Privacy policy

1. What we collect

• Account details: your name, email address and preferred language. We never store your password itself, only a one-way hash from which the password cannot be recovered.
• If you provide them: a mobile number, and the interests you pick on the welcome screen (parent, teacher and so on). Interests are only a preference and grant no special permissions.
• Login session details: the browser and operating system names (for example "Chrome on Windows") so you can recognise your devices, and the time of login. We do not store your network (IP) address or full browser identity as such; we store hashes made with a secret key, from which the real values cannot be recovered.
• Security log: successful and failed logins, password changes and reset requests with their time, and the hashes above. It contains no phone number, email or password.
• Consent records: which version of the terms, privacy policy and cookie notice you accepted or declined, and when.
• If you sign in with Google: Google sends us only your name, email address and a permanent identifier of your Google account. We never receive your Google password. Google uses your information under its own policy.
• Human check: on forms such as registration and password reset we may use Cloudflare Turnstile to stop automated abuse. When it is on, Cloudflare looks at some signals from your browser and network to tell whether you are a person.
• Request counting: to stop abuse we count how often requests arrive. For that we keep a hash of your IP address, made with a secret key, for a short time (a few hours at most), never the address itself.
• Cookies: the cookies needed to sign you in and keep the site secure. See the cookie policy.

2. What we do not collect

• Your precise location, photos or payment details (cards, bank accounts) at this stage.
• We do not track you for advertising and we do not sell your information.

3. Why we use it

• To create your account, recognise you and keep you logged in.
• To protect accounts and the site: to stop repeated password guessing, stolen sessions and abuse.
• To send necessary messages such as password reset emails.
• To meet legal obligations.
• Only if you separately allow it, to understand how the site is used and improve it (analytics cookies). No such analytics is running now.

4. How long we keep it

• Account details: for as long as your account exists.
• Login sessions: ended when you log out, or after 30 days at most.
• Password reset links: valid for 1 hour and useless after use.
• Account deletion requests: 30 days after the request your name, email, phone number, password hash, sign-in details and security log are erased permanently. Logging in during that time cancels the request.
• Security log and consent records: [retention period to be decided]. When an account is erased its security log goes with it; the consent records (proof of what you agreed to) may remain without your name or email.

5. Who it is shared with

We do not sell your information. Only the necessary part goes to those who help us run the service: the hosting and database provider [name and country to be decided] and the email delivery provider [name to be decided]. If you sign in with Google, Google, and if the human check is on, Cloudflare, receive information directly from your browser for their own purposes. We may have to give information to authorities when a valid legal order requires it.

6. Your rights

• To know: your profile page shows your details and the devices that are logged in.
• To correct: you can change your name and language yourself on the profile page.
• To delete: you can request deletion of your account on the profile page (confirming with your password, or with Google). You are then logged out on all devices and your personal data is erased permanently after 30 days. If you change your mind, logging in again within that time cancels the request.
• To withdraw consent: change your cookie choice any time with "Cookie settings" at the bottom of the page.
• To complain: if you think there is a problem with your data, tell us first; you also have the right to complain to the competent authority.

7. Security

We hash passwords, use encrypted connections, limit login attempts and end a session when suspicious token reuse is detected. No system is perfectly secure, though. Use a long, unique password, and if you see a device you do not recognise, log it out and change your password.

8. Children

Accounts are for adults. Parents can look for a madrasa for their child, but children should not open accounts in their own name.

9. Changes

If this policy changes, the new version is published with a new version number and logged-in users are asked to accept it again.

10. Contact

[Contact email and address to be added before publication]