Privacy Policy — POWER Family

This Privacy Policy explains what personal data POWER Family collects, why, who can see it and how long it is kept. POWER Family is operated from Egypt.

1. Data you give us

Account: first and last name, username, email address and password (stored only as a one-way hash).
Profile (optional): photo, cover, bio, gender, date of birth, country, mobile number, social media links and contact details you choose to show.
Identity verification: the document type and the images you upload (national ID, passport or driving licence, a selfie and, where asked, a website screenshot). See the Verification Policy.
Marketplace: listings, photos, ownership-proof screenshots, offers, bids, buyer requests, comments, likes and saved listings.
Deals: deal-room messages, signed declarations, handover records, payout details (method and account) and transfer screenshots.
Payments to POWER Family: the wallet number or InstaPay account you paid from, sender name, transaction ID and the receipt screenshot.
Community features: Academy posts and answers, Fraud Registry reports and evidence, appeals, content reports, POWER of Good donations (amount, sender number and screenshot), Ideas & Issues posts.

2. Data collected automatically

Session and security cookies (see the Cookie Policy).
Your IP address on sign-in and registration attempts (rate limiting), when you sign a deal declaration and when you start a payment.
Activity needed to run the site: notifications, profile visits, listing views, likes and votes (each counted once per member), and audit records of team actions.

3. Why we use it

To run your account, the marketplace, deal rooms and payments.
To keep members safe: identity checks, fraud prevention, duplicate-receipt detection, moderation and dispute decisions.
To calculate the Trust Score, rankings, badges and the price index.
To send you notifications inside the site and account emails such as password resets.
To comply with the law and answer lawful requests from Egyptian authorities.

We do not sell your personal data, and we do not run third-party advertising trackers.

4. Who can see what

Public profile information is visible to other members. Your email, phone number and date of birth are hidden from other members unless you choose to show them; gender and country are shown unless you hide them.
Deal rooms are visible only to the buyer, the seller, the middleman who owns the deal and the team. Login details handed over in a deal are encrypted and shown only to the person receiving them.
Identity documents, payment receipts, donation screenshots, private Fraud Registry documents and listing ownership proofs are stored on private storage that is not reachable from the web. Only you and authorised team members can open them.
The identity of a member who files a content report or a Fraud Registry report is not shown to the reported person.
VIP members can see other members' followers and following lists. A VIP may choose to hide their own profile visits.
Service providers: the site is hosted on servers we control. Live currency rates are fetched by our server from a public rate service; no personal data is sent. Fonts are loaded from Google Fonts, which receives your IP address as part of a normal web request.

5. How long we keep it

We keep personal data only as long as we need it, then delete or anonymise it automatically every night:

Sign-in records (time, IP address, browser, approximate location): successful sign-ins for 12 months, failed attempts for 90 days. A device that is still signed in is kept until it signs out.
Sessions end after 120 minutes of inactivity unless you ticked "Remember me"; expired sessions are deleted daily.
IP addresses and browser details recorded at registration, on payments and in team records: kept 12 months, then removed (we keep only the country).
Browsing traces: the listings and topics you opened and profile visits for 90 days (we keep only the totals used for badges); your recent searches for 12 months or until you clear them; your activity log for 12 months.
Notifications: 90 days after you read them; unread ones for 12 months.
Email codes: deleted 24 hours after they are used or expire. Sign-ups whose email code was never confirmed are not accounts: their details are deleted automatically after 24 hours.
Identity documents: deleted as soon as the team approves or rejects the verification (or 30 days after the team asked for changes you did not send). After approval we keep only the verification result and the verified name, ID number and address that the team transcribed, until your account is deleted.
Login details shared in a deal handover: erased 14 days after the deal is completed, cancelled or refunded.
Community membership proofs: deleted when the request is decided or replaced.
Deals, deal chats, declarations, receipts, payments, penalties, reviews, reports, moderation and Fraud Registry records: kept for the life of your account and for up to 5 years after the record is closed, as financial, dispute and safety records (Egyptian commercial and tax rules require financial records to be kept for 5 years).
Unpaid payments expire after 24 hours.
Server logs are kept for 14 days and database backups for 30 days.
Other account data (profile, listings, posts and comments) is kept while your account exists. If you delete your account, it is deactivated at once and anonymised after 30 days (see section 7).

6. Security

Passwords are hashed, sensitive deal secrets are encrypted, private files are kept off the public web, and the site uses rate limits, security headers and team-only access controls. No method is perfect, so please use a strong, unique password.

7. Your choices and rights

You can view and edit your profile and choose which details (email, phone, date of birth, gender, country) other members can see in Settings at any time.
You can ask the team for a copy of your data or a correction, and you can delete your account yourself in Settings › Delete account. The account is deactivated at once and deleted after 30 days (sign in before then to cancel): your name, email, phone number, photo, contacts and identity documents are removed. Some records (completed deals, payments, penalties, reviews, comments, moderation and Fraud Registry decisions) are kept under "Deleted member" where needed for safety, disputes or the law.
Requests are handled under the Egyptian Personal Data Protection Law (Law No. 151 of 2020).

8. Sign-in and session records

Each time you sign in (and each failed attempt on your account or password reset) we record the time, the IP address, the browser and device type (from your browser's user agent), an approximate location worked out from the IP address (country and city), and whether it succeeded. A random cookie recognises your browser so we can tell you about sign-ins from a new device.
While you are signed in, your session (IP address, browser and last activity time) is stored on our servers.
To estimate the location, our server sends the IP address (and nothing else) to a public IP-location service; results are cached for a few days.
You can see where you are signed in and your sign-in history in Settings › Security & Logins, where part of each IP address is hidden. You can sign out any device from there. We alert you inside the site and by email about sign-ins from a new device or location and about repeated failed attempts.
The team can see full IP addresses and sign-in history, and which other accounts used the same IP address or browser. We use this only to protect accounts and to detect fraud and duplicate accounts.
Sign-in records are deleted automatically after 12 months (failed attempts after 90 days). Session records are deleted when the session expires or you sign out.

9. Contact

Contact the team from inside your account through the Ideas & Issues page. We will update this policy when our practices change and show the new date above.