Privacy Policy for Almutafoq App

This Privacy Policy explains how Almutafoq ("we," "our," or "the App") collects, uses, shares, and protects your personal information. By using this App, you agree to the terms of this Privacy Policy.

1. Data Collection and Usage

We collect the minimum necessary data to provide personalized learning, verify account enrollment, and maintain the App's security.

A. Core Identifiers (MFA & Cross-Platform)

B. Usage Data and Academic Progress

C. Financial Data Handling

In-App Purchase (IAP): We DO NOT process or store your payment details (credit card or bank account). All IAP transactions are handled securely by Apple's App Store, and are governed by Apple's privacy policy.

RevenueCat: We share the anonymous purchase identifier and App User ID (Phone Number) with RevenueCat for receipt validation and entitlement management only.

D. Push Notifications and Device Data

OneSignal Push Notification Service: We use OneSignal to send you study reminders and important notifications. When you grant notification permissions, we collect and share the following data with OneSignal:

• Device Push Token: Unique identifier from Apple Push Notification service (APNs) to deliver notifications to your device.
• Device Information: Device type (iOS), language preference (Arabic), and timezone for scheduling notifications appropriately.
• User Identifier: Your phone number as an external user ID to link notifications to your account.
• Player ID: OneSignal's internal identifier for your device.

You can opt-out of push notifications at any time through your iOS device settings (Settings > Notifications > Almutafoq).

OneSignal's Privacy Policy: https://onesignal.com/privacy_policy

E. Microphone and Audio Recording (Optional Feature)

Microphone Permission: The App may request access to your device's microphone for the optional feature of recording audio responses during study sessions.

• Purpose: To enable you to record voice answers and practice verbal responses to questions.
• Storage: Audio recordings are stored locally on your device only and are NOT uploaded to our servers or shared with third parties.
• Optional: You can use all core features of the App without granting microphone permission.
• Control: You can revoke microphone access at any time through your iOS device settings (Settings > Privacy > Microphone > Almutafoq).

F. Local Storage and Cookies

The App uses local storage on your device to:

• Store your authentication session securely
• Cache study progress and flashcard data for offline access
• Remember your preferences and settings
• Store temporary data for app performance optimization

This data remains on your device and is automatically cleared when you log out or delete the App.

2. Data Security

We take the security of your personal information seriously and implement industry-standard measures to protect it:

• Encryption in Transit: All data transmitted between the App and our servers uses HTTPS/TLS encryption.
• Encryption at Rest: Sensitive data stored in our database (Supabase) is encrypted at rest using AES-256 encryption.
• Authentication Security: Secure authentication using phone number + password. Passwords are encrypted using bcrypt hashing algorithm and protected during transmission with HTTPS/TLS.
• Access Controls: We implement strict access controls and only authorized personnel can access user data for support purposes.
• Secure Infrastructure: Our data is hosted on secure, enterprise-grade cloud infrastructure (Supabase) with 24/7 monitoring.
• Regular Audits: We conduct regular security reviews and updates to protect against vulnerabilities.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

3. Data Sharing and Third-Party Services

We share data only with the minimum necessary third-party services required for the App's operation. We do not sell your personal information to third parties.

Third-Party Service Providers:

• Supabase (Database & Authentication): Stores all user data, authentication credentials (hashed passwords), and learning progress. Data may be stored on servers located internationally. Privacy Policy
• RevenueCat (Subscription Management): Verifies Apple IAP receipts and manages subscription entitlements. Based in the United States. Privacy Policy
• OneSignal (Push Notifications): Manages push notification delivery to your device. Based in the United States. Privacy Policy
• Apple Inc. (In-App Purchases & Push Notifications): Processes all subscription payments and manages APNs push tokens. Privacy Policy

International Data Transfers:

Your data may be transferred to and stored on servers located outside your country of residence, including in the United States and European Union. These countries may have data protection laws that differ from your country. By using the App, you consent to the transfer of your information to these countries. We ensure that all service providers implement appropriate safeguards to protect your data in accordance with this Privacy Policy.

4. Data Retention

We retain your personal information for as long as necessary to provide you with our services and as described in this Privacy Policy:

• Active Accounts: We retain your data for as long as your account remains active.
• Inactive Accounts: If you do not log in for 24 consecutive months, we may delete your account and associated data.
• After Account Deletion: When you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain certain information (e.g., financial records for tax purposes).
• Backup Systems: Deleted data may remain in backup systems for up to 90 days before permanent deletion.
• Anonymized Data: We may retain anonymized, aggregated data (that cannot identify you personally) indefinitely for statistical analysis and service improvement.

5. Your Rights and Choices

You have the following rights regarding your personal information:

A. Right to Access

You have the right to access and review your personal data stored in the App. Most of your data is visible in the App's Settings screen. For a complete copy of your data, contact us at mustafa.0312j@gmail.com.

B. Right to Correction

You can update your name, gender, and other profile information directly in the App's Settings. If you need to change your phone number, contact our support team.

C. Right to Deletion

You can delete your account and all associated data at any time:

• In-App: Go to Settings > Account Management > Delete Account
• By Email: Send a deletion request to mustafa.0312j@gmail.com
• By Telegram: Contact @Mustafa0412

We will process verified deletion requests within 30 days.

D. Right to Data Portability

You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format. Contact us at mustafa.0312j@gmail.com to request data export.

E. Right to Opt-Out

• Push Notifications: Disable in iOS Settings > Notifications > Almutafoq
• Microphone Access: Disable in iOS Settings > Privacy > Microphone > Almutafoq
• Marketing Communications: We do not send marketing emails. All communications are service-related only.

F. Right to Object

You may object to the processing of your personal data for certain purposes. However, please note that some data processing is essential for the App's core functionality (authentication, subscription management, progress tracking). If you object to these essential processes, you may not be able to use the App.

G. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know whether personal information is sold or disclosed
• Right to opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to deletion
• Right to non-discrimination for exercising CCPA rights

H. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including those listed above and the right to lodge a complaint with a supervisory authority.

6. Privacy of Minors (COPPA Compliance)

The Almutafoq App is designed for students in 12th Grade and older. We do not knowingly collect personal information from children under the age of 13 without parental consent.

• Age Requirement: Users must be at least 18 years old OR be 13-17 years old with verifiable parental/guardian consent to use this Service.
• Collection Policy: If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will take immediate steps to delete that information from our servers.
• Parental Rights: Parents/guardians have the right to review, delete, or refuse further collection of their child's personal information.
• Parental Notification: If you are a parent or guardian and become aware that your child has provided us with personal information, please contact us immediately at mustafa.0312j@gmail.com so we can take necessary action.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Notification: When we make material changes, we will notify you by:
  • Displaying a prominent notice in the App
  • Sending a push notification (if you have enabled notifications)
  • Updating the "Last Updated" date at the top of this policy
• Your Acceptance: Your continued use of the App after changes are posted constitutes your acceptance of the updated Privacy Policy.
• Review Regularly: We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
• Previous Versions: If you would like to review a previous version of this Privacy Policy, contact us at mustafa.0312j@gmail.com.

8. Legal Basis for Processing (GDPR)

If you are in the EEA, our legal bases for processing your personal information are:

• Contractual Necessity: Processing is necessary to provide the App services you requested (authentication, progress tracking, subscription management).
• Legitimate Interests: We have a legitimate interest in improving our services, preventing fraud, and ensuring security.
• Consent: For optional features like push notifications and microphone access, we obtain your explicit consent.
• Legal Obligations: We may process data to comply with legal requirements (e.g., tax laws, court orders).

9. Do Not Track Signals

Our App does not track users across third-party websites or apps. We do not respond to "Do Not Track" (DNT) signals because we do not engage in cross-site tracking. All data collection is limited to the App's functionality as described in this Privacy Policy.

10. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Developer: Mustafa Rahimoglu (Individual Developer)
• Email: mustafa.0312j@gmail.com
• Telegram Support: @Mustafa0412
• Response Time: We aim to respond to all inquiries within 48 hours.

By using the Almutafoq App, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.