Privacy Policy

This policy explains what Firaq, based in Cairo, Egypt, does with personal data. It applies to the Firaq app and to the forms on firaq.space. Contact: pr@firaq.space.

1. Who we are

Firaq is the operator of this service. Each organization that uses Firaq decides who joins it and what its members enter. In an employer-managed organization, the organization's admin controls the workspace and we process the data on the organization's behalf, under the Data Processing Addendum at https://firaq.space/dpa.

2. What we keep

• Account data: your name, email address, a password hash (argon2id, never the password itself), your role, and the organization and squad you belong to.
• Team content: standup answers, blockers and their history, retro notes, votes and action items, planning poker votes and estimates, the squad charter, and sprint reports.
• Calendar data: out-of-office days (we record no reason) and organization holidays.
• Organization settings: timezone and work week.
• Slack connection data, only if an organization connects Slack: the Slack workspace id, the channel, an encrypted bot token, and the email address Slack reports for a person who submits a standup from Slack. We use that email to match the person to their Firaq account.
• Session data: one record for each browser you are signed in on: a random token (we keep only a hash of it), the IP address, the browser and operating system from the browser's identification header, the country the IP address belongs to, and the times you signed in and were last active. We look up the country on our own server from a local database, so no IP address goes to a third party for it.
• Security data: the IP address and email used in login and signup attempts, which we use for rate limiting, and server logs.
• Website forms: the details you enter in the waitlist and demo request forms on firaq.space.

3. Cookies and browser storage

• A session cookie, HttpOnly and Secure in production. It holds a random token that points to your session record in section 2. If you tick "Keep me signed in", the browser keeps the cookie after you close it. Otherwise it is cleared when you close the browser. You need it to stay signed in.
• Your light or dark choice, stored in your browser.
• We use no analytics cookies and no advertising cookies.

4. Why we use it

We use your data only to provide Firaq, sign you in, keep the service secure, and contact organization admins about the service. We do not sell personal data, we show no advertising, and we do not train AI models on your data.

5. Who processes it for us

• Our hosting provider: servers, the database and backups.
• Slack, only if an organization connects it.
• Anthropic, only if an organization admin turns AI on in Settings. It is off by default. When an admin asks for the daily summary, that day's standup answers for the organization go to Anthropic to generate it. Firaq does not store the summary.
• Formspree: it receives what you enter in the waitlist and demo request forms on our website.
• Google Fonts: app pages load their fonts from Google, which sees the visitor's IP address.

6. Moving data outside Egypt

These providers process data outside Egypt. By creating an account you consent to that transfer, as Egypt's Personal Data Protection Law (Law No. 151 of 2020) requires. You can withdraw your consent at any time, as section 9 explains.

7. How long we keep it

We keep an organization's data while its account is active. We erase it 30 days after the organization closes its account (its admin emails pr@firaq.space to close it). Backups roll off on the hosting provider's schedule. We keep security logs only as long as we need them. Session records are deleted 30 days after they are created.

8. How we protect it

• Passwords are hashed with argon2id.
• Slack tokens are stored encrypted.
• Cookies are HttpOnly, and Secure in production.
• A sign-in ends after 7 days without use, or 14 days after it began, whichever comes first. Signing out, changing your password, or signing out other browsers ends the sessions you choose, and you can see and end your sessions on your account page.
• Each organization and each squad sees only its own data. We enforce this on every query.

9. Your rights

Under Law No. 151 of 2020 you can ask to know what we hold about you, get a copy, correct it, have it erased, withdraw your consent, and object to how we use it. Email pr@firaq.space. In an employer-managed organization, we may pass your request to that organization's admin, who controls the workspace.

10. Changes to this policy

We post each new version on this page with the date it takes effect. For a change that matters, we email organization admins before it applies.

11. Contact

Questions or requests: pr@firaq.space.