Privacy Policy

What we hold and why

• Account: your email, your name and your password, kept only as a one-way hash (Argon2id). To create your account, sign you in and send you emails about it.
• Profile: your phone number, address, profile picture (stored encrypted) and language, when you add them. To show your profile and, with your agreement, share it with apps.
• Security: your second factors (the authenticator app’s secret, stored encrypted, and your passkeys’ public keys), your signed-in sessions (IP address and browser) and a cookie that recognises your device. To protect your account and tell you about sign-ins from new devices.
• Identity check: its status and result, including the name and country on your document (see the next section).
• NNWallet: your wallet’s public address and public key. Never your recovery phrase or private keys.
• Activity: a record of account events (sign-up, sign-ins, changes, security events) that can’t be edited, and which apps you opened from the store. To keep accounts safe, look into abuse and meet legal duties.

We use your data to provide the account you asked for, with the agreement you give when you sign up, to keep the service secure, and where the law requires it. We don’t sell your data and don’t use it for advertising. NN Store is for adults; we don’t knowingly hold data about children.

The identity check with Didit

Your identity is checked once, in NN Store, by Didit, our identity verification provider, and the result counts for every NNChain app. Before the check starts, we ask for your agreement.

Didit receives the photos of your document and a short selfie video, and holds them under its own privacy policy. NN Store never keeps the document images or the selfie. We keep the check’s status and Didit’s decision (stored encrypted). When Didit leaves a check for review, NN Store’s compliance staff may look at it, and every decision is recorded.

Your NNWallet is yours

NNWallet is self-custodial. Your recovery phrase and private keys are created and kept on your device, encrypted with your wallet password, and never sent to us.

We store only your wallet’s public address and public key, linked to your account by a signature from your key, so that apps can trust the address is yours. Balances and activity are read from the public NNChain network.

What apps receive

Apps in the store are independent services. Opening an app from the store gives it nothing from your account.

When apps sign you in with NN Store, each one asks for your agreement the first time and shows what it will get: your name, picture and language, your email, whether you’re verified (with the date, the level and your name as on your document) or your NNWallet address. An app never gets your document, your selfie, your password or your recovery phrase.

You can withdraw an app’s access at any time in My apps. What an app has already received is covered by that app’s own privacy policy.

Cookies and storage on your device

We use only what the site needs to work:

• a session cookie that keeps you signed in (HttpOnly: page scripts can’t read it);
• a cookie that recognises your device, for security;
• your language and theme choices;
• your encrypted NNWallet, in your browser’s storage, when you set it up on this device.

We use no advertising or analytics trackers.

Who else sees your data

• Didit, for the identity check.
• Our email provider, to send account emails from [email protected].
• Google reCAPTCHA, when it’s switched on for sign-up and sign-in, to stop automated abuse. Google’s privacy policy covers what it collects.
• Our hosting and network providers (including Cloudflare), which run and protect the service, and an error-reporting service that receives technical details when something fails.
• Apps you allow, as described above.
• Authorities, when the law requires it.

Each provider gets only what its task needs. Some may process data in other countries; we use providers that protect it and transfer data only as the law allows.

How long we keep it, and deleting your account

We keep your data while you have an account. You can delete your account at any time in Security: this removes your profile, your identity check and its result, the link to your NNWallet, your second factors and your sessions, and apps that use your account are told it’s gone.

The activity record keeps that the account existed and its events, for security and legal duties. Backups are replaced in their normal cycle. Didit keeps what it collected under its own rules, and apps you allowed keep what they received under their own policies.

Your rights

With Saudi Arabia’s Personal Data Protection Law (PDPL) in mind, you can:

• know what we hold about you and how we use it;
• get a copy of your data;
• correct it: you can change most of it yourself in your account;
• delete it: delete your account in Security, or ask us;
• withdraw your consent: for an app in My apps, or for NN Store by deleting your account. This doesn’t affect what was done before.

Write to [email protected] from your account’s email. We answer as soon as we can, within the time the law sets. You can also complain to the Saudi Data & AI Authority (SDAIA).

Security

Every account has a second factor. Passwords are hashed with Argon2id; identity decisions, profile pictures and authenticator secrets are encrypted at rest; the site uses HTTPS only; sessions end after a while without activity; and staff access is limited and recorded.

No system is perfectly secure: keep your password, second factor and recovery phrase to yourself. If a breach puts your data at risk, we’ll tell you and the authorities as the law requires.

Changes to this policy

We update this page when what we do changes, and show the date at the top. If a change matters, we tell you by email or in the store before it applies, and ask for your agreement again where needed.

Contact

Questions or requests about your data: [email protected]. NN Store (NNChain), store.nnchain.org. See also our Terms of Service.