Privacy Policy
Last updated: October 5, 2026
This policy explains what data SRMED collects when you use our website (srmed.ai) or our mobile app, why we collect it, and what your rights are. It is written to meet the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, and it also covers the rights you have under the EU General Data Protection Regulation (GDPR) if it applies to you.
The short version: You can read SRMED without signing in. If you sign in with Google or Apple, we keep your name, your email and the choices you make in the app (topics you follow, stories you like or hide, stories you save, and what you read) so your feed follows you to every device. We show no ads, we sell no data, and we do not track you across other apps or websites. You can delete your account from the app at any time, and everything tied to it is deleted with it.
1. Who we are
SRMED is a news service operated by SRMED AI Company ("SRMED", "we"). SRMED AI Company is the controller of your personal data. For anything related to your privacy, contact support@srmed.ai.
2. Using SRMED without signing in
In the app, we create a guest profile the first time you open it. It has a random identifier and no name or email. It holds the topics you pick, the stories you like, hide or save, and your reading activity (which stories you open, how long you read, which sources you visit), so your feed works without an account. On the website, nothing is stored about you beyond the anonymous analytics described below.
If you never sign in, the guest profile cannot be connected to your name, email or any real-world identity. Deleting the app removes the identifier from your phone; inactive guest profiles are deleted from our servers.
3. Signing in
Signing in is optional. You can sign in with Google or with Apple. When you do, we receive from them:
- your name,
- your email address,
- an account identifier issued by Google or Apple.
We never receive your Google or Apple password. When you sign in, the topics, likes, hidden publishers, saved stories and reading activity from your guest profile move to your account, so you keep them.
4. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account data (signed-in readers only): name, email, Google or Apple account identifier, display language | Create and run your account, let you sign in on more devices | Contract: providing the service you asked for |
| Your choices in the app: topics you follow, stories you like or mark as not interested, publishers you hide, stories you save | Build your feed and keep it on every device | Contract |
| Reading activity: stories shown to you, opened, how long and how far you read, sources you open, shares | Rank and personalize your feed, measure which stories are useful | Legitimate interest in running a personalized news service |
| Usage events and error reports: screens you view, episodes you play and how far you listen, error messages, device type, operating system, app version | Understand which features are useful, find and fix crashes | Legitimate interest; you can turn it off (section 6) |
| Feedback you choose to send: answers to in-app surveys | Read and act on your feedback | Consent |
| Push notification token: a device token issued by Apple or Google (only if you enable notifications) | Deliver the notifications you asked for | Consent |
| Server and network logs: IP address and user agent in short-lived infrastructure logs | Keep the service secure and working | Legitimate interest |
We do not collect your location, contacts, photos, or any sensitive personal data (such as health, religious beliefs or political opinions). We do not make decisions about you that have legal or similarly significant effects based only on automated processing; personalization only changes which news stories you see first.
5. What we do NOT do
- No advertising. We show no ads and embed no advertising SDKs.
- No sale of data. We do not sell, rent, or trade your data, to anyone.
- No cross-app or cross-site tracking. We never access advertising identifiers (such as Apple's IDFA). Under Apple's App Tracking Transparency definition, SRMED does not track you.
- No session recording in the app. The app never records your screen, gestures, or typing.
- No stored IP addresses in analytics. Your IP address is discarded when analytics events arrive. Our analytics derives an approximate location (country and city) from it first.
6. Analytics
We use an analytics service to see how the app and website are used and to find errors.
- If you are not signed in, events are recorded against a random identifier created on your device.
- If you are signed in, events from the app are recorded against your account's identifier together with your email address, so we can see how signed-in readers use SRMED across devices. We do not send your name.
- In the app, turn off "Share usage data" in Settings → Privacy and no analytics events are sent from that moment. This does not change how the app works. Your reading activity (section 4) is still used to build your feed while you have a guest profile or an account.
- On the website, we use one first-party cookie holding the random identifier, and we record masked session replays (clicks, scrolling, what was on screen; anything you type is masked before it leaves your browser) to diagnose problems. No third-party or advertising cookies. You can delete or block cookies for srmed.ai at any time; the site works without them.
7. Who processes data for us
We rely on a small number of service providers ("processors"). They handle data only on our instructions, under data processing agreements:
| Provider | What they receive |
|---|---|
| A cloud database provider | Your account data, choices and reading activity — stored in the European Union (Germany) |
| A cloud hosting, content-delivery and security network | Requests to our app and website, including IP address and user agent, as part of running the service; short-lived logs |
| An analytics and error-tracking service | Usage events, error reports, survey answers, and your email if you are signed in — stored in the European Union |
| Google and Apple | Only when you choose to sign in with them, under their own privacy policies |
| Apple (APNs) and Google (FCM), via a push-delivery service (only if you enable notifications) | Your push token and the notification content |
If you want to know exactly which providers we use, email us and we will tell you. We may disclose data if a law or a competent authority requires it.
Links to other websites: SRMED stories link to the original news publishers. Once you leave SRMED, that website's own privacy policy applies.
8. Where your data lives
Your data is stored in the European Union. Our services are delivered through a global network, so data may pass through other countries, including the United States, on its way. Transfers outside the Kingdom of Saudi Arabia are made under the PDPL's rules for transfers outside the Kingdom, and only to providers that protect the data to at least the standard of this policy. Transfers outside the EU/EEA are covered by an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data, choices and reading activity | As long as you keep your account. Deleted when you delete your account. |
| Guest profiles | Until you sign in (then they move to your account) or the guest profile becomes inactive |
| Analytics events, error reports and survey feedback | Up to 7 years (our analytics provider's plan maximum), or until you ask us to delete them |
| Session replays (website only) | Up to 90 days |
| Diagnostic and infrastructure logs | Days to a few weeks |
| Push tokens | As long as you keep notifications enabled |
10. Deleting your account
In the app, go to Settings → Account → Delete account. This immediately and permanently deletes your account and everything tied to it on our servers: your name, email, sign-in identifiers, topics, likes, hidden publishers, saved stories and reading activity. You can also ask us to delete it by emailing support@srmed.ai from the email address on your account. Analytics events recorded against your account are deleted on request.
11. Your rights
Under the PDPL you have the right to:
- be informed about how and why your data is processed (this policy),
- access your personal data and get a copy of it in a readable format,
- correct data that is inaccurate or incomplete,
- have your data destroyed when it is no longer needed, or when you delete your account,
- withdraw your consent at any time where we rely on consent.
If the GDPR applies to you, you also have the rights to restrict or object to processing and to data portability.
To use any of these rights, email support@srmed.ai. We answer within 30 days. If you are not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA), or to your local data protection authority.
12. Security
Data travels encrypted (HTTPS/TLS) and is encrypted at rest by our database provider. Access to production data is limited to the people who run SRMED. If a data breach puts your rights at risk, we will notify the competent authority and you as the law requires.
13. Children
SRMED is not directed at children under 13, and we do not knowingly collect their data. If you are under 18, please use SRMED with your parent or guardian's permission. If you believe a child's data has reached us, contact us and we will delete it.
14. Changes to this policy
Changes are posted on this page with an updated date above. Material changes are announced in the app and on the website before they take effect.
15. Contact
Publishers and rights holders can use the same address to ask us to remove an image or a story. Include a link to the story and we will act on it promptly.