Privacy Policy

Last updated: August 15, 2026

1. What we store

• Account data: your username, display name, and a bcrypt hash of your password. We never store the password itself. If you provide an email address, we store it and use it only for account verification and password reset — never for marketing.
• Profile photo: if you choose to add one, it is stored with your account. You can remove it at any time in Settings.
• Learning data: lesson progress, quiz results, flashcard review history, and daily activity, so that spaced repetition and progress tracking work.
• Conversation practice: transcripts of your spoken practice sessions and their evaluation reports, so you can review past conversations.

We do not ask for or store payment details, and we collect nothing beyond what is listed above.

2. Cookies

We use a single, strictly functional cookie (arabiyyah_session) that keeps you signed in. It contains a random session token, nothing else. There are no analytics, advertising, or third-party tracking cookies, which is why the site shows no cookie banner.

3. Third parties

• Voice practice: when you start a spoken conversation on the Talk page, your microphone audio and the conversation transcript are sent to the AI provider powering the session (OpenAI or Google Gemini) for the duration of that session. This only happens when you explicitly start a conversation.
• Email delivery: verification and password-reset emails are sent through Resend, which processes your email address for delivery only.
• Quran text and recitation: Quran pages load text from the quran.com API and stream recitation audio from its servers.
• Embedded videos: some exercises embed YouTube videos. When you open a page with an embedded video, YouTube (Google) may set its own cookies and collect data according to its own privacy policy.

No other third-party services receive your data.

4. Where data lives

All data is stored in a database on our server. Encrypted backups are kept for disaster recovery and rotated automatically.

5. Your rights

You may request a copy of your data or the deletion of your account and all associated data at any time by contacting the operator (see the project repository or site footer for contact details). Deletion is permanent and removes your account, progress, and review history.

6. Changes to this policy

If we ever add features that change what data we collect, this policy and its "last updated" date will be revised before those features go live.