous cookie in your browser, so we can notify you when any alert you send from this device gets a reply. It is kept for up to 30 days after the last alert you sent — every new alert renews that — and then deleted on its own, and you can stop it at any time with «Turn notifications off» on the page. We use it to send you the reply and nothing else.

The admin record of who scanned

When someone sends an alert we keep one encrypted record holding: the IP address, the phone and browser type, the browser language, the anonymous cookie identifier, and which message was sent and when.

No location — we do not know it.

It exists for one reason: if the service is used for harassment, threats or anything unlawful, and if a lawful request reaches us.

Only our admin team can open it — never the car owner, and never another scanner. It is deleted automatically after 180 days, may be kept up to two years if the alert was reported or the device banned, and then it goes regardless.

To ask about your own record, email support@klaksapp.com. If you wrote your name with the message, it is kept in the same record.

If you order a printed sticker

This only applies if you ordered a printed sticker from the «Store».

If you did, we ask for your name, mobile number, governorate and address so we can print the sticker, deliver it, and call you to agree delivery and payment. You can also send a map pin if you want to make the courier’s job easier — it is optional and can be left blank.

All of it is stored encrypted — the governorate too, inside the encrypted address. It is seen only by our own admin team while the order is being prepared, and every time someone opens it that is logged.

If you tick «Save these details for my next order» — it is unticked to begin with — we keep the name, number, governorate, address and pin encrypted on your account, so your next order is quicker. Nobody sees them but you, and they stay until you delete them from settings («Delete the saved address») or delete your account.

None of this touches the scan page: whoever scans your sticker never sees your name, your address or your pin.

Ninety days after the order is delivered or cancelled, the name, number, address, pin and note on the order are deleted automatically, and all that stays is that an order happened, plus a scrambled governorate marker we use for statistics — it cannot be read back as it is, and on its own it points at nobody.

What we keep and for how long

The IP address on an alert

72 hours

A number or a name a scanner leaves

30 days

Alert details

90 days — then anonymized

The admin record of who scanned

180 days — up to two years where there is a report or a ban

The reply-notification address a scanner asks for

30 days from the last alert

If you delete your account, your details, items and stickers are erased immediately.

Past alerts stay behind as bare numbers — detached and anonymized, with nothing left that leads back to you.

The scanner's own details are not yours to erase, so they do not go with your account and keep their own clock: a number or a name they left disappears from the alert after 30 days, or the moment you delete your account, and our admin record of them — which keeps the name if they wrote one — stays 180 days, or up to two years where there is a report or a ban.

Do we sell? No. Do we share? Only what's needed

We do not sell your data and we do not hand it to advertisers.

To deliver the service a few companies help us, and each gets the least it needs: Google's push service delivers notifications to Android phones and browsers and sees only your device token, not your number; on iPhone, Apple delivers the alert and sees only a device token — never the alert details or who scanned the code; if the app crashes, we receive a report with the phone model, OS and app version and where in the code it failed — without your name, email or any of your data, and the service receiving it (Sentry) is hosted in Germany; and Cloudflare counts page visits anonymously, with no cookies and no way to identify you, and also checks that whoever sends an alert from the scan page is a person and not a script (its Turnstile service) — the check runs in the background without asking you anything, and is covered by the Cloudflare Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy; and the app downloads its updates from Expo's update service, which sees only the app version, the phone type and the IP address — not your account or your alerts.

Each of these companies may use what it receives only to provide that service to us, and must protect it at least as well as we do. Nobody beyond those gets anything. Your number stays hidden from everyone who scans your code, and there is no way to look up a car or its owner through KLAKS.

Your rights

Under Egypt's Personal Data Protection Law (151/2020) you can access, correct, or erase your data.

The "Delete my account" button in your settings erases everything instantly — no need to talk to anyone.

Questions?

Every one of your rights is exercised by you, with nobody to ask: see your data and change your name and settings, and erase the account completely with "Delete my account".

For any privacy question, or to exercise a right some other way, email us at support@klaksapp.com and we will answer. The help center also has the common questions.