Privacy Policy

Mobdla · Last updated 11 October 2026

This policy explains what the Mobdla app and website collect, what we use it for, who sees it, and how you control it. It describes only what the app actually does.

1. What we collect

• Mobile number — to sign you in with a code sent in a WhatsApp message, and as your account's identity. If WhatsApp sending fails, we may use an SMS fallback for Egyptian mobile numbers only.
• Name — shown to the people you swap with.
• Email, address, governorate and city, profile photo — if you choose to add them.
• Your properties: type, location (governorate, city, district, compound, and street address if you enter it), area, price, rooms, finishing, instalment details, description, photos and videos, and ownership papers if you upload them.
• Your requests: what you are looking for, budget, specifications.
• Verification documents you upload, such as an ID card.
• Conversations: your messages and attachments with the Mobdla team — support conversations, and a conversation of your own about each swap. And the conversations you had with the other side of a swap before they went through Mobdla, which are now read-only.
• Reports and blocks you make.
• Technical data: IP address and device or browser type in server logs; the session data that keeps you signed in on your device; and a copy of what you last opened in the app (properties, requests, matches, conversations, notifications) so that you can see it without internet — it stays on your device and is deleted when you sign out.
• Phone notifications — in the app, if you allow notifications: a token Google gives your phone so a notification can reach it (Firebase Cloud Messaging), the app's language, and your notification settings on that phone. It is deleted when you sign out on that phone, sign out of every device, or close your account, or when Google says it no longer works (for example when you uninstall the app).
• Your approximate location — in the app if you allow it, and on the website if you press «Sort by nearest» and allow it in your browser: used on your device only, to show how far a property is from you and to put the nearest units first. It is never sent to us or to anyone, and never stored.

Mobdla marketing messages (SMS and email): If you have a property on Mobdla and have not added a request, Mobdla’s team may send you an SMS to your mobile and an email to your registered address with your name, your property’s type and place, the number of units and requests in its city, and a link to add your request. We do not send the same message more than once every two weeks. Every message carries a link that stops Mobdla’s marketing messages, and you can also switch them off under «Marketing» in your account; once off, no marketing message reaches you until you switch it on yourself. Messages your account needs (such as the sign-in code) still reach you. We record that a message was sent and when its link was opened, not the message’s text.

Analytics and marketing tracking: Mobdla uses first-party operational analytics on its own servers to understand the product journey and improve the service. On the website only, if you explicitly choose “Allow marketing tracking”, we run Meta Pixel. When it runs, Meta receives technical data inherent to the browser request such as IP address, browser type and the current page URL after Mobdla screens the query for values that look like a mobile number, email address or sensitive identifier, plus general journey events and campaign identifiers such as UTM. Your choice is optional and can be withdrawn at any time from Privacy & Security or marketing tracking settings. Mobdla keeps a first-party technical consent/withdrawal record for three years from the latest choice for accountability: a session identifier, the internal account identifier when signed in, the time of the choice, and the consent-notice version; the consent record contains no phone number or email address. Mobdla does not send Meta your phone, email, address, property content, documents or conversation content through the Pixel. With the same consent, Mobdla’s servers tell Meta (through the Conversions API) when you complete your account, add a property, make a request, become ready for matching or send a swap offer: the event’s name and time, the IP address and browser type, and Meta’s own browser identifiers (_fbp and _fbc) — never your phone, email, name, account number or any detail of the property or request, not even in hashed form. This happens from the website only, never from the mobile app, and stops as soon as you withdraw consent.

2. What we use it for

• Running the service: showing your properties, suggesting swaps, conversations, notifications.
• The matching system automatically compares your properties and requests with other people's to suggest swaps. A suggestion is only a suggestion; no decision is made for you.
• Reviewing every new property before it appears on the market: Mobdla's team reads its details, description and photos, and writes you the reason if it does not accept it.
• Verifying identity and ownership when you upload documents.
• Safety: handling reports and blocks, preventing fraud and abuse, protecting accounts.
• Answering support requests.

3. Who sees your data

Other users

They see your name, profile photo if any, verification badge, your governorate and city if you entered them, and the details of your listed properties (once Mobdla's team has approved them) without the full address. Your mobile number, email and address, and your property's full address are not shown to any other user — not even someone you have a swap offer with.

The Mobdla team

The two sides of a swap do not talk to each other directly: each deals with the Mobdla team in a conversation of their own, which the other side does not see. The team sees your account details and your conversations with it, and passes to the other side only what the swap needs — a viewing time, a document, a question — never your number or contact details.

Companies that run the service for us

• Railway — server and database hosting, in the European Union (Netherlands).
• Supabase — photo and file storage, in the European Union (Germany).
• Meta (WhatsApp Cloud API) — sends your sign-in code in a WhatsApp message; receives your number and the sign-in code as an authentication-template parameter so it can deliver the message through WhatsApp.
• Meta Pixel — on the website only and only after you allow marketing tracking: receives general journey events and campaign identifiers such as UTM values for campaign measurement and retargeting. We do not send contact details or property/document/conversation content through the Pixel.
• Meta Conversions API — with the same website marketing consent: Mobdla’s servers tell Meta five steps (account completed, property added, request made, ready for matching, swap offer sent) with their time, the IP address, browser type and Meta’s browser identifiers, for campaign measurement. Never your phone, email, name, account number or property/request details. Meta may process this data outside Egypt.
• Brand Encode — sends an SMS fallback for Egyptian mobile numbers only when WhatsApp sending fails; receives the mobile number and message containing the sign-in code to send that SMS. Also Mobdla’s marketing SMS (unless you switched them off): receives the mobile number and the message.
• Anthropic — when the AI support assistant is on: the written messages of your conversation with the Mobdla team (support, or a swap's conversation) and a summary of your account (your name, and your properties, requests and offers without addresses), to write a reply. It never receives your number, your files, or the other side's account details.
• Sentry — when error reporting is on: technical details of an error, with personal data removed before sending.
• OpenStreetMap — when you open a map, your device loads its images from their servers, which see your IP address. To place an area on the map, our server sends them only the area's name (compound, city or governorate) — never your address.
• Google (Firebase Cloud Messaging) — if you allow notifications in the app: delivers them to your phone. It receives your phone's notification token and the notification's text, which says only what happened (such as “A new swap offer”) — no property, price, name or message text. Google may process this outside Egypt.

We may disclose data where the law requires it. We do not sell your data.

4. Where it is stored

Core app data is stored in the European Union (the Netherlands and Germany) — outside Egypt — with Railway and Supabase. Other service providers may process data in other countries according to their infrastructure and privacy terms.

5. How long we keep it

For as long as your account is open. When you close it:

• Deleted immediately: your name, number, email, address and profile photo; your verification documents; your property photos, videos and ownership papers, from storage; the properties and requests that are not part of anyone else's swap; notifications, favourites and blocks; every signed-in device.
• Kept, and why: completed swaps and their records; a property's or request's details where they form part of another person's swap record (without the address, description, photos, papers or instalment details); the old conversations you had with the other side of a swap, because they are entitled to keep them — you appear as “deleted user”; your conversations with the Mobdla team (support and swap conversations) and reports, as the company's record.
• Offers still waiting for an answer, or accepted but not completed, are cancelled, so nobody is left waiting.
• Backups are taken daily and the last 14 are kept, so deleted data leaves the backups within about two weeks.

6. Security

• Connections to the app and the website are encrypted (HTTPS).
• Identity documents and ownership papers are kept in private storage, reachable only through a link that stops working after five minutes.
• We store no passwords; you sign in with a code sent to your phone in a WhatsApp message, or an SMS fallback for Egyptian mobile numbers only if WhatsApp sending fails.
• You can sign out every device from your profile.
• Anyone on our team has to sign in, with a role that allows it, to see any data.

7. Your rights

• See and correct your data from your profile.
• Close your account and erase your data in the app (Profile → Delete my account) or from the account deletion page.
• Withdraw consent, object to a use of your data, or ask for a copy of it: privacy@mobdla.com.
• If you have a data-protection complaint, you can contact us first at the same address, and you also have the right to complain to the Personal Data Protection Center (PDPC).

8. Who the service is for

Mobdla is for adults who are legally able to deal in property. It is not directed at children.

9. Changes

If we change anything material in this policy, we will tell you in the app before the change takes effect.

10. Contact

Questions about your data: privacy@mobdla.com · Support: support@mobdla.com