Privacy Policy

Who We Are

Paz is a household management application built for families in the MENA region. It helps a family run a home: tasks and routines, shopping lists, appointments, and the day-to-day coordination with the people who work there, such as a housekeeper, a driver, a nanny or a cook. We built it because running a household takes more organising than any one person should have to hold in their head.

Our Approach to Your Information

Before the detail, the short version. Nobody at Paz sits reading your shopping lists, your tasks or your household's schedule. What you put into Paz is there to make Paz work: to send the right thing to the right person at the right time. It is infrastructure, not surveillance. We look at the content of a particular household only when there is a reason to, such as a problem you have asked us to fix.

We also want to be straight about the part that policies like this one usually leave vague. Paz is an AI product. The assistant cannot answer a question about your home without being told about your home, so real details about your household do leave our servers and reach the companies that run the AI models. The section below called AI, and the permission you give for it says exactly what goes, who receives it, what they may do with it and how long they keep it. If you would rather none of that happened, the assistant can stay switched off and the rest of Paz still works.

What Information We Collect and Why

What you give us when you sign up

To create an account we need a way to tell you apart and a way to reach you: your name and your email address, plus your phone number if you want Paz to message you on WhatsApp. You can sign in with a code sent to your email, or continue with Google or Apple, in which case that company confirms your identity to us and passes on your name and email address so the account can be made. There is no password to lose.

Your household, and the people in it

Setting up a home means telling Paz about the home and who is in it: family members, the people who work there, your rooms, your pets. You can also keep practical details about the home itself, such as its address, its WiFi name and password, and places you save on a map. Paz needs to know who is who in order to send the right things to the right person. The details that are private to the family, the WiFi password and the address among them, are stored apart from the rest of the household's information and are readable only by the people you have given that permission to.

What you create as you use Paz

Tasks, lists and the items on them, events, routines, notes about how the home runs, the things the home holds, maintenance reports, questions anybody raises, and photos you attach. This lives in your household's own workspace so that the people in that home can see it and so that Paz can act on it. It belongs to you; see Data Ownership below.

Messages

Paz reaches the people who work in your home over WhatsApp, because that is an app they already have, so they never download anything and never create an account. We keep a record of those messages, incoming and outgoing, inside your household's workspace, so the home has a history of what was asked and what came back.

Some of those messages are sent by Paz itself, on a schedule, with nobody pressing send: a short briefing each morning, a reminder about an hour before something is due, and a message to whoever a new task has just been assigned to. That is what the product is for rather than a side effect of it, and the person receiving them can stop them for good at any time by replying STOP to the Paz number from their own phone. START turns them back on. The word has to be sent on its own, so a message that happens to contain it never switches anybody off by accident.

Your device

Basic technical information: the kind of device, its operating system, which version of the app you are running, and a push token if you have allowed notifications. It is there so the app works properly on your phone, so we can tell which build a crash came from, and so a reminder can actually reach you. We do not use it to build a profile of you and nothing in Paz follows you into other apps.

Location

Paz asks for your location in one situation only: when you open a map to pick a place, for example adding a location to a task or an event. Your coordinates are used on your device to centre that map and to show how far a suggested place is from you, and they are sent along with your search to Google Maps Platform so that nearby results come back first. We do not write your coordinates to our database and we do not log them. Paz never follows your location in the background, and if you don't open a location picker we never ask for it at all.

Places you save to a home, and the home's own location if you use weather alerts, are stored as part of your household data. Those are places you chose to save, not a record of where your phone has been.

Photos and voice

Photos you attach to a task, a list item or a message are kept in private storage tied to your household, reachable only through a short-lived signed link issued to a member of that household. Voice input inside the app is not stored by us: the recording is sent to be turned into words, we keep the text it produces, and the audio is not saved to our systems. The company that does the transcribing may hold its own copy for a short period, which the AI section below sets out. Voice notes sent through WhatsApp work differently: WhatsApp hands us the audio file and we keep it next to the message, so the household has a record of what was actually said. Photos and WhatsApp audio stay with the household they belong to for as long as that household exists; write to us if you want a specific file removed sooner.

Usage records

There is no third-party analytics or advertising SDK inside the Paz app. No PostHog, Amplitude, Mixpanel, Firebase or Segment, and nothing in it follows you across other apps or websites. What we do keep is a record, on our own servers, of what happens in Paz: a task created or completed, a list item added, a photo attached, a routine set up, a message arriving from a member of your team, a question asked, a screen failing to load. Each record carries the kind of thing that happened, when, in which household, and who did it.

These records are deliberately kept free of content. They hold counts, timestamps and short labels, never the text of a task, a list item, a note, a message, a name or a phone number. They record no taps, no screen views and no browsing of any kind. If we ever need to read what someone actually wrote, we go and read it with a reason, rather than stumbling across it in an analytics table.

We keep it because the alternative is guessing. Without it we cannot tell a member of your team who chose not to use Paz from one Paz silently stopped answering, and those two need opposite responses from us. We do not sell it, share it with advertisers, or use it to build advertising profiles. And one thing in particular: we do not hand per-person activity to an employer as performance data. If somebody on a team is not receiving messages we will say so, because that is ours to fix; we will not report how often an individual replies, how fast, or how much they got done.

Your subscription

If your home pays for Paz, we hold what we need in order to know that it does: which plan, monthly or yearly, whether it is running, when the current period ends, and the identifiers Apple and RevenueCat use for that subscription. No card number, expiry date or billing address ever reaches us. Apple takes the payment and never passes those on. We also keep a record of each message RevenueCat sends us about a subscription, so that a charge, a renewal or a cancellation can be traced if one is ever disputed.

When you write to us

If you email us for help, for example using the "Email support" option in the app, which opens your own mail app with our address already filled in, we receive your email address and whatever you choose to write to us. We use it only to answer you and sort out what you got in touch about, and for nothing else.

How We Use Your Information

Everything we do with your information falls into one of these:

Running the service you signed up for. Your household data powers the features you use every day: tasks, scheduling, coordinating the people who work in your home, shopping lists and reminders. Without processing it the app would not function.

Telling people what is happening. Paz sends notifications and WhatsApp messages about tasks, upcoming events and routines. Some are a direct result of something you just did, such as assigning a task; others go out on a schedule, such as the morning briefing and the reminder before something is due. Either way the timing and the content come from what is in your household, not from any editorial decision of ours.

Answering with AI. The assistant, voice notes, the quick reading of a task you type, and translating so that everyone in the home reads things in their own language. The next section is entirely about this.

Making Paz better over time. We use the usage records described above to see which features earn their place, where people get stuck, and what to build next. Most of the time we are looking at totals across all households; sometimes, to work out why something broke for one home, we look at that home’s records specifically. Either way we are looking at what the app did, not at what anyone wrote.

Keeping it safe and working. Crash reports, error reports and a check that a login is coming from a person rather than a script.

AI, and the permission you give for it

Paz uses AI in four places: the assistant you talk to, turning a voice note into words, reading a task you type in quickly so it can fill in the date and the person for you, and translating a task or a message so that everyone in the home reads it in their own language.

We ask first. The first time you use the assistant, voice input or the quick reading of a typed task, Paz shows you what is about to happen and asks. If you tap Not now, nothing goes to an AI company: the assistant, voice notes and quick task reading stay off, a typed task is read by a simple pattern matcher that runs on your own phone instead, and everything else in Paz keeps working. You can change your mind later, in either direction, under Settings, then AI assistant. The answer is stored against your account, so it holds on every device you sign in on.

What gets sent. What you type, say or photograph, plus the part of your household the answer needs: the names of the people and pets in the home, their roles, your tasks, lists, events, rooms, and the places you have saved including their addresses. A phone number can be part of it when you ask the assistant to add or change somebody’s WhatsApp number, or ask it which number it has on file. Your email address is not sent. Notes about how your home runs, the things it holds and its open issues are also turned into a numeric form, called an embedding, so that the assistant can find the right one later; the text of the note is part of that request.

Who receives it. Anthropic runs the models behind the assistant, the quick reading of a typed task and the translation. OpenAI turns voice into words, both what you record in the app and the voice notes that arrive over WhatsApp, and produces the embeddings just described. Alongside the audio, Paz sends OpenAI a short list of the names in your household so that an unusual spelling comes back right rather than as the nearest common name.

What they may not do with it. Neither Anthropic nor OpenAI may use what we send them to train or improve their models. Anthropic’s commercial terms say it in as many words, in section B: "Anthropic may not train models on Customer Content from Services." OpenAI’s API documentation states that data sent to the OpenAI API is not used to train or improve OpenAI models unless a customer opts in, and we have not. Both were read on 11 October 2026 and are a condition of us using those companies at all.

How long they hold it. We used to tell you nothing was kept. That was not accurate, so here is what is. Anthropic deletes what we send within 30 days of receiving it, except where its automated safety checks flag something, which it may keep for up to two years. OpenAI generates abuse-monitoring logs for API use and keeps them for up to 30 days, and longer only where the law requires it or where it is necessary to stop harm. None of these companies is given your email address, and none of them is paid in your data: we pay them money.

The people who work in your home, and WhatsApp. Somebody working in your home talks to Paz through WhatsApp rather than through the app, so there is no screen on their phone where Paz could put the question above. Their messages are handled the way yours are: what they write or say reaches the same companies, under the same terms, so that Paz can understand it and answer in their own language. The switch in Settings covers the family’s own use of the assistant inside the app; it does not close the WhatsApp side, because WhatsApp is how the home reaches them at all. Whoever set up the household added them and decided they should be reached this way, so if that is you, this paragraph is the part to read twice. Anyone can stop their own messages at any time by replying STOP, and Paz tells them so.

What we do not do. We do not send your household’s information to an AI company for any purpose other than answering the thing in front of you. We do not sell it. We do not let it be used for advertising, and there is no advertising anywhere in Paz.

Third-Party Services

Paz is built on other companies’ services, and this is the full list of the ones that handle any part of your information, with what each one is for.

Supabase provides the database, the file storage, the login system and the servers our code runs on. Your household data lives there with row-level security turned on, which means the database itself enforces that a person can only reach data belonging to a household they are in. Even at that level, another family's shopping list is invisible to you, and yours to them.

Anthropic runs the AI models behind the assistant, the quick reading of a typed task and translation. OpenAI turns voice into words, whether it is recorded in the app or sent as a WhatsApp voice note, and produces the embeddings used to search your household’s notes. The section above says what each receives and for how long.

WhatsApp, from Meta carries the messages between Paz and the people in your home who use it. The content of each message passes through Meta's platform, which is what makes it arrive in an app they already have. Meta handles it under its own terms as the operator of WhatsApp.

Expo and Apple Push Notification service deliver push notifications to your phone. A notification carries the text you would expect to see on the lock screen, such as the title of the task, so that text passes through both services on its way to you.

Apple distributes the app through the App Store and TestFlight, and runs Sign in with Apple if that is how you sign in. Google runs Sign in with Google for the same reason. Either one confirms to us that you are who you say you are and passes on your name and email address.

Google Maps Platform powers place search, place details and address lookup. Those requests travel through our own server so that our Google key never ships inside the app; what reaches Google is your search text and, when you have granted location permission, your coordinates. We keep no copy. Google handles these requests under the Google Maps Platform Terms of Service.

Resend sends the emails Paz has to send: your sign-in code, an invitation to join a household, and our replies to the things you report. It receives the address the email is going to and the content of that email.

hCaptcha checks that a sign-in request is coming from a person and not from a script. It sees the technical information any such check sees, including your IP address, and it does not receive your name, your email address or anything from inside your household.

Sentry receives crash and error reports so we can fix what breaks. A report identifies you only by your account id, Sentry is configured not to attach your name, email address or phone number, and on the server side we additionally strip tokens and phone-number-shaped text out of every report before it is sent.

Apple also takes every payment for a Paz subscription, as the seller of record in the App Store, and RevenueCat sits between Apple and us: it reads the receipt Apple issues, works out which plan is running and tells our server when one starts, renews, lapses or is cancelled. What it holds about you is the subscription itself, with an identifier for the account it belongs to, and never your name, your email address or anything from inside your household. Neither of them is given access to your household data.

Vercel hosts our website and the web pages Paz links to, such as a shared shopping list. Vercel sees the request information any web host sees, and gives us aggregate page-view counts rather than a profile of any individual visitor.

We do not sell your personal information to any third party, and we never will. Our business is a useful service that families pay for, not the resale of what they tell it.

Data Storage and Security

Your data is stored in the European Union, in Frankfurt, Germany. We chose an EU data centre because the European Union holds some of the strongest data protection standards in the world and we wanted the foundation to reflect that.

All data is encrypted in transit, when it is moving between your device and our servers, and at rest, when it is sitting in our database. Files you upload are kept in private storage, not on a public address: reaching one needs a short-lived signed link issued to somebody in that household.

As mentioned above, we use row-level security to keep households strictly separate. This means that even if there were a bug in our application code, the database itself would refuse to hand one household another household's data. It is an extra layer built into the foundation rather than bolted on top.

We review our security practices regularly and update them as standards move. No system can promise absolute security, but we take every reasonable measure to protect your information, and if something ever did go wrong we would tell you rather than hope you did not notice.

Your Rights

You have the right to:

Access your data. You can ask for a copy of the personal data we hold about you and your household.

Correct your data. If something we hold about you is wrong, you can ask us to fix it, and you can change most of it yourself inside the app.

Delete your account. You can do this yourself, from inside the app: Settings, then Delete account. It happens immediately and cannot be undone. It removes your profile and contact details, your conversations with Paz, your notifications and reminders, your documents and your registered devices. A home you own on your own is deleted with you, including its tasks, lists and events; a home you share with other family members keeps running and passes to one of them. Where something you created is still in use by a home you shared, a task, a list, an event, that item stays with the household, no longer connected to your name or any way of contacting you. If you would rather we did it, write to hello@getpaz.io and we will, within 30 days.

Withdraw your permission for AI. Under Settings, then AI assistant, at any time, without losing the rest of the app.

Stop the WhatsApp messages. Reply STOP to the Paz number from the phone receiving them. This works for anybody Paz writes to, whether or not they have a Paz account.

Export your data. You own your data, and if you want to take it with you, you have every right to do so.

To exercise any of these, write to hello@getpaz.io. We will answer promptly and always within 30 days.

Data Ownership

This is straightforward: you own your household data. Paz claims no ownership over the content you create in the app. Your tasks, lists, schedules, notes and anything else you enter belong to you. We are custodians of your data, not owners of it.

If you ever decide to stop using Paz, you can ask for an export of your data or ask us to delete all of it. Either way, it is your choice.

Data Retention

We keep your household data for as long as your account is active, because that data is what makes the app useful to you. When you delete your account from inside the app the deletion is immediate, not scheduled: your personal data goes at once, and a home you owned alone goes with it. If you ask us to delete your account by email instead, we will do it within 30 days.

One thing worth stating plainly: a home you shared with other people does not disappear when you leave it, and neither does the work you did in it. A task, list or event you created stays with that household, because the household still needs it, but it is no longer linked to your name, your email address, your phone number or anything else that identifies you. Photos and WhatsApp voice notes stay in private storage with the household they belong to; ask us and we will remove specific files sooner.

We keep the usage records described above, the content-free ones rather than your household’s actual data, after an account is deleted, so that totals for past months do not silently change. Deleting an account strips your identifier from those records, so what survives is the shape of what happened and not whose it was. Anything you wrote to us as feedback is deleted outright along with the account, not kept.

Deleting your account removes your data from our systems. It does not reach backwards into the short-term copies the companies in the AI section hold, which fall away on their own schedules, described there.

Children

Paz is for adults running a household. It is not intended for anyone under 18 without a parent or guardian involved, and we do not knowingly collect personal information from children under 18. A parent may of course add a child to the household as a family member; what is held about them is then what the parent entered. If we learn that we have collected information from a child without a parent or guardian knowing, we will delete it promptly.

International Data Considerations

Paz serves families primarily in the MENA region while our own infrastructure sits in the European Union, and the companies listed above operate in the European Union, the United Kingdom and the United States. So your information does cross borders, both on its way to us and when one of those services is doing its job. We make those transfers under the protections applicable data protection law requires, and we hold each company to terms that keep your information protected wherever it is processed.

Changes to This Policy

We may update this Privacy Policy as the app changes or as the law does. When a change is significant we will tell you through the app or by email, so you have the chance to read it. Smaller changes, such as clearer wording with no change in practice, may be made without telling you, and the current version is always here.

The "Last updated" date at the top always reflects when the most recent change was made.

Contact Us

If you have a question about this policy, want to exercise one of the rights above, or just want to understand how something works, we are happy to help:

hello@getpaz.io

We are a small team, we read everything that arrives, and we would rather answer a question plainly than have you guess.