Privacy

dawa · last updated 2026-07-18 · back to the app

dawa is an assistant that spends your Bitcoin on real-world things, only with your confirmation. We collect the minimum needed to do that, we run no advertising trackers, and we don't sell or share personal data for advertising.

What we collect, and why

• Account: your email address (one-time login codes) or your Nostr public key. Used only to sign you in and hold your balance. Login codes are single-use, expire after 10 minutes, and are routinely purged once expired.
• Balance & transactions: your custodial balance and a ledger of payments (amounts, references, and the recipient identifiers you provide — phone numbers, meter numbers, bank accounts). Kept as financial records of the purchases you asked for.
• Chat: your conversation is processed by our AI model provider (currently OpenAI) to run the assistant. Don't put anything in chat you wouldn't send to the model provider.
• Technical: your IP address, briefly, for rate limiting and abuse prevention. Your session is one essential cookie (dawa_session).
• Preferences: theme and display currency, stored in your browser; the currency choice syncs to your account when signed in.
• Usage: anonymous, aggregate page-view counts via Vercel Web Analytics, to see which parts of the app get used. It sets no cookies and does no cross-site tracking; visits are counted with a temporary hash that is discarded within 24 hours, and it is never linked to your account, chat, or transactions. OAuth authorization pages are excluded from it entirely.

Who data goes to

Only the providers needed to complete what you asked for: the airtime/electricity provider, the cash-out provider (Mavapay), the gift-card provider (Laso), the travel data provider (StableTravel), our email delivery provider (Resend — your address, to send login codes), our AI model provider, and our hosting/database providers (Vercel — who also process the aggregate page analytics — and Neon). Each receives only what its job requires — e.g. a recipient phone number goes to the airtime provider, never to the model provider.

Cookies & signals

One strictly-necessary session cookie; no advertising storage, and our page analytics is cookieless and aggregate — it stores nothing on your device — so there is no consent banner to click. We don't sell or share personal data, so the Global Privacy Control signal is honoured by default — there is nothing to opt out of.

Your rights

Ask us to show you or delete the data tied to your account. Transaction ledger entries may be retained where financial record-keeping requires it. Contact: hello@dawabit.xyz.