Last updated: 6 October 2026

Privacy Policy

1. Scope

This Policy explains how WESH handles data associated with the website, app, accounts and related services. Processing is subject to applicable laws and regulations in the Kingdom of Saudi Arabia where relevant.

2. Data we may collect

We may process account data such as email, phone number when available, preferred country or market, settings, saved items, alerts and preferences, as well as technical and operational data required for security and service improvement such as device information, network address, error logs and usage data.

Signing in with Google

If you choose to sign in with Google, WESH receives from Google only your name, email address, profile picture and account identifier (the email, profile and openid scopes). We use this data only to create your WESH account, sign you in, and show your name and picture inside your account. WESH does not request access to Gmail, Drive, contacts or any other data in your Google Account. This data is stored in WESH's database hosted by Supabase; we do not sell it, share it with third parties, or use it for advertising. You can delete your account and its data from the account page or by contacting us, and you can revoke WESH's access at any time from your Google Account settings. WESH's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use data

We use data to operate accounts and sign-in, sync saved items and preferences, send account, security and requested alert messages, personalize WESH, measure and improve service performance, prevent fraud and abuse, and meet legal requirements.

"Request a code" is for signed-in members only: a request needs you to be signed in to your account. If you ask us for a code for a shop we have none for, we keep the shop name as you typed it, the market and your optional note (without links, email addresses or phone numbers), together with your account; we do not keep your network address. We use requests to learn which shops people are looking for, and the WESH team sees only the requested shops, how many requests each has and the notes with the day they were written, never who wrote them. "Email me once when a code arrives" starts selected and can be unticked before sending: we send one message to your account email when a code for that shop is published in your market, and the address is not copied into the request; if no code arrives within 90 days the request expires. That message is not used for marketing and your address is not shared with shops. You can cancel an open request under My requests, and your requests are deleted with your account. A request is not a promise that a code exists.

"Price alerts" and "New codes from shops you follow": alerts and alert e-mails are on by default for every signed-in member, and you can turn them off at any time. They are only about things you chose: products you saved, a price you set, and shops you starred. We keep your choices once you change them (alerts inside WESH, the alert e-mail, and the language of the messages), the price you set for a saved product if you set one, and a record of the alerts we decided for you (the product, the prices the alert named, when, and whether it was e-mailed) for 90 days, after which it is deleted. Your address is not copied: we write to your account's e-mail at the moment of sending, only while alert e-mails are on, and it is not used for marketing or shared with shops. You can turn alerts or the e-mail off at any time under Account > Alerts, or stop the e-mail in one click from the link in every alert e-mail, and all of it is deleted with your account. An alert tells you a price we saw; it does not mean the price will last. For "New codes from shops you follow", we use the shops you starred (Favorite) and your account's market to see when a new code appears for them, and keep the shop's name and the day of the alert in the same record - at most one alert per shop per day. A code comes from the shop or its partners, and the shop's terms apply.

"New WESH guides": when a new guide is published we add an alert about it inside WESH for every signed-in member; this is on by default and you can turn it off at any time under Account > Alerts. The e-mail about new guides is promotional, so we send it only if you turn it on yourself ("New guides by e-mail"); we keep when you did, and it stops if you turn it off, turn the alert e-mail off, or follow the stop link in any alert e-mail. We keep the guide's name and the day of the alert in the same record - one alert per guide, within the same daily limit as every alert - and it is deleted with your account.

4. Marketing messages

WESH sends a marketing message only where a consent record exists on the server. A setting switched on in the account does not by itself authorise a send: switching it on records a consent event carrying the server’s own time, the version of the disclosure text, the language, the market and the channel, and switching it off records a separate withdrawal event. A withdrawal does not erase the earlier record, because the evidence that a message was sent with consent has to outlive that consent. Users can change the choice at any time from Account > Alerts, and a withdrawal outranks any earlier consent whatever its date. Disabling marketing does not disable essential account, security, confirmation or password-recovery messages.

"The offers newsletter": you can subscribe with your e-mail address alone, without an account. We keep the address, the newsletter language, when you asked, and the version of the consent text you agreed to. Nothing is sent until you open the confirmation link we e-mail you; if you never open it, the subscription is not completed. The list is kept on WESH's own server and sent through our e-mail provider, and your address is not shared with shops. Every newsletter has a one-click unsubscribe link, and unsubscribing stops all WESH marketing e-mail to that address; an address that unsubscribed cannot be signed up again through the form. After you unsubscribe we keep a record that it stopped, so that we do not write to it again.

5. Service providers

We may use technical service providers for hosting, database, authentication, email delivery, analytics, notifications and other processing required to provide WESH. WESH uses Supabase for its database, authentication and account-feature synchronization. The WESH website uses Google Tag Manager to manage measurement tags and Google Analytics to measure visits, engagement and performance. WESH also uses Sentry to process crash and error reports for the website and app: when an error occurs, its type, technical stack trace, app version, platform and the page path without parameters are sent; this is not intended to include identifying data, and involves no advertising, no performance profiling and no session recording (Sentry privacy policy). Only data reasonably necessary for the purpose should be shared under appropriate arrangements.

6. Third-party merchants and links

When a user leaves WESH for an external merchant, website or app, that third party processes data under its own privacy policy. WESH does not control third-party privacy practices.

7. Cookies and similar technologies

The WESH web app renders Arabic text in a font bundled with the site. When it meets a character or symbol that font does not cover, the browser fetches a fallback font from Google's font servers at fonts.gstatic.com. This happens on page load and before any choice in the privacy panel. It is not measurement or advertising: it is a request for a font file, and like any request to an external server it discloses the visitor's IP address to the host of that file. No account data or user identifier is sent with it.

WESH may use browser storage, cookies or similar technical identifiers for sign-in, preferences, performance, measurement and abuse prevention depending on the platform and feature. The WESH website does not load Google Analytics or Google Tag Manager measurement tags until a visitor accepts them through the privacy panel. Visitors can decline measurement without losing access to WESH. To change the choice later: reopen the measurement options here, or use the privacy screen inside the app. Declining also clears the measurement cookies from the browser straight away.

WESH also counts, itself, how often a coupon code is copied, a shop is visited or a product is opened from the site: one number per coupon or product per day, with no account, no visitor identifier, no cookie and no IP address. The count cannot be tied to a person, so it does not wait for measurement consent.

"Visit statistics from Cloudflare": the site reaches you through Cloudflare, and we use its Cloudflare Web Analytics service to see aggregated visit numbers: how often each page is opened, which site a visit came from, and how long pages take to load. It sets no cookies, stores nothing on your device, gives you no identifier and does not track you across sites. It receives the page address, the browser type and load timings, and the IP address as any request does; we see only totals, never one person's visit. Because it identifies nobody, it does not wait for measurement consent (Cloudflare privacy policy).

"Usage statistics from PostHog": on the WESH website we use PostHog (servers in the United States) for anonymous usage statistics: which pages are opened, and a few named actions such as a search, copying a code or opening a store (with the store's name or the coupon's or product's reference, and a search's result count but not its words), without the text of what you click. It runs from the first visit without cookies and without storing anything on your device, unless you accept analytics, in which case it keeps a random identifier on askwesh.com. It does not record your session, we send it no name, e-mail or anything you type, and the IP address is not kept. If you decline or withdraw, it goes back to no cookies and what it stored is deleted (PostHog privacy policy).

"Local Umami analytics": the website, the iPhone app and the Android app are measured separately, and the events and totals are kept on a computer held by the owner, reached through a secure Cloudflare tunnel. We send the page or screen path and a few named catalogue actions, without search text, e-mail or account data. A new random identifier is made in browser memory for each page load, or in app memory for each app session, and is stored with the events in the database; no identifier stays on your device after the page closes or the app session ends. Because it uses no cookies and stores nothing on your device, it works the same whether or not you accept measurement. The referring site's origin, the language, and the browser, system and device type derived from the request are kept when available, with no geolocation and no session recording. The tunnel uses the IP address briefly to limit abuse and does not pass it to Umami. The numbers are anonymous sessions, not unique people. Events stay in the local database until the owner deletes them, and local backups are kept for 14 days.

8. Push notifications

In the WESH app for iPhone and Android a user can ask to be told when a saved product gets cheaper, or when a store they follow has a new coupon. WESH does not ask for notification permission on first launch; it asks after the user saves a product or turns an alert on. With permission, WESH stores the phone's push token (a code the service generates, which does not identify the person) against the account, and sends alerts through Google's Firebase Cloud Messaging, which hands them to the Apple Push Notification service on iPhone. An alert carries only the product name, its current price and a link inside the app. At most one alert of each kind is sent per day, and none between 22:00 and 09:00 Riyadh time. Each kind can be turned off under Account > Notifications > Alerts, or all notifications in the phone's settings. Signing out or deleting the account removes the phone's token from WESH.

9. Home-screen widgets

In the WESH app for iPhone and Android, the app keeps on the device a small copy of what the home-screen widgets show, so a widget can display it without opening the app: public offers and codes and, when the user is signed in, the names and current prices of their most recently saved products, shown only on their own home screen. The copy stays in storage shared only between the app and its widgets on that device, is sent to no one, loses the saved products when the user signs out, and is removed entirely when the app is deleted.

10. Retention

We retain data for as long as reasonably necessary to provide the service, meet the purposes described, satisfy legal requirements and maintain security, after which data may be deleted or de-identified when there is no longer a legitimate need to retain it.

11. Security

We apply reasonable technical and organizational measures intended to protect data against unauthorized access, use, alteration or disclosure. No electronic system can be guaranteed to be completely secure.

12. User choices and rights

Users can change certain account information and preferences and disable marketing messages in account settings. Privacy and personal-data requests may be sent to privacy@bohobi.me, subject to identity verification and applicable legal requirements.

13. Policy updates

We may update this Policy as the service, technology or legal requirements change. The latest update date appears at the top, and additional notice may be provided for material changes when required or appropriate.

14. Contact

For privacy and personal-data questions or requests, email privacy@bohobi.me or use the official WESH Contact page. Do not send a password, verification code or sensitive financial information.