Privacy Policy

1. Controller & Contact

Data controller

Fasaha controls personal data for our consumer services. When delivered through a school or employer, that organization may act as joint controller.

How to reach us

Email fasaha.app@gmail.com for any privacy question. EEA/UK users: add "GDPR" to the subject line. We respond within 30 days.

2. Data We Collect

We collect only what is needed to deliver lessons, meet legal obligations, or improve the product. Decline optional collection via in-app settings or device permissions.

Account data

Name, email, auth tokens, language preferences, timezone, and profile photo. Passwords are hashed—never stored in plaintext.

Learning activity

Lesson progress, streaks, quiz scores, dictionary lookups, translations, and prompts sent to AI tutors.

Audio recordings, speech transcripts, or camera input when you use pronunciation or scanning features. Recordings stay on-device when possible; uploads occur only when you initiate scoring or sync.

Sensitive data (CCPA 2026)

Voice biometrics derived from pronunciation practice are treated as sensitive personal information. We do not collect neural data (brain-wave or nervous-system signals). If we ever do, we will obtain explicit opt-in consent first.

Purchases

Subscription tier, trial dates, store receipts, and anonymized RevenueCat IDs. Apple/Google process payments; we receive only transaction tokens.

Device & diagnostics

Model, OS, app version, locale, crash logs, and (if enabled) ad identifiers for debugging and platform compliance.

Approximate location from IP/timezone to localize content and display correct legal terms.

In-app analytics

Our iOS and Android apps send product analytics to Firebase Analytics (Google) and PostHog. Events describe what happened — a lesson opened, a word looked up, a paywall shown — alongside device model, OS, app version, language, and approximate location derived from your IP address.

We do not send your name, email, or account ID, and we do not send Arabic text, translations, saved notes, or anything you type into search. Events reach PostHog under a random per-install identifier that is never linked to your account, and PostHog stores them in the European Union. We do not record your screen: session replay is switched off.

Cookies

Essential cookies for language prefs; optional Vercel Web Analytics running cookieless by default (no third-party ads). We do not load it when your browser signals Global Privacy Control or Do Not Track.

Our website also sends anonymous page and button events, with approximate location derived from your IP address, to PostHog in the European Union. It sets no cookie and stores nothing on your device, so separate visits are not linked, and it does not run when your browser signals Global Privacy Control or Do Not Track.

3. How We Use Data

Deliver & personalize

Sync lessons and progress across devices via Supabase/Firebase. Surface weak vocabulary. Provide AI tutoring and speech feedback through vetted APIs (e.g., Google Cloud Speech). Prompts are pseudonymized and blocked from training public models unless you opt in.

Communicate

Service messages, security alerts, study reminders, and marketing (unsubscribe anytime). Push notifications are opt-in via device settings.

Improve & protect

Aggregate de-identified metrics for product decisions, A/B tests, and fraud detection.

Legal compliance

Enforce Terms of Service, respond to lawful requests, maintain audit trails required by education and consumer-protection laws.

4. Automated Decision-Making

Effective January 2026, California requires disclosure of automated decision-making technology (ADMT). Here is how Fasaha uses it:

Adaptive learning

Algorithms adjust lesson difficulty based on your quiz performance and time spent. You can reset adaptive settings in Settings → Learning.

Speech scoring

AI models grade pronunciation. Scores influence practice recommendations but do not restrict access to content.

Fraud detection

Automated systems flag suspicious account activity (e.g., abnormal streaks). Flagged accounts are reviewed by a human before any action is taken.

Your rights

California residents may request information about ADMT logic, opt out of certain profiling, and access outputs. Email fasaha.app@gmail.com with subject "ADMT Request".

5. Legal Bases (EEA/UK)

Contract – account, progress, and payment data needed to deliver the service.

Legitimate interests – diagnostics, analytics, safety monitoring, limited marketing to existing users.

Consent – push notifications, marketing emails, non-essential cookies, research programs.

Legal obligation – tax records, anti-fraud logs, platform reporting.

6. When We Share Data

Service providers

Infrastructure (Supabase, AWS, Google Cloud), auth/media (Firebase, Expo), analytics (Vercel Web Analytics + Speed Insights—cookieless, no PII; PostHog for product analytics in the apps and on the website, hosted in the EU), payments (RevenueCat, Apple, Google), communications (Expo Push, support inbox).

All have signed DPAs; sub-processing is restricted; security audited annually.

Community features

Joining challenges or sharing vocab lists makes your display name, avatar, and shared content visible to participants. Delete anytime from the relevant screen.

Business transfers

In a merger, acquisition, or bankruptcy, data transfers to the successor under this policy. We may also disclose to comply with law or protect users.

With consent

We ask explicit permission before sharing data with research partners, featuring testimonials, or enabling SSO integrations.

YouTube API Services

We use YouTube API Services in two places. Our website can play YouTube videos in an embedded player, and one internal tool manages Fasaha’s own YouTube channel (the titles, descriptions, thumbnails, captions and playlists of the videos we publish). Only Fasaha staff use that tool, and it signs in only to Fasaha’s own channel. It does not access, collect, store or share information about app users, website visitors or other YouTube users; the only thing it stores is the authorization for our own channel, kept on our own device.

YouTube’s services are governed by the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://www.google.com/policies/privacy). When you play an embedded video, YouTube may collect data under those terms. Access granted to an app through a Google Account can be reviewed and revoked on Google’s security settings page (https://security.google.com/settings/security/permissions).

My books in your own iCloud or Google Drive

Books, PDFs and texts you add to My books are never uploaded to Fasaha’s servers. Without sync they stay on your device. If you turn on My books sync, the files and their reading state (your place in each book, highlights, notes, bookmarks, and the words you marked or looked up while reading) are stored in your own cloud storage: your private iCloud database on Apple devices, or a hidden app-data folder in your Google Drive on Android. Fasaha has no access to that copy; only the Fasaha app on your own devices reads it.

On Android, Fasaha asks for Google’s “drive.appdata” permission, which lets the app see only the files it created in that hidden folder, and uses it only to sync My books. Data obtained through Google APIs is used in accordance with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements: it is never sent to Fasaha, sold, used for advertising, or used to train AI models. You can turn sync off or delete the synced copy in the app (My books → Sync), delete it in your iCloud settings or in Google Drive (Settings → Manage apps → Fasaha → Delete hidden app data), and revoke access on Google’s security settings page (https://security.google.com/settings/security/permissions).

7. International Transfers

Primary storage is in the United States. Cross-border transfers rely on Standard Contractual Clauses or equivalent mechanisms. Data is encrypted in transit and at rest.

8. Retention & Deletion

Account data: retained while active; deleted after 24 months of inactivity (two reminder emails sent first).

Learning artifacts (audio, transcripts, dictionary history): clear anytime via Settings → Privacy.

Server logs: up to 12 months. Purchase records: as required by tax law.

9. Security

TLS encryption, role-based access, secret scanning, routine pen-tests. We maintain incident-response playbooks and notify regulators/users of breaches as required.

10. Your Rights

Access, portability, correction, deletion

Download learning history, update profile, or delete account in Settings → Account. Need help? Email fasaha.app@gmail.com.

Marketing & cookies

Every marketing email has an unsubscribe link. We currently use essential cookies only and honor Global Privacy Control (GPC) signals.

US state privacy rights (2026 update)

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia can: know what data we hold, correct it, delete it, obtain a copy, and opt out of "sale" or "sharing" for targeted ads.

Fasaha does not sell personal data. To submit or appeal a request, email fasaha.app@gmail.com. We will verify identity and respond within the statutory period (usually 45 days).

Universal opt-out

Our apps and site detect GPC browser signals. When detected, we automatically treat it as an opt-out of sharing for cross-context behavioral advertising.

11. App Store Disclosures

Our App Store Privacy Nutrition Label and Google Play Data Safety form list each data type, purpose, and linkage to identity—synced with this policy before every release.

The app includes a link to this policy in Settings → Privacy (required under CCPA 2026 for mobile apps).

Permissions (microphone, camera, speech recognition, notifications, media library, motion) are requested just-in-time and revocable in device settings.

12. Children & Age Verification

Minimum age

Fasaha is for learners 13+. We do not knowingly collect data from children under 13 without verifiable parental consent. If discovered, such data is deleted immediately.

Under-16 protections (CCPA 2026)

For users under 16, we obtain opt-in consent before any "sale" or "sharing" of personal information. In practice, Fasaha does not sell data, but we implement this safeguard as required.

Age signals

We may use platform-provided age-signal APIs (Apple/Google) to apply appropriate protections per App Store Accountability Acts (TX, CA, LA, UT).

13. Policy Changes

We update this policy for new features, processors, or regulatory changes. Material updates are announced via in-app notice or email at least 15 days before taking effect.