Privacy Policy

Effective date: [YYYY-MM-DD]

1. Who we are

Sheraa is an app for learning Arabic. It is run by Ebanah (إبانة), Muscat, Sultanate of Oman ("we", "us"). We are responsible for the personal data described in this policy.

Questions or requests about your privacy: support@ebanah.com.

2. Using Sheraa without an account

You can use Sheraa without creating an account. In that case, everything you do in the app is saved only in your browser on this device, in its local storage (localStorage and IndexedDB, under keys that start with shiraa.). This includes:

• the name you give yourself and your companion, your app language, daily goal and settings;
• your lessons, scores, XP, coins, streak, badges and review schedule;
• your companion's state and your game results.

We do not receive this data. To remove it, use Settings → Reset progress or clear this site's data in your browser.

The app also keeps a copy of its own files (code, pictures, audio clips) in the browser's cache so that it works offline. These files are the same for everyone and contain no personal data.

3. What we collect when you create an account

An account backs up your progress and lets you buy a pass. When you have one, we store the following on our servers:

We do not ask for your phone number or postal address.

4. How we use your data, and on what basis

We use your data only to run Sheraa:

• To provide the service you asked for (our contract with you): your account, sign-in, progress backup, and passes you buy.
• To keep Sheraa safe (our legitimate interest): rate limits, temporary account locks after many failed sign-ins, security logs, preventing fraud.
• To meet legal obligations: keeping financial records and answering lawful requests from authorities.
• With your permission (consent): microphone access for speaking exercises and browser notification permission. You can withdraw this permission at any time in your browser settings.

We do not sell your personal data. We do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Payments

Passes are sold through Paymob, a payment provider. When you buy a pass, you are taken to Paymob's secure checkout page. To create the payment, we send Paymob your email, your name (if you gave one), the plan and the price. Paymob's form does not need a phone number or address, so we send the placeholder "NA" for those fields.

You enter your card details on Paymob's page, not in Sheraa. We never receive or store your full card number or security code. After the payment, Paymob sends us a notification with the result. We keep that notification as a financial record. It may contain details that Paymob includes, such as a masked card number (for example the last four digits), the card type, the billing name and email, and the amount.

Paymob processes your payment data under its own privacy policy.

6. Microphone and speech features

Speaking exercises. When you start a speaking exercise, the app asks your browser for microphone access.

• The moving ring that reacts to your voice is calculated on your device. Sheraa does not record your voice, does not save audio and does not send audio to our servers.
• To understand what you said, Sheraa uses the speech recognition built into your browser (the Web Speech API). That service is provided by your browser maker, not by us. Some browsers process speech on the device. Others send the audio to their own servers: for example, Google Chrome uses Google's servers. Your browser maker's privacy policy applies to that processing.
• The app receives only the text the browser recognised. It compares that text with the expected phrase on your device to give you a score. The text is not sent to us and is not saved.
• If your browser does not support speech recognition, speaking exercises are hidden. You can refuse microphone access. The rest of the app works normally.

Spoken Arabic. Most words are played from recordings that come with the app. When a recording is not available yet, the app may use your device's text-to-speech voice. Some browsers use an online voice service, which receives the text to be spoken.

7. Cookies, analytics and trackers

• One essential cookie. When you sign in, we set one cookie called shiraa_sid. It holds a random sign-in token and is protected (HttpOnly, and Secure on HTTPS connections) so scripts on the page cannot read it. It expires 30 days after your last visit or when you sign out. The app does not work signed in without it, so we do not ask for consent for it.
• No analytics service, no ads, no trackers. Sheraa contains no third-party analytics, advertising or tracking code. The app only connects to our own servers, and to Paymob when you choose to pay. Sheraa counts some app events in memory (for example, "lesson finished") for debugging, but these counts are not sent anywhere.
• Local storage on your device is described in section 2.

If we ever add an analytics tool, we will update this policy first and ask for your consent where the law requires it.

8. Emails

We send emails only about your account: confirming your email address, resetting your password, and telling you if someone tries to sign up with an address that already has an account. We do not send marketing emails. Emails are delivered by [Email delivery provider].

9. Who we share data with

We share personal data only with service providers who help us run Sheraa, and only what they need:

• Hosting: [Hosting provider and server country] runs our servers and database.
• Email delivery: [Email delivery provider] delivers account emails.
• Payments: Paymob processes payments (see section 5).

We may also disclose data if the law requires it, to protect the rights and safety of our users or of the public, or as part of a merger or sale of our business (in that case, we will tell you first).

Your browser maker may process speech as described in section 6. This is part of your browser, not a service we choose or pay for.

10. Server logs and backups

• Logs. Our servers record technical information about requests: the time, the type of request, the page or address requested (without any query string), the response status and duration. Our web server's access log also records your IP address and browser user-agent. Passwords, email addresses, cookies and codes are removed from our application logs. Logs are kept for [N days].
• Rate limits. To block abuse, we count requests per IP address in our server's memory for one minute. These counts are never saved.
• Backups. We back up the database every night and keep each backup for 14 days. Data you delete therefore disappears from our backups within 14 days.

11. Deleting your account and data

• Delete your account: go to Settings → Delete account and confirm with your password. We immediately delete your account, profile, progress backup, sessions, codes, pass status and purchase records from our database. The app then clears the data stored in that browser.
• What we keep: Paymob payment notifications (section 5) are kept as financial records for [N years, as required by accounting law]. The link to your account is removed. Deleted data also remains in backups for up to 14 days (section 10).
• Other devices: data saved on other devices stays there until you sign out and reset progress on that device, or clear the browser's site data.
• Without an account: use Settings → Reset progress, or clear this site's data in your browser.

12. Your rights

Depending on where you live, you may have the right to:

• access your personal data and get a copy of it;
• correct data that is wrong;
• delete your data;
• receive your data in a portable format (we provide your account details and progress backup as a JSON file);
• object to or restrict some uses of your data;
• withdraw consent at any time, for example to microphone access, without affecting what happened before;
• complain to your local data protection authority.

To use any of these rights, write to support@ebanah.com from the email address of your account. We may ask you to confirm that the account is yours. We answer within one month. If a request is complex, we may need longer; we will tell you if so. Using your rights is free.

13. Children

Sheraa is meant for learners aged 13 and over. You must be at least 13 years old to create an account, or older if the law of your country requires it.

Children can use Sheraa without an account. Their progress then stays on their device and we receive nothing. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child under 13 has created an account, write to support@ebanah.com and we will delete it.

14. Security

We protect your data with measures that include:

• encrypted connections (HTTPS) and strict browser security rules;
• passwords stored only as argon2id hashes;
• sign-in and email codes stored only in hashed form;
• a protected sign-in cookie that page scripts cannot read;
• rate limits, and a temporary lock after 10 failed sign-in attempts;
• your password is required again before your account is deleted;
• personal data removed from application logs, and restricted access to backups.

No system is perfectly secure. If a data breach affects you, we will inform you and the authorities as the law requires.

15. International users

Our servers are located at: [Hosting provider and server country]. If you use Sheraa from another country, your data will be transferred to and processed in that location. Paymob may process payment data in other countries. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

16. Changes to this policy

We may update this policy when Sheraa or the law changes. The effective date at the top shows the latest version. If a change is important, we will tell you in the app or by email before it takes effect.

17. Contact

• Ebanah (إبانة)
• Muscat, Sultanate of Oman
• Email: support@ebanah.com