This policy describes what Sira Nabawiya stores, why, and who else touches it. It is written to match what the software actually does.
Collected when you create an account:
| Email address | Your identifier, and where one-time sign-in codes are sent. Required. |
|---|---|
| Name | Shown on your profile and to friends you add. Required. |
| Date of birth | Optional. Used to tell adult and younger accounts apart. |
| Phone number | Optional. Only stored if you provide it. |
| Profile picture | Optional. Stored on Cloudflare R2 and served from a public URL. |
Created as you use the app: lessons read and completed, quiz attempts and scores, flashcard review history, bookmarks, XP, level, streaks and daily activity. This is what makes progress, review scheduling and streaks work.
If you send or accept a friend request, we store the link between the two accounts. Your name, profile picture and progress figures are visible to accounts you are connected to.
If you allow notifications, we store a device push token so reminders can reach your device. Revoking the permission stops this; the token is removed when the device unregisters.
Purchases are made through Apple's App Store or Google Play — we never see your payment details. We store the purchase receipt and its status so the app knows what your subscription entitles you to.
Server logs record request paths, timestamps and IP addresses, and IP addresses are used for short-lived rate-limit counters that protect sign-in and uploads from abuse.
We use these providers. They process data on our behalf and do not use it for their own purposes.
| Amazon Web Services | Application server, database and outbound email (SES). Data is held in the US East (N. Virginia) region. |
|---|---|
| Cloudflare | Image and media storage (R2) and DNS. |
| Vercel | Hosts this website and our internal admin dashboard. |
| Expo | Delivers push notifications to your device. |
| Apple and Google | Process payments and let us verify a purchase is genuine. |
The app is intended for a general audience and may be used by younger learners, which is why date of birth is recorded when given. We do not knowingly collect more from a young user than from anyone else, and there is no advertising or behavioural profiling in the app for any age. If you believe a child has provided information you would like removed, contact us and we will remove it.
Account and learning data is kept while your account exists. Rate-limit counters expire within minutes. Server logs are retained on the server and rotated. Purchase records may be kept longer where a tax or accounting obligation requires it.
Traffic is encrypted in transit with TLS. The database is not reachable from the internet. Passwords are stored hashed, and sign-in codes are single-use and expire.
If this policy changes materially we will update the date above and, where the change affects you, tell you in the app.