سياسة الخصوصية Privacy Policy

The Irab (إعراب) app is developed and operated by Mansoor Hassan, an independent developer. This Privacy Policy explains how we collect, use, and protect your personal information when you use the Irab app on iOS or Android.

For applicable data protection law (including GDPR), Mansoor Hassan is the data controller for personal data collected through this app.

Questions? Contact us at support@irab.app

Account & Identity

• Email address: provided during sign up
• Display name: chosen by you, shown on leaderboards
• Profile photo URL: optional, from Google if using Google Sign In
• Firebase UID: anonymous internal identifier

Learning Progress

• XP points, ranks, badges, streak records
• Practice session results (accuracy, correct/incorrect counts)
• Challenge history, power up counts, stage stars
• Daily challenge attempts and scores
• Saved favorites, Irab Library entries, Grammar Certificates

Usage & Analytics

• Feature usage events (practice started, challenge completed, premium gate hit)
• Daily usage counts per feature (for free tier limits)
• Session metadata collected by Firebase Analytics (app version, OS, device type)
• Product analytics and blurred session recordings collected by PostHog (EU, Frankfurt): screens visited, features used, subscription events, campaign source of the install (UTM parameters and ad click identifiers). Text you analyse, search or dictate is never sent to analytics; recordings mask all text and images. You can switch this off in the app Settings or via the notice on the website.
• Crash reports and performance diagnostics

Search History

• Arabic words and sentences submitted for irab/dictionary analysis
• Timestamps of each query

Device & Technical

• FCM push token (for notifications you opt into)
• Firebase Installation ID and Android Device ID (for analytics)
• IP address: processed by Cloudflare to deliver the service. For free use, your network address is also kept in short lived usage counters (see Free Use Limits below)

Free Use Limits (Abuse Prevention)

• Daily usage counters: how many AI uses (analyses, dictionary lookups, questions and the like) an account, or a guest's anonymous ID, has made today: for the free limits and, for Irab Plus, a high ceiling against abuse
• First use date: when an account first used an AI feature, to give it its welcome week
• On the website (irab.app), for free use only: the same uses are also counted per browser and per network, so that one person gets one free allowance rather than one per account. For this the site sends us: a random browser ID that it keeps in your browser's local storage; a device signature, which is a one way hash of your browser type, operating system, language, screen size, time zone and processor and memory class, also kept in your browser (our server hashes it again together with your network); and your network address, meaning your IPv4 address or the first half (the /64 prefix) of your IPv6 address
• Welcome week on the website: to give it once per browser and home network, we note which account each browser ID, device signature and home network saw first
• Website guests: a guest's free tries are counted the same way, and also under the device signature over a longer period and per IP address and address range for the day
• Email check: before a free website account uses AI features, we check that its email address is confirmed and not from a disposable email service

These identifiers are used only to enforce the free limits. They are never used for analytics or advertising, or to follow you on other sites, and the website's browser and network counts are not kept for Irab Plus subscribers.

Expired counters and markers are no longer read, and are deleted automatically in the background.

We use data solely to provide, maintain, and improve the Irab app:

• Core service: Authenticate your account, process grammar analysis, store your progress, serve content
• Gamification: Award XP, calculate rank, maintain streaks, display leaderboards
• Personalization: Show saved favorites, library entries, practice history
• Notifications: Send daily reminders and streak alerts (opt in only)
• Subscription: Verify premium entitlement and gate features
• Abuse prevention: Enforce free usage limits and request limits, including counting free website use per browser and network (see Section 02)
• App improvement: Analyze aggregated, anonymized analytics to identify issues
• Legal compliance: Maintain records required by law

What Is Sent to Gemini

• Arabic sentences submitted for irab analysis
• Arabic words for dictionary lookups
• Images (base64) when using OCR / camera
• Sentences and user analysis during practice grading
• Wrong words for explanation generation (premium)

How We Protect Your Data in AI Calls

• All requests route through our Cloudflare Workers proxy: Gemini API keys are never exposed to your device
• Firebase ID tokens are verified server side on every request
• All communication is encrypted via HTTPS/TLS

What Gemini Does NOT Do

• Does not use your text to train or improve AI models (per Google's API Terms)
• Images sent for OCR are not stored after processing
• We do not store raw images on our servers

See Google's privacy policy at policies.google.com/privacy

Ask the Teacher: Anthropic Claude

The Ask the Teacher feature sends your question to Anthropic's Claude API, together with the sentence, its i'rab as shown in the app, the last few messages of the conversation and, when you ask from practice, your answer and the correct one. If Claude is unavailable, the same request is sent to Google Gemini instead. Anthropic does not use content sent through its API to train its models (per Anthropic's Commercial Terms). See Anthropic's privacy policy at anthropic.com/legal/privacy

If you rate a teacher's answer, your rating, the reasons you pick, any note you write, your question and the answer are stored on our Cloudflare servers with your account ID, so we can review and improve the teacher. When you ask the teacher to review a word's i'rab, the sentence, your objection and the teacher's ruling are stored the same way.

Smart Dictionary: OpenAI

Smart Dictionary entries are written by Google Gemini or OpenAI's API. Only the word you look up is sent. OpenAI does not use data sent through its API to train its models by default (per OpenAI's API data usage policy). See OpenAI's privacy policy at openai.com/policies/privacy-policy

With your explicit permission, we send push notifications via Firebase Cloud Messaging (FCM). We send two types:

• Daily Practice Reminder: sent ~6 PM Gulf Time if you haven't practiced that day
• Streak at Risk Alert: sent ~8 PM Gulf Time if your streak is at risk

You can revoke permission any time via device Settings → Notifications or from the app's Settings screen. On logout, your FCM token is removed from our servers. We do not send marketing push notifications.

Irab offers optional premium subscriptions. All purchases are processed by Apple App Store (iOS) or Google Play (Android). We do not receive or store payment card details.

Subscription management is handled by RevenueCat, which receives your purchase receipt and User ID to verify entitlement. When you subscribe, RevenueCat notifies our server via webhook, updating your subscription status in Firestore. This status determines which premium features are unlocked.

Subscription status (tier, plan) is stored in Firestore linked to your account and deleted when you delete your account.

• Account data (email, display name, profile): until account deletion
• Learning progress, favorites, history: until account deletion
• Daily usage counters (account, browser, network): expire after 2 days
• First use date and website first account markers: 60 days
• Website guest tries (device signature): 90 days; website guest address counters: 25 hours
• XP award logs: auto deleted after 60 days
• Certificates: until account deletion (stored in Cloudflare R2)
• FCM token: deleted on logout
• Firebase Analytics data: up to 26 months (Google's retention)

When you delete your account, a Cloud Function removes all associated data from Firestore and Cloudflare R2 within 24 hours.

To exercise rights, delete your account via Settings → Account → Delete Account or email legal@irab.app. We respond within 30 days.

The Irab app is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent and believe your child has provided us with personal information, contact us immediately at legal@irab.app and we will delete it promptly.

Users aged 13 to 17 should use the app with parental knowledge where required by law.

Our primary Firestore database is in the Singapore region. Services including Firebase, Gemini, Anthropic, OpenAI, RevenueCat, and Cloudflare are operated primarily in the United States.

If you are in the EEA, your data may be transferred outside the EEA. These transfers are made under appropriate safeguards: Standard Contractual Clauses (SCCs) with Google, RevenueCat, and Cloudflare.

• Encryption in transit: All data uses HTTPS/TLS
• Authentication: All API endpoints require a valid Firebase ID token verified server side
• API key security: AI API keys stored as Cloudflare Workers secrets, never exposed to devices
• Firestore rules: Users can only read/write their own data
• Firebase App Check: Protects against unauthorized access and bots
• Rate limiting: Per user limits on all AI features

While we take reasonable precautions, no Internet transmission is 100% secure.

We may update this policy from time to time. Material changes will be communicated via push notification or in app banner, and the "Last Updated" date will be updated. Continued use of the app after changes constitutes acceptance.