Privacy Policy
What data Fasaha collects, why it is used, which services process it, how long it is kept, and how to delete your account.
October 4, 2026
Fasaha ("we", "us") is an AI-powered Arabic learning platform available globally through our mobile apps and fasaha.app. This policy explains what data we collect, why, who helps us process it, and how you stay in control.
Applies to: Fasaha iOS/Android apps, fasaha.app, and support channels. Schools or enterprise customers may have supplemental agreements provided by their administrator.
1. Controller & Contact
Data controller
Fasaha controls personal data for our consumer services. When delivered through a school or employer, that organization may act as joint controller.
How to reach us
Email fasaha.app@gmail.com for any privacy question. EEA/UK users: add "GDPR" to the subject line. We respond within 30 days.
2. Data We Collect
We collect only what is needed to deliver lessons, meet legal obligations, or improve the product. Decline optional collection via in-app settings or device permissions.
Account data
Name, email, auth tokens, language preferences, timezone, and profile photo. Passwords are hashed—never stored in plaintext.
Learning activity
Lesson progress, streaks, quiz scores, dictionary lookups, translations, and prompts sent to AI tutors.
Audio recordings, speech transcripts, or camera input when you use pronunciation or scanning features. Recordings stay on-device when possible; uploads occur only when you initiate scoring or sync.
Sensitive data (CCPA 2026)
Voice biometrics derived from pronunciation practice are treated as sensitive personal information. We do not collect neural data (brain-wave or nervous-system signals). If we ever do, we will obtain explicit opt-in consent first.
Purchases
Subscription tier, trial dates, store receipts, and anonymized RevenueCat IDs. Apple/Google process payments; we receive only transaction tokens.
Device & diagnostics
Model, OS, app version, locale, crash logs, and (if enabled) ad identifiers for debugging and platform compliance.
Approximate location from IP/timezone to localize content and display correct legal terms.
In-app analytics
Our iOS and Android apps send product analytics to Firebase Analytics (Google) and PostHog. Events describe what happened — a lesson opened, a word looked up, a paywall shown — alongside device model, OS, app version, language, and approximate location derived from your IP address.
We do not send your name, email, or account ID, and we do not send Arabic text, translations, saved notes, or anything you type into search. Events reach PostHog under a random per-install identifier that is never linked to your account, and PostHog stores them in the European Union. We do not record your screen: session replay is switched off.
Cookies
Essential cookies for language prefs; optional Vercel Web Analytics running cookieless by default (no third-party ads). We do not load it when your browser signals Global Privacy Control or Do Not Track.
3. How We Use Data
Deliver & personalize
Sync lessons and progress across devices via Supabase/Firebase. Surface weak vocabulary. Provide AI tutoring and speech feedback through vetted APIs (e.g., Google Cloud Speech). Prompts are pseudonymized and blocked from training public models unless you opt in.
Communicate
Service messages, security alerts, study reminders, and marketing (unsubscribe anytime). Push notifications are opt-in via device settings.
Improve & protect
Aggregate de-identified metrics for product decisions, A/B tests, and fraud detection.
Legal compliance
Enforce Terms of Service, respond to lawful requests, maintain audit trails required by education and consumer-protection laws.
4. Automated Decision-Making
Effective January 2026, California requires disclosure of automated decision-making technology (ADMT). Here is how Fasaha uses it:
Adaptive learning
Algorithms adjust lesson difficulty based on your quiz performance and time spent. You can reset adaptive settings in Settings → Learning.
Speech scoring
AI models grade pronunciation. Scores influence practice recommendations but do not restrict access to content.
Fraud detection
Automated systems flag suspicious account activity (e.g., abnormal streaks). Flagged accounts are reviewed by a human before any action is taken.
Your rights
California residents may request information about ADMT logic, opt out of certain profiling, and access outputs. Email fasaha.app@gmail.com with subject "ADMT Request".
5. Legal Bases (EEA/UK)
Contract – account, progress, and payment data needed to deliver the service.
Legitimate interests – diagnostics, analytics, safety monitoring, limited marketing to existing users.
Consent – push notifications, marketing emails, non-essential cookies, research programs.
Legal obligation – tax records, anti-fraud logs, platform reporting.
6. When We Share Data
Service providers
Infrastructure (Supabase, AWS, Google Cloud), auth/media (Firebase, Expo), analytics (Vercel Web Analytics + Speed Insights—cookieless, no PII; PostHog for in-app product analytics, hosted in the EU), payments (RevenueCat, Apple, Google), communications (Expo Push, support inbox).
All have signed DPAs; sub-processing is restricted; security audited annually.
Community features
Joining challenges or sharing vocab lists makes your display name, avatar, and shared content visible to participants. Delete anytime from the relevant screen.
Business transfers
In a merger, acquisition, or bankruptcy, data transfers to the successor under this policy. We may also disclose to comply with law or protect users.
With consent
We ask explicit permission before sharing data with research partners, featuring testimonials, or enabling SSO integrations.
YouTube API Services
We use YouTube API Services in two places. Our website can play YouTube videos in an embedded player, and one internal tool manages Fasaha’s own YouTube channel (the titles, descriptions, thumbnails, captions and playlists of the videos we publish). Only Fasaha staff use that tool, and it signs in only to Fasaha’s own channel. It does not access, collect, store or share information about app users, website visitors or other YouTube users; the only thing it stores is the authorization for our own channel, kept on our own device.
YouTube’s services are governed by the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://www.google.com/policies/privacy). When you play an embedded video, YouTube may collect data under those terms. Access granted to an app through a Google Account can be reviewed and revoked on Google’s security settings page (https://security.google.com/settings/security/permissions).
7. International Transfers
Primary storage is in the United States. Cross-border transfers rely on Standard Contractual Clauses or equivalent mechanisms. Data is encrypted in transit and at rest.
8. Retention & Deletion
Account data: retained while active; deleted after 24 months of inactivity (two reminder emails sent first).
Learning artifacts (audio, transcripts, dictionary history): clear anytime via Settings → Privacy.
Server logs: up to 12 months. Purchase records: as required by tax law.
9. Security
TLS encryption, role-based access, secret scanning, routine pen-tests. We maintain incident-response playbooks and notify regulators/users of breaches as required.
10. Your Rights
Access, portability, correction, deletion
Download learning history, update profile, or delete account in Settings → Account. Need help? Email fasaha.app@gmail.com.
Marketing & cookies
Every marketing email has an unsubscribe link. We currently use essential cookies only and honor Global Privacy Control (GPC) signals.
US state privacy rights (2026 update)
Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia can: know what data we hold, correct it, delete it, obtain a copy, and opt out of "sale" or "sharing" for targeted ads.
Fasaha does not sell personal data. To submit or appeal a request, email fasaha.app@gmail.com. We will verify identity and respond within the statutory period (usually 45 days).
Universal opt-out
Our apps and site detect GPC browser signals. When detected, we automatically treat it as an opt-out of sharing for cross-context behavioral advertising.
11. App Store Disclosures
Our App Store Privacy Nutrition Label and Google Play Data Safety form list each data type, purpose, and linkage to identity—synced with this policy before every release.
The app includes a link to this policy in Settings → Privacy (required under CCPA 2026 for mobile apps).
Permissions (microphone, camera, speech recognition, notifications, media library, motion) are requested just-in-time and revocable in device settings.
12. Children & Age Verification
Minimum age
Fasaha is for learners 13+. We do not knowingly collect data from children under 13 without verifiable parental consent. If discovered, such data is deleted immediately.
Under-16 protections (CCPA 2026)
For users under 16, we obtain opt-in consent before any "sale" or "sharing" of personal information. In practice, Fasaha does not sell data, but we implement this safeguard as required.
Age signals
We may use platform-provided age-signal APIs (Apple/Google) to apply appropriate protections per App Store Accountability Acts (TX, CA, LA, UT).
13. Policy Changes
We update this policy for new features, processors, or regulatory changes. Material updates are announced via in-app notice or email at least 15 days before taking effect.