Last updated: October 6, 2026
Developer: Mega Al-Jadida for Telecom & Technology
Package name: com.abdo.megaja
Contact email: dafabd50@gmail.com

1. Data we collect

a) App account data

• Phone number (used as your login ID) and password.
• Managed by Google Firebase Authentication. Your password is not stored by the developer or on your device; it is stored, encrypted, by Google only.

b) Telecom account data you add

• Contract number and PIN of your Mega Al-Jadida account are sent to the company's server for verification only. The PIN is never stored in the app; after successful verification we keep an access token (API key) returned by the server.
• Subscription data shown in the app (plan, balance, usage, expiry date, invoices, sessions) is requested from the company's server each time you open a screen.

c) Device identifiers and notifications

• The app generates a random identifier (UUID) locally to distinguish your device on the company's server. It contains no personal information, is not linked to any advertising ID, and is erased when you clear app data.
• To send push notifications we store your notification token (FCM token) together with your device model, Android version and app version in Firebase Firestore under your private path. It is deleted when you delete your account.

d) Crash reports

• When the app crashes, a report is saved on your device and uploaded to Firebase Firestore on the next launch. It includes the stack trace, the app's last events before the crash (no credentials), app version, Android version and device model. We use it only to fix bugs, and it is not linked to your name or contract number.

e) Location (optional)

• If you tap "My location" on the towers map, the app asks for location permission only while you are using the app, to show your position and find the nearest tower. Location is processed on your device only; it is not sent to any server and not stored. The map works without this permission, and you can revoke it at any time in your phone settings.
• Map tiles are loaded from OpenFreeMap (OpenStreetMap data) and, when satellite view is enabled, from EOX and Esri, over HTTPS. These providers may receive your IP address like any normal network request.

f) Online top-up requests and payment receipt images

• When you submit an online top-up request we collect your name, phone number, amount, contract number and the transaction's reference number, and store them to process and follow up the request. We do not collect payment card data.
• If you choose to attach a payment receipt image, the image you select is uploaded to Cloudinary (a third-party image hosting service) and its link is attached to the top-up request. We do not access your photo gallery beyond the single image you choose for this purpose.
• These requests and images are deleted when you delete your account (see Section 5).

g) What we do not collect

We do not collect: contacts, microphone, camera, call logs, messages, advertising ID, or any analytics or advertising tracking data, nor any photos or files other than the payment receipt you upload yourself. There are no ads in the app, and we do not sell your data to anyone.

2. How data is stored

Account and session files are excluded from Google cloud backup (backup_rules.xml / data_extraction_rules.xml) so they are not transferred to any other device.

3. Permissions and why we need them

• INTERNET and ACCESS_NETWORK_STATE: fetch your subscription data and detect connection status.
• POST_NOTIFICATIONS: alert you before your subscription expires (3 days), about low balance, and admin messages. You may deny it; the app works normally without it.
• ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION: optional, to show your position and the nearest tower on the map (see 1-e). Not used in the background.
• RECEIVE_BOOT_COMPLETED: re-show the subscription status notification after the phone restarts.
• WAKE_LOCK and VIBRATE: used by the system to run background updates and alert you with notifications.

4. Data sharing

Data is shared with three parties only, to the extent needed to provide the service:

1. Mega Al-Jadida Telecom server — to carry out your account operations (verification, renewal, card top-up, plan change, loan).
2. Google Firebase (Authentication + Firestore) — as hosting and authentication provider. See: https://firebase.google.com/support/privacy
3. Cloudinary — only to host the payment receipt images you upload with top-up requests. See: https://cloudinary.com/privacy

The map services mentioned in 1-e may also receive your IP address when loading tiles. We do not sell your data or share it for advertising purposes.

5. Retention and deletion

• Account data on Firestore is kept until you delete your account from within the app.
• Removing an added subscription account from the app deletes both its local copy and its Firestore copy.
• Deleting your app account and all its data: in the app go to Settings → Delete account (this deletes added subscription accounts, notification tokens, top-up requests, receipt images from Cloudinary, and your Firebase user). If you cannot open the app, request deletion from the account deletion page or by emailing support; it is carried out within 30 days.
• Crash reports are not linked to your identity (they contain neither your ID nor your contract number), so they are not deleted with the account.
• Clearing app data in your phone settings immediately erases everything stored locally.

6. Children

The app is intended for internet service subscribers (18+) and is not directed to children under 13, nor does it knowingly collect their data.

7. Security

We use local encryption (AES-256) for sensitive data on the device and strict security rules on Firestore. Even so, no method of electronic transmission or storage is 100% secure.

The app's connections to Firebase, the map service and the speed test use encrypted HTTPS. The connection to the Mega Al-Jadida server (contract number, PIN and account data) currently uses unencrypted HTTP, which means someone able to monitor the network you are connected to (such as public Wi-Fi) may be able to read this data. We advise avoiding the app on untrusted public networks until encryption is enabled on the server.

8. Changes to this policy

Any change will be published at the same link with the "Last updated" date above revised.

9. Contact

For questions or data deletion requests: dafabd50@gmail.com — WhatsApp: 0925914657