Privacy Policy

1. About this policy

This Privacy Policy explains how Sara Abutaleb, the owner of the Miftahi app, based in the Arab Republic of Egypt ("Miftahi", "we", "us" or "our"), collects, uses, shares and protects information about you when you use the Miftahi app and its related services (the "Service"). We are the data controller responsible for your information.

In short: we collect only what the Service needs to work, we do not sell your data, we do not show ads, and the app contains no analytics, advertising or tracking software. Questions, requests and complaints about privacy: miftahiapp@gmail.com.

Back to contents

2. Information you give us

• Account: your sign-in details. A username account uses your username, your password (which our sign-in provider stores only in scrambled, hashed form) and a sign-in address generated by the system that is not a real mailbox. If you make a recovery code, we keep only a scrambled (hashed) copy of it, and delete it once it is used. When someone tries to reset a password, we record the username tried, the network address and the time, for up to 2 days, to stop people guessing codes. If you use Apple or Google sign-in once it is available, we receive the email and basic profile they share with us.
• Profile answers: your first name (optional), how often you read, your languages and your Arabic level.
• Public profile: your @username, nickname, avatar, status, title, frame, banner, bio, favourite verse and showcased badges.
• Messages and clan chat: the messages you send and receive (text, quick chats and shared badges) and the clan chat messages you post.
• Clans: clans you create or join, their details, your role, join requests and invites.
• Gifts: gifts of Miftahi Go you send or receive, with the note.
• Safety and support: reports you file, help requests you send (topic, message, your username, the reply email you give us and the app version), and any optional feedback you send: when cancelling Miftahi Go or ending the free trial (the reasons you pick, what you write and the app version) or through Settings, Share your thoughts (a 1 to 5 star rating, the areas you pick, what you write and the app version).

Back to contents

3. Information created as you use the Service

• Progress: your total and weekly XP, a record of each XP award (activity type and amount), your streak and the days you were active, badges, reading-challenge progress and event badges.
• Social: friend requests, friendships, blocks, whether messages have been read, and when you were last active.
• Clans: the XP you earned for your clan, weekly results, clan wars and league standings.
• Purchases: items you bought with XP, XP packs, gifts, whether your one-time trial was used and when, and, once billing is switched on, a record of each store transaction (product and transaction id).
• Safety records: warnings under the community rules (what kind, where and when; the hidden words themselves are not kept) and any chat pause.
• Security: when an account is created, the network (IP) address the request came from is recorded to stop mass account creation. It is deleted automatically after two days.
• Technical logs: like any online service, our hosting provider keeps short-lived logs of requests to our servers, including the network address and time, to keep the service secure and fix problems. We do not use them to track you.

Back to contents

4. Information stored only on your phone

• Bookmarks and reading position.
• Arabic course progress, including per-item results used for your Notebook and your personal plan (goal, focus skills, daily target and placement result).
• Vocabulary practice and review scheduling.
• Appearance, sound and haptics settings.
• That you confirmed being 13 or older. Your birth year itself is never stored.

Each account on a phone keeps its own copy, and switching accounts swaps it. If you also use the Miftahi website, it can save bookmarks, reading position, course progress and vocabulary to our server; any such copies are included in your data export and deleted with your account.

Back to contents

5. Cookies and similar technologies

The Miftahi app does not use cookies, advertising identifiers, tracking pixels or any similar technology to follow you across apps or websites. It keeps your settings, progress and sign-in session on your device, in the app's own storage and your phone's secure storage, only so the app works. If you use Miftahi in a web browser, the same information is kept in the browser's local storage for the same purpose. Because nothing is used for tracking or advertising, the app does not ask for tracking consent. Our website (the pages with this policy, our terms, support and account deletion) uses no cookies, no analytics and no scripts.

Back to contents

6. What we do not collect

We do not collect your location, contacts, photos, camera, advertising identifier, browsing history or birth year. Speaking exercises use the microphone only while you hold a speaking turn (after you tap the mic, and only with your permission). Your phone's own speech recognition service (Apple's on iPhone, Google's on Android) turns what you say into text, which may happen on the phone or on Apple's or Google's servers under their own privacy policies. The app compares that text with the answer on your phone and then forgets it: we never receive, record or store your voice or the text. Where voice checking is not available, you rate yourself.

Back to contents

7. How we use your information, and why

We use your information only for the purposes below. Where the law asks us to name a legal basis (for example under the GDPR or Egypt's Personal Data Protection Law), it is shown in brackets.

• To provide the Service: signing you in, saving your progress, showing profiles and rankings, connecting you with friends and clans, delivering messages and running events (performance of our contract with you).
• To grant what you buy or are gifted, and keep records of purchases (contract, and legal obligations such as tax and accounting records).
• To keep the community safe: word filtering, warnings, chat pauses, blocking and reviewing reports (our legitimate interest in a safe service, and our contract with you, which includes the community rules).
• To protect the Service: preventing mass account creation, spam, cheating and abuse, and keeping our systems secure (legitimate interests).
• To answer your help requests and feedback (contract and legitimate interests).
• To show reminders you switch on (daily practice, streak and Friday reminders): they are scheduled on your phone by its own notification system, not sent from our servers. Your reminder choices and time are stored only on your phone. You can turn them off at any time in Settings, Notifications or in your phone's settings (your consent).
• To meet legal duties, such as responding to lawful requests from authorities or reporting child exploitation (legal obligation).

We do not use your information for advertising, we do not sell it, and we do not build profiles of you for anyone else.

Back to contents

8. Automated moderation and your right to a human review

Names, bios, notes and messages are checked against a list of offensive words on your phone and on our server. In chats, blocked words are replaced with dots before the message is saved, and a warning is recorded. After two warnings, chat can be paused automatically for a set time, as described in the Terms and in Settings, Community rules.

You can always see your standing and the reason for each warning in Settings, Community rules. If you disagree with an automatic decision, choose Moderation review in Settings, Ask for help, and a person will look at it. Reports filed by other learners are always reviewed by a person.

Back to contents

9. What other learners can see

Other signed-in learners can see your public profile: @username, nickname, avatar, status, title, frame, banner, bio, favourite verse, showcased badges, total and weekly XP, streak, badges, reading language, when you joined, when you were last active, and whether you have Miftahi Go. Clan members can see clan chat and each member's role and clan XP. People who are not signed in cannot see profiles.

Messages are visible only to you and the person you are talking to. You can delete messages you sent, which removes them for everyone in the chat. Reports, with the reported content, are kept for a person to review, even if the reported message is later deleted.

Back to contents

10. Who we share information with

We share information only with service providers who help us run the Service, under contracts that let them use it only on our behalf:

• Supabase, which hosts our database and sign-in on servers in the United Kingdom (London region).
• Resend, which delivers help requests and feedback to our inbox by email.
• Sentry (servers in the European Union), which receives crash and error reports from the app: what went wrong, the screen, your device model, operating system and app version. Reports carry no name, username, email, messages or IP address.
• Apple and Google, which distribute the app and, once available, handle sign-in if you choose it and process store payments. We never see your card details.
• RevenueCat, which will manage store purchases for us once billing is switched on, receiving your account id and purchase details from the store.
• Cloudflare, which hosts our website and, when sign-up or a password reset shows a quick check that you are not a robot (Turnstile), runs that check. The check sees your network address and basic information about your device and browser, only to tell people from automated programs, under Cloudflare's own privacy policy.
• Quran.com, QuranCDN and QuranicAudio, which stream recitation audio and see your device's network address like any website. Pronunciation audio uses your phone's built-in speech engine; we cannot see whether a voice runs on the phone or on Apple's or Google's servers. Speaking exercises use your phone's speech recognition service in the same way; your voice goes from the phone to Apple or Google (if at all), never to us.

We may also disclose information if the law requires it, to protect someone's safety (for example, reporting child exploitation to the authorities), to enforce our Terms, or to a new owner if the Service is transferred, in which case this policy continues to protect your information.

Back to contents

11. International transfers

We are based in Egypt, and our database is hosted in the United Kingdom. Some of our providers, such as Resend, Apple and Google, may process information in other countries, including the United States. When information leaves your country, we rely on our providers' legal safeguards, such as the European Commission's standard contractual clauses, to protect it.

Back to contents

12. How long we keep information

• Account, profile, progress, social, clan, gift and purchase information: for as long as your account exists.
• Network addresses recorded at sign-up or at a password reset attempt: two days.
• Your recovery code: only a scrambled (hashed) copy, deleted as soon as it is used, replaced or removed, or when your account is deleted.
• Crash reports: kept by our crash-reporting provider for up to 90 days, then deleted. They do not include your name, username or messages.
• Records of actions taken by the app owner in the admin tools: kept for security for as long as they are needed, and never shown to other learners.
• Warnings under the community rules: they stop counting after 90 days and are deleted with your account.
• Reports: kept for review, and deleted when the account of the person who reported or the person reported is deleted.
• Help emails already delivered to our inbox: deleted on request.

When you delete your account, everything on our server listed in this policy is deleted with it: profile, progress records, friendships, messages, clan membership and clan chat messages, gifts, purchases, event progress, safety records, reports and help requests. If you lead a clan, leadership passes to another member. Copies may remain for a short time in our hosting provider's backups before they are overwritten. We may keep limited records longer where the law requires it, such as purchase records for tax purposes.

Back to contents

13. How we protect information

Information travels encrypted (HTTPS). Your sign-in session is kept in your phone's secure storage. Our database only lets each person read their own private information, and anything that grants paid features can only be changed by our server, never by the app. Access to our systems is limited to what is needed to run the Service.

No system is perfectly secure, so please use a strong password that you do not use anywhere else. When you choose a new password, we check it against the free Have I Been Pwned list of passwords leaked in other services' breaches. Only the first 5 characters of a one-way scrambled (hashed) copy are sent, never the password itself or anything about you, and a leaked password is refused. If a breach affects your information, we will tell you and the relevant authorities where the law requires it.

Back to contents

14. Your rights and choices

In the app, Settings, Export & storage lets you download everything we and this phone hold for you, or delete your account and all of it, at any time. You can edit your profile in the app. You can also delete your account from this website.

Depending on where you live, for example under Egypt's Personal Data Protection Law, the GDPR in the European Union, the UK GDPR, US state privacy laws, India's Digital Personal Data Protection Act, Brazil's LGPD, Saudi Arabia's and the UAE's Personal Data Protection Laws, Turkey's KVKK or Indonesia's Personal Data Protection Law, you may also have the right to:

• access the information we hold about you and get a copy of it;
• correct information that is wrong or incomplete;
• delete your information;
• restrict or object to certain uses, including uses based on our legitimate interests;
• receive your information in a portable format;
• withdraw consent where we rely on it, without affecting what we did before;
• name someone to use these rights for you if you die or cannot act, where your law allows it;
• appeal if we turn down a request: reply to our answer and a different person will look at it again and tell you the result and how to complain if you still disagree;
• complain to a data protection authority, such as Egypt's Personal Data Protection Center, your local authority in the EU, or the UK Information Commissioner's Office.

Email miftahiapp@gmail.com for anything the app does not let you do yourself. We may need to confirm that the account is yours first. We reply within one month, and we will not treat you differently for using your rights.

Back to contents

15. Notice for United States residents

We do not sell personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. The categories we collect are the identifiers, account details, messages, activity and purchase records described in sections 2 and 3, used for the purposes in section 7. You can exercise any rights your state gives you by emailing miftahiapp@gmail.com.

Back to contents

16. Children

Miftahi is not for children under 13, and sign-up blocks them. Learners aged 13 to 17 should use the app with a parent's or guardian's permission, and where the law where you live requires a parent's consent (for example through your app store's family or age settings), it must be given. To keep younger learners safe, messages can only be sent between friends, every chat is filtered for offensive words, anyone can be blocked or reported from their profile or chat, and we never show personalised ads or sell anyone's information. If you believe a child under 13 has an account, email miftahiapp@gmail.com and we will delete it.

Back to contents

17. Changes to this policy

We will update this policy when the app's handling of information changes, and change the date at the top. When a change matters, we will tell you in the app before it takes effect.

Back to contents

18. Contact

Privacy questions, requests and complaints: miftahiapp@gmail.com, or Settings, Ask for help in the app.

Back to contents