Privacy Policy · daynight

1. Summary

We collect the minimum personal data needed to find you an activity in Sharm El Sheikh, send you tickets, get you picked up from your hotel and let you pay for it. We do not sell your data to anyone. We do not store your card number — that lives with our payment provider. You can delete your account and ask us to erase your data once any upcoming trip is cancelled or over — see Delete your account.

2. Who controls your data

The data controller is Folman Application LLC (commercial register 286182, tax registration 773993355), the owner, publisher and developer of the daynight app, operating from Cairo, Egypt. See our company information. Contact details:

Privacy queries: legal@daynighteg.com
Security incidents: legal@daynighteg.com
Postal: H1 Office, Building 52, Main Aviation Street, opposite the Health Insurance Hospital, Rabaa El-Adaweya, First District, Nasr City, Cairo, Egypt

3. What we collect

Account & profile

Name, email and phone number you provide when signing up.
Profile photo, language preference and home country (optional).
Apple ID or Google ID if you sign in with those.

Booking & activity

The pickup point you set for each activity: your hotel or address, your room or apartment number (optional) and its place on the map.
A contact phone number for the booking.
For each guest: their full name, nationality (optional) and a photo of their ID card or passport.
Number and ages of guests, dietary needs, accessibility notes.
Booking history, ratings, reviews and messages with operators.

Help & Support

The messages you and our team exchange when you contact us in the app, and the booking they are about.
The email address and phone number to reach you on, and your app version, platform and language — so we can reply and look into a problem without asking.

Partner applications

If you apply to list your business on daynight through the form at daynighteg.com/partners, we keep the details you send us: your business name, your name, your phone or WhatsApp number, your email, your website or Instagram, what you run, where in Sharm, your message, the language and page you applied from, how you reached our site (for example a QR code or a search engine), and when you agreed to be contacted. We use them only to contact you about listing your business. They go to our team's inbox, and a short notice with your business name, what you run, the area, the language, the page you applied from and any campaign that brought you there is posted to our team's internal Discord channel (Discord Inc., United States); your name, contact details and message are not. We do not keep your IP address with your application. Applications we decline, and submissions our spam filter catches, are deleted after 12 months. For partner applications, this paragraph adds to sections 4 (why we use it), 8 (third-party services), 10 (how long we keep it) and 12 (international transfers) below. To see, correct or delete your application, email support@daynighteg.com and include your reference (it starts with “P-”).

Device & usage

Device type, OS version, app version, language locale, IP address.
Crash reports and basic analytics about which screens you use.
On the website, only if you accept the cookie banner: the pages you visit, the link or campaign that brought you there, which app-store, trip and call-to-action links you click, which trip pages you open, whether you sent a partner application (never what it said), your browser and device type, and an approximate location Google derives from your IP address, measured with Google Tag Manager and Google Analytics (Google Analytics then sets cookies). Before you answer, and if you decline, they are not loaded and the website sends Google none of this. Whatever you answer, the link or campaign that brought you there is kept in your browser for one visit, and if you follow our Google Play link, Google Play receives it as part of that link. See our Cookies Notice.
In the app, only if you allow ad measurement: the app activity and device details listed in §8, which the app shares with Meta.
Push notification tokens (FCM on Android, APNs on iOS).

Location

Approximate location to suggest nearby activities, only while the app is open and only with your explicit permission. We never sell or share your real-time location with vendors, advertisers, or anyone else.

4. Why we use it

To take, confirm and fulfil your bookings.
To arrange hotel pickup with the activity operator.
To translate the experience into your chosen language.
To send you tickets, receipts and reminders.
To keep daynight working — fixing bugs, blocking abuse, paying tax.
To follow up on a complaint, refund or accident report.

5. Legal basis (PDPL Art. 2 & Art. 4)

We process your data on one of these grounds, never more than needed:

Your explicit consent — for marketing emails, location access, and any optional profile info, and on the website for measurement with Google Tag Manager and Google Analytics, which never runs without it, and, in the app, for sharing app activity with Meta to measure our ads, which never starts unless you allow it. You can withdraw at any time from Settings → Privacy, with “cookie settings” at the bottom of any page of daynighteg.com, or by emailing us.
Contract performance — to give you the activities, tickets and payouts you booked.
Legal obligation — Egyptian tax, anti-fraud and consumer-protection laws.
Legitimate interest — diagnostic logs, fraud prevention and platform integrity, balanced against your rights.

Only the parties who actually need each piece, only for what's listed:

Activity operators — the operator running your activity gets what it needs to deliver it: each guest’s name, nationality and ID or passport photo, the booking’s contact phone number, the pickup point (hotel, room and place on the map), the tickets you booked and any notes you add. They get this for every booking, including when daynight arranges the transport. They can view ID photos only for their own bookings, only from when you book until the day after the trip, and every view is logged. They are bound by a written data-processing agreement.
Drivers / pickup partners — your name, the pickup point and pickup time, and the booking’s contact phone number so they can reach you at pickup.
Our payment provider — your card details to take payment; see §7.
Cloud and analytics providers — see §8.
Meta (Facebook and Instagram) — only if you allow it in the app: the app activity and device details listed in §8, for ad measurement.
Authorities — only when compelled by Egyptian law or a court order, and only the data specifically required.

We do not sell, rent or trade your personal data with advertisers, brokers or marketing networks.

If you allow it in the app, we do share the app activity listed in §8 with Meta so that we can measure how our own ads perform. That is measurement, not a sale, and it never includes your name, email address or phone number.

If you accept the cookie banner, we use Google’s measurement tools on the website to see which pages and links bring people to daynight. That is measuring our own reach, not selling your data: we do not give Google or anyone else your name, email address or phone number for this, and the website loads no advertising tags. See our Cookies Notice.

7. Payment data

Card payments are processed by a licensed payment service provider certified to PCI-DSS. When you pay:

Your card number, CVV and PIN are entered into the provider's secure form, never our app.
They are PCI-DSS compliant; payment is authorised through 3-D Secure.
We receive a token and the last 4 digits, only for receipts and refunds.
Refunds always go back to the original card and currency.

The provider is the controller for your card data and handles it under its own privacy policy. If a charge looks wrong, contact your bank and us in parallel.

8. Third-party services

We use a small number of vendors. Each is contractually limited to the data and purpose listed:

Apple — Sign in with Apple, push notifications (APNs), App Store payments.
Google — Sign in with Google, Firebase Cloud Messaging, Play Store payments.
Our payment provider — card payment processing (see §7).
Google (Tag Manager, Analytics) — website visit measurement, loaded only after you accept the cookie banner: not before you answer, and not while your answer is decline (see the Cookies Notice).
Meta Platforms (Facebook, Instagram) — ad measurement in the mobile app, only if you allow it: on iPhone, only if you choose Allow when Apple’s tracking prompt asks; on Android, only if you tap Allow in the app’s one-time question. Until then, and if you say no, the app does not start Meta’s software and sends Meta nothing. If you allow it, the app sends Meta which trips you view, when you start or finish a booking and what it cost, when you create an account (the fact only), basic device details (phone model, system version, language, time zone, carrier, screen size) and your device’s advertising ID when your phone allows it. Meta uses this to report on our ads and to find more people like our travellers, under its own privacy policy. We never send your name, email address, phone number, documents or messages. You can switch it off any time in the app under Settings → Account → Ads & measurement, or on iPhone in the phone’s Settings → daynight → Allow Tracking.
Mailtrap — transactional email delivery (verifications, receipts).
Microsoft Azure / SQL Server — hosting, database, backups within the EU/EEA region.
Crash reporting — anonymised stack traces, no personal data.

9. Your rights under PDPL

Egypt's Personal Data Protection Law (Law No. 151 of 2020) gives you the following rights, free of charge:

Access — ask for a copy of your personal data.
Correction — fix anything inaccurate or incomplete.
Erasure — delete your data, subject to legal hold and to any upcoming trip being cancelled or over.
Withdrawal of consent — at any time, by email or in-app (for ad measurement, in Settings → Account → Ads & measurement), and for the website’s measurement with “cookie settings” at the bottom of any page (Google’s measurement tools then stop, and the site deletes their cookies).
Objection & restriction — to specific kinds of processing.
Notification of breach — if your data is involved in an incident.
Complaint — to the Egyptian Personal Data Protection Center.

Email legal@daynighteg.com and we'll reply within 30 days.

10. How long we keep it

Account data — until you delete the account, then 30 days for backups.
Booking + payment records — 7 years (Egyptian tax law).
ID and passport photos — deleted 90 days after the trip date, for every booking, whether or not the trip went ahead. The rest of the booking record is kept as above.
Help & Support conversations — kept as a record of what we told you. If you delete your account, the email address and phone number saved with them are removed.
Diagnostic logs — 90 days.
Website measurement, only if you accepted it — Google Analytics keeps visit- and user-level data for 14 months (our retention setting). Its cookies stay on your device for up to 2 years, unless you clear them or change your answer to decline (the site then deletes them).
App ad measurement, only if you allowed it — what the app already sent Meta stays with Meta under its own retention rules; switching it off stops anything further from being sent but does not recall it.
Marketing email opt-ins — until you unsubscribe.

11. Security

Data in transit is encrypted with TLS 1.2+. Data at rest in our database is encrypted with AES-256. Passwords are hashed (bcrypt). Access to production data is limited to a small named on-call team and audited monthly. We disclose breaches to affected users and the Egyptian Personal Data Protection Center within 72 hours of confirming them.

12. International transfers

Some of our processors run in the EU/EEA (e.g. Microsoft Azure West Europe). If you accept measurement on the website, Google may process that data in the United States and other countries. If you allow ad measurement in the app, Meta may process that data in the United States and other countries. Any transfer outside Egypt happens under standard contractual clauses or an equivalent legal mechanism approved by the PDPL.

13. Children

daynight is not directed to anyone under 13. We don't knowingly collect personal data from children. If you think a child has signed up, email us and we'll erase the account.

14. Changes

If we make a material change we'll notify you in the app and by email before it takes effect. Minor edits will be reflected in the “Effective” date at the top of this page.

15. Contact us

Privacy questions, data requests, complaints — email legal@daynighteg.com. For anything else there's support@daynighteg.com.