Privacy Policy

The parent’s name and phone number, and the children’s names, school stages, grades and exam date if provided.

The parent’s email, if they add it optionally, to confirm the account and send subscription messages and reminders. Students never see their parent’s email.

The children’s answers and results in placement, lessons and the weekly test, used only to track their progress.

A record of subscription payments made on the website, if any: the transaction ID at the payment provider, the amount, the type of payment method (mada, card or Apple Pay) and the date. We never collect or store your card number.

Family data is stored on the servers of our cloud provider (Supabase) in a data centre in Frankfurt, Germany, so the parent and children can log in from more than one device.

Data travels between your device and the server encrypted, and only the app’s own server can reach the database. Passwords are never stored in plain text; the account provider stores them in an irreversible encrypted form.

Verification codes are not stored in plain text either, only an encrypted fingerprint that expires within minutes and is then deleted.

The browser keeps a session cookie to keep you signed in, valid for 30 days and cleared on logout, and a separate device cookie described under “Protecting the free trial from repeat use”. Demo mode stays on your device only and sends nothing.

Data is kept as long as the account exists, and the parent can delete it at any time as described under “Your rights”: a child’s data, or the whole account, which erases everything immediately leaving only a non-identifying deletion record for 12 months (see “Account deletion” in the Terms), plus the free-trial anti-repeat fingerprints described in the next section for the period stated there.

To stop the free trial being repeated by creating new accounts, we set a separate device cookie in your browser (not readable by pages, valid for 400 days) whose value is a random number carrying no information about you, and on our server we keep only irreversible encrypted fingerprints, never the raw values: a fingerprint of the phone number that started a trial, a trial counter per device, and, for each trial start, a fingerprint of the device and of the network range (not the IP address itself). The phone fingerprint and the device counter remain even after the account is deleted, for up to 24 months after the last trial, and are then deleted automatically; the device and network fingerprint linked to the family is erased with the account or after 90 days, whichever comes first. We use them to give one trial per phone number and at most two trials per device (siblings are welcome), and to flag suspicious patterns to the platform owner for personal review; nobody is blocked automatically. We use no browser-fingerprinting library, we do not track you outside the app, and we share this data with no one.

We use this data only to show each child’s progress, build their weekly parent report, and tailor questions and lessons to their level.

Your data is never used for advertising or commercial purposes, and is never shared with anyone other than the service providers listed under “Service providers”, and only as far as needed to run the app.

We use a text-message provider (Authentica) to send verification codes to the parent’s phone by text message only, and to send the weekly report by text message to parents who choose it; it receives only the phone number and the message text.

We use an email provider (Resend) to send account messages, and the weekly report by email to parents who choose it; it receives only the email address and the message text, and messages may pass through its servers outside Saudi Arabia.

We use a licensed payment provider (Moyasar) to process payments made on the website; card details are entered directly into Moyasar’s form and never pass through our servers, and we receive from it only the transaction ID, status, amount and method. Its handling of your data is governed by its own terms and privacy policy.

For the AI tutor “Nouf” we use the AI model provider Anthropic; it receives only the question text and the student’s message, with no name or phone number.

For Nouf’s read-aloud voice we use the voice provider ElevenLabs; it receives only the text of the question to be read.

Device notifications are delivered through the push service your browser or device uses (Google FCM, Apple, Mozilla or Microsoft, depending on the browser), as described under “Device notifications”.

These providers process data on our behalf for delivery only and may not use it for any other purpose.

After the parent confirms their email we send only essential account messages: the confirmation link, a welcome message, and subscription activation.

We also send a reminder three days before a free trial or subscription ends, and when it ends. The parent can turn reminders off at any time from the “Email & notifications” page, or remove their email from the account entirely.

The weekly report is always ready inside the app. The parent explicitly chooses (at sign-up, or later from the “Email & notifications” page) whether it also reaches them every Saturday by text message to their phone (via Authentica), by email to their confirmed address (via Resend), or inside the app only. The message carries the child’s first name, a short summary and a link that opens the report read-only without logging in for 14 days. This choice is optional and can be changed or stopped at any time by going back to “Inside the app only”.

We never send promotional messages, and we never email an unconfirmed address except for the confirmation link itself.

A parent or a student can turn on web push notifications on a specific device. They are optional and work only after you accept the permission prompt in the browser. A parent gets a notification when the weekly report is ready and when a subscription is about to end (3 days before); a student gets one for today’s task, when a friend has played their challenge, and when the Friday test starts.

For each device that turns them on we store: the device’s address at the push service and its encryption keys, the identifiers of the subscriber (account, family or child), the display language, and your choice for each notification type. We do not store the notification texts themselves.

Notifications are delivered through the push service your browser or device uses (Google FCM, Apple, Mozilla or Microsoft, depending on the browser); it receives the device address and the message encrypted with your device’s keys, and may handle it on servers outside Saudi Arabia. A child’s first name may appear on the lock screen in a parent’s notification.

To turn them off, disable them in the browser or device settings, or inside the app: the “Email & notifications” page for a parent and the “My profile” page for a student, where you can switch off each type or all notifications. A device’s subscription is deleted when you log out, when the push service rejects it as expired, and together with the account on deletion.

No family account is created and no child is added until the parent accepts these Terms and the Privacy Policy on behalf of their children.

The parent creates and controls the children’s accounts; children log in with a code handed to them by the parent.

The parent can view all of their children’s data at any time from the “My data” page.

They can also export a copy of the family’s data as a single file (including their email, if added), and fully delete any child’s data after explicit confirmation.

They can also delete the whole family account from inside the app (“My data”, then “Delete the account permanently”) after re-verifying their identity; everything listed under “What we collect” is erased immediately, leaving only the non-identifying deletion record described under “Account deletion” in the Terms and the fingerprints described under “Protecting the free trial from repeat use”.

The app keeps an internal audit log of important events, such as account creation, consent, adding children, logins and deletions, to protect the account and prove what happened on it.

This log cannot be edited, and is deleted only together with the whole account; the parent can verify its integrity from the “My data” page.

For any question about the privacy of your data: email info@rawafedalmarafeq.com or phone +966 54 424 4052.