Privacy Policy

At MyDaftar ("we," "us," or "our"), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information when you use our mobile application.

1. Information We Collect

1.1 Information You Provide

Account Information:

• Email address (required for account creation)
• Name (optional)
• Password (encrypted and never stored in plain text)
• Profile information (if provided)

User Content:

• Vocabulary words and translations you save
• Personal notes and examples
• Quiz progress and statistics
• Search terms you enter (used to power lookup on your device; not stored on our servers)
• Text you input for translation
• Photos or images you capture or select for OCR text extraction (premium feature)
• Optional answers you give during onboarding: why you are learning, your level, your daily goal, your age range, your gender, how you heard about MyDaftar, and a creator code if you enter one
• Content reports you submit: the type of issue, the word being reported, and any comment you write
• Support requests you send from the app: your name, your email address, and your message

1.2 Automatically Collected Information

Usage Data:

• App features used and frequency of use
• Translation requests (count and language pairs)
• Quiz session data and performance metrics
• Time spent in the app
• Error logs and crash reports

Device Information:

• Device type and model
• Operating system version (iOS/Android)
• App version
• Device language settings
• A push notification token issued by Apple, stored with your account so we can tell you when a scan or translation has finished (iOS only; Android uses on-device notifications and no token is stored)
• Network connectivity status

1.3 Information We Do NOT Collect

• Precise location data (GPS coordinates)
• Contact lists or phone numbers
• Microphone audio or voice recordings
• Racial or ethnic origin, religious beliefs, health data, or biometric data
• Financial information (handled by App Store/Play Store)

We do ask for your age range and gender during onboarding. Both questions are optional and are described in Section 1.1; they are used to understand who the app serves, never for advertising.

Note on OCR: The OCR feature (premium only) accesses your camera or photo library when you choose to scan an image. The image is uploaded to our storage under your account, downloaded by our processing service, and sent to Google Cloud Vision to extract the text (see Section 3.1). The image is deleted as soon as text extraction finishes, whether it succeeded or failed. Any image missed by that cleanup is removed automatically within 24 hours.

2. How We Use Your Information

2.1 To Provide the Service

• Create and manage your account
• Process translation requests via OpenAI API
• Extract Arabic text from images via Google Cloud Vision API (OCR feature)
• Store and sync your vocabulary across devices
• Generate personalized quizzes based on your vocabulary
• Track your learning progress and statistics
• Enable offline functionality

2.2 To Improve the Service

• Analyze usage patterns to enhance features
• Identify and fix bugs and technical issues
• Improve translation quality and accuracy
• Optimize app performance

2.3 To Communicate With You

• Send transactional emails (password resets, account notifications)
• Provide customer support
• Send optional notifications about your quiz reminders
• Notify you of app updates and new features (with your consent)

2.4 To Process Payments

• Verify subscription status through App Store/Play Store
• Manage premium features access
• Track usage limits for free tier users

3. How We Share Your Information

3.1 Third-Party Service Providers

Where the content you create is sent outside the app, we name the provider that receives it:

3.2 Infrastructure and Operational Providers

We also rely on service providers for the ordinary operation of the app. These providers process your data only on our instructions and only for the purpose described:

• Cloud hosting and authentication: stores your account, vocabulary, quiz progress and the other data described in Section 1, on servers in the United States (West US, North California)
• App store payment processing and subscription management: receives purchase receipts and subscription status. We never receive your payment card information.
• Crash and error diagnostics: receives crash reports containing the device model, operating system version and app version. No account identifier is attached, so crash reports are not linked to your account, and no vocabulary, translations or personal messages are included.
• Push notification delivery: receives a device token so we can tell you when a scan or translation has finished (iOS only)
• Interface typeface delivery: the app downloads its interface font on first launch, which necessarily discloses your IP address to the font provider. No account information is sent.
• Website analytics: used on our marketing website only, not in the app

We will provide the identity of any of these providers on request — see Section 10.

3.3 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations or court orders
• Protect our rights, property, or safety
• Prevent fraud or abuse
• Respond to lawful requests by public authorities

3.4 We Will Never

• Sell your personal data to third parties
• Share your vocabulary or learning data with advertisers
• Use your data for targeted advertising
• Share your data with data brokers

4. Data Storage and Security

4.1 Where We Store Data

• Local Storage: Vocabulary, translations, and quiz data are stored on your device using Hive, inside your app's private sandbox. We rely on your device's own storage protection (iOS Data Protection, Android app-private storage) rather than adding a separate encryption layer on top.
• Cloud Storage: Account data and sync copies are stored with our cloud hosting provider, on servers in the United States (West US, North California)
• Offline-First: Your data works offline and syncs when online

4.2 Security Measures

• HTTPS with TLS 1.2 or higher for all data transmission
• Password hashing and authentication handled by our managed authentication provider; we never store or see your password
• Row Level Security, so your account can only read its own data
• Encryption at rest on our servers
• Device-level storage protection on your device (iOS Data Protection, Android app-private storage)
• Dependency and platform updates applied regularly

4.3 Data Retention

• Account data: Retained while your account is active
• User content: Retained until you delete it or close your account
• Backups: Deleted within 30 days after account deletion
• Analytics events: May be retained for up to 2 years
• OCR images: Deleted as soon as text extraction finishes; any image missed by that cleanup is removed within 24 hours
• Push notification tokens: Deleted when you sign out or delete your account
• Support requests: Retained so we can handle your request and any follow-up
• Content reports: Retained after account deletion with the link to your account removed, because the reported mistake is still worth fixing

5. Your Privacy Rights

5.1 Access and Control

You have the right to:

• Access: View all your personal data in the app settings
• Correct: Update your account information at any time
• Delete: Remove individual vocabulary items or your entire account
• Export: Download your vocabulary data (coming soon)
• Object: Opt-out of optional data collection

5.2 GDPR Rights (EU Users)

If you're in the EU, you have additional rights under GDPR:

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with supervisory authority

5.3 CCPA Rights (California Users)

California residents have the right to:

• Know what personal information is collected
• Know if personal information is sold or disclosed
• Opt-out of sale of personal information (we don't sell data)
• Request deletion of personal information
• Non-discrimination for exercising privacy rights

5.4 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@mydaftar.app or use the account deletion feature in app settings.

6. Children's Privacy

MyDaftar is designed for users aged 13 and above. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately, and we will delete such information.

7. International Data Transfers

Your account data is stored on servers in the United States (West US, North California). Your data may therefore be transferred to and processed in countries outside your country of residence, including the United States and other jurisdictions where our service providers operate including our cloud hosting, AI processing, payment, diagnostics and font providers. Our product analytics provider hosts its data in the European Union. If you are in the EU or UK, transfers to the United States rely on the European Commission's Standard Contractual Clauses as implemented by each provider. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

8. Cookies and Tracking

The mobile app does not use cookies. However, we use local storage for:

• Authentication tokens (to keep you logged in)
• App preferences and settings
• Offline data caching

The app does send product analytics events to PostHog, described in Section 3.1. These are used to understand feature usage. They are not advertising or cross-app tracking, and the app contains no advertising SDK.

Our website (mydaftar.app) may use analytics cookies. You can control cookie preferences in your browser settings.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via:

• In-app notification
• Email to your registered address
• Updated "Last Modified" date at the top of this policy

Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

11. App Store Compliance

This app complies with Apple App Store and Google Play Store privacy requirements:

• Privacy-related app permissions are requested only when needed
• All data collection purposes are clearly disclosed
• Users can delete their accounts and data at any time
• Payment processing is handled exclusively by Apple/Google
• No advertising SDKs and no cross-app tracking. Product analytics (PostHog) are used to understand feature usage — see Section 3.1.