Privacy policy
The short version
Neerz is built so that we can't see where you are. Your location, your places, everyone's names and your alerts are locked on your phone before they leave it, and only the phones in your circle can unlock them. Our server passes on locked data and keeps only what it needs to do that, listed below. There are no accounts, no ads, no trackers, and no location history on our server.
1. Who we are
Neerz is made by Shebbak Studio. Needs legal review: name the legal entity that controls the data, its registered address and registration number, once the company exists.
Questions about privacy: privacy@neerz.app. Update at launch: this address isn't set up yet.
2. No accounts
You never give us a name, email address, phone number or password. When you first open Neerz, your phone makes a random device ID and a random secret. Your phone uses them to prove it's a member of your circles. Our server stores the device ID and only a one-way fingerprint (a SHA-256 hash) of the secret, so even we can't use it to pretend to be your phone.
You join a circle with an invite link or QR code from someone already in it. The name you show your circle is locked on your phone like everything else.
3. What stays on your phone
These are locked before they leave your phone, and only the phones in the same circle can unlock them. We can't read them:
- Your location, how accurate it is, when it was taken and your battery level.
- Your circle's name and kind (family, friends, a trip), its places (name, position and size) and who gets alerts for each place.
- Everyone's names.
- Alert messages, such as “Omar arrived at School”.
- The invite card a new member sees before joining (circle name, who invited them and who's in it).
Your Activity list (arrivals and departures), your keys and your settings are kept only on your phone.
Location permission. Neerz asks to use your location, including in the background, so your circle can see where you are and so your phone can notice when you arrive at or leave a place. Your phone checks places itself; we never learn which places you have or when you cross them. Most of the time the app uses the phone's low-power location. When someone in your circle asks to see you live, your phone sends precise updates for up to 5 minutes, and you're told that they checked.
Notifications permission. Used to show alerts from your circle. You can turn it off in your phone's settings.
4. How the locking works
“Locked” means end-to-end encrypted: the keys exist only on the phones in your circle, never on our server.
Update at launch In today's test builds, the phone that creates a circle makes a random 256-bit circle key and locks data with AES-256-GCM. The key travels to new members only inside the invite link, after the #. Browsers and apps don't send that part of a link to any server, including ours.
Before launch, Neerz moves to MLS (Messaging Layer Security, the IETF standard RFC 9420). With MLS every phone has its own keys and signs what it sends, so no one can fake another member's location, and removing someone changes the keys for everyone left. We plan to publish the encryption code so anyone can check it.
5. What our server keeps
Our server (we call it the relay) runs on Cloudflare. It stores the following, and nothing else:
| What | Why | How long |
|---|---|---|
| For each circle: when it was created, and its locked info (name, kind and places) with a version number | So every phone in the circle gets the same circle info | Until the last member leaves; then the whole circle is deleted |
| For each phone in a circle: its random device ID, the fingerprint of its secret, and whether it's an iPhone or Android phone | To know which phones belong to the circle | Until the phone leaves or is removed |
| Its push token (the address Apple or Google use to deliver notifications to it) | To deliver alerts and “Where are you now?” requests | Until the phone leaves, is removed or replaces it |
| When it asked to join and when it was let in, which phone invited it, and which invite it used | So the circle can see who joined and when, and so the inviter's phone can show the matching check code | Until the phone leaves or is removed |
| Its locked name card | So the others can show its name after unlocking it | Until the phone leaves or is removed |
| Its latest locked position, and when it arrived | So the circle sees the latest position, even when your phone is asleep | Replaced by each new update. There's no history. |
| Open invites: a fingerprint of the invite code and the locked invite card | So a new member can see who invited them before joining | 24 hours, or until used or cancelled |
| The time of the last “Where are you now?” request for each person | To limit these requests to one every 30 seconds | 1 hour |
A phone that asks to join but is never let in is deleted after 7 days. Request logs are turned off, so we don't keep a record of who connected or when.
6. What our server sees but doesn't keep
To pass data along, the relay can't help seeing some things while it works. We don't store them, but we want you to know:
- Your IP address, which can show roughly which city you're in. It's needed to connect at all. Cloudflare also uses it to limit how often one address can create or join circles.
- When your phone connects and sends an update.
- How many phones are in your circle, and which phones an alert or request goes to.
- Whether your circle has a paid plan (once plans exist).
We can't see what's inside anything that's locked.
7. Other companies involved
We don't sell or share your data with advertisers or data brokers, and the app contains no analytics, advertising or crash-reporting code from other companies. These companies are involved in running Neerz:
- Cloudflare hosts the relay and this website. It processes IP addresses to deliver traffic and block attacks, and stores the relay data listed above in its data centres. Needs legal review: data processing terms with Cloudflare, and transfers of data outside your country.
- Apple and Google deliver notifications (Apple Push Notification service and Firebase Cloud Messaging). They see your push token, when a notification is sent and its size. Alerts are locked, and “Where are you now?” requests contain only random IDs, not names or places. We send to Apple and Google directly, not through another push company. Apple and Google also run the app stores.
- OpenFreeMap Update at launch provides the map images in today's test builds, so it can see which area your map is showing (not who you are or where your circle is). Before launch, city maps downloaded to your phone replace it, so nobody sees which streets you look at.
If a court or authority asks us for data, we can only hand over what's in section 5, and the locked parts stay locked. Needs legal review: how we handle and disclose legal requests.
8. Payments and the free trial
Update at launch: paid plans aren't live yet. You'll pay through the App Store or Google Play; we never see your card or payment details. Apple or Google confirm the purchase to our server, and we keep a fingerprint of the original purchase ID, which circles it pays for and the plan's status. Everyone in a paid circle sees who pays for it.
To give each phone one free trial, Neerz will use Apple's DeviceCheck and Google's Play Integrity, which store a few bits per device with Apple or Google (for up to 3 years) without telling us who you are. The same services will also be used to check that requests come from the real Neerz app.
9. This website and invite links
neerz.app uses no cookies, no analytics and no trackers, and loads nothing from other companies: even the fonts come from our own server. Cloudflare hosts it and processes your IP address to deliver pages and block attacks; we don't keep visit logs.
Invite links look like neerz.app/j#…. Everything after the # stays in your browser: browsers never send it to servers. The invite page reads it on your phone and hands it to the Neerz app, and the page isn't allowed to make network requests, so it can't send the invite anywhere.
10. How long we keep things, and deleting them
- Leave a circle in the app, and your phone's entry in that circle (including its last locked position) is deleted straight away.
- When the last person leaves, the circle and everything in it are deleted.
- If you delete the app without leaving, your phone stays listed in your circles, with its last locked position and “Last seen” time, until someone in the circle removes it. To remove yourself completely, leave each circle first.
- Lost your phone? Ask someone in your circle to remove it.
- Data on your phone is deleted when you delete the app.
Because there are no accounts, we can't look you up by name, email or phone number. The quickest way to delete your data is to leave your circles in the app.
11. Your choices in the app
- Share live, share only your area (about 2 km wide), or pause, separately for each circle. Your circle always sees which one you chose; there's no hidden mode.
- See who can see you at any time, and leave any circle at any time. Everyone in the circle is told.
- Turn off location or notifications in your phone's settings. Your circle sees that location is off.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete or move your personal data, and to object to how it's used. Most of this you can do yourself in the app, as described above. For anything else, email privacy@neerz.app. Because we hold no names or contact details, we may need your phone to prove which data is yours.
Needs legal review: which laws apply (for example the EU and UK GDPR, Egypt's Personal Data Protection Law No. 151 of 2020, Saudi Arabia's PDPL and the UAE's PDPL), our legal basis for each use of data, how to complain to a regulator, and whether we need a local representative.
13. Children
Families may use Neerz with their children. A child's phone works like everyone else's: it always shows who can see it, it can pause or leave, and there's no hidden mode. We don't knowingly collect more about children than about anyone else, which is the short list in section 5.
Needs legal review: minimum age, parental consent (for example COPPA in the US and the age rules under GDPR), and the store age ratings.
14. Changes and contact
If we change this policy, we'll update the date at the top and, for important changes, tell you in the app before they take effect. Needs legal review: notice period and which language version applies if the English and Arabic differ.
Contact: privacy@neerz.app. Found a security problem? Email security@neerz.app. Update at launch: these addresses aren't set up yet.