Privacy Policy

Tasreef Roots  ·  Last updated: June 7, 2026

This Privacy Policy describes how the Tasreef Roots mobile application ("App") and the tasreefnlp.com website ("Site") collect, use, and protect your information. By using the App or Site you agree to this policy.

1. Who We Are

Tasreef Roots is an independent Arabic-language learning application. You can reach us at [email protected].

2. Information We Collect

We collect only what is necessary to operate the service:

• Account information — email address, display name, and a bcrypt-hashed password (we never store your plaintext password).
• Learning progress — per-root spaced-repetition state: stability, difficulty, repetitions, lapses, review state, and next due date. These are tied to your account and stored on our server.
• Timestamps — account creation date, last login, and individual review submission times.
• Vacation mode dates — start and end dates if you activate vacation mode.

We do not collect: real name, phone number, location, device identifiers, crash reports, or analytics events.

3. How We Use Your Information

• Authenticate you and keep your account secure.
• Compute your spaced-repetition schedule so you see the right roots at the right time.
• Display your learning statistics (streak, cards due, heatmap) inside the App.

We do not use your data for advertising, sell it to third parties, or share it with anyone except as described in Section 5.

4. Data Storage and Security

• Account and progress data is stored in an SQLite database on a Hetzner Cloud server located in Frankfurt, Germany (EU).
• All traffic between the App and our servers is encrypted via HTTPS (TLS 1.2+).
• Passwords are stored as bcrypt hashes (cost factor 12) — your plaintext password is never retained.
• Your authentication token (JWT) is stored exclusively in the iOS Keychain or Android EncryptedSharedPreferences on your device — never in plain storage.
• Authentication tokens expire after 7 days.

5. Third-Party Services

We use the following third-party services that may process your data:

• Cloudflare — acts as a reverse proxy and CDN for all traffic to tasreefnlp.com. Cloudflare processes your IP address and request metadata to provide DDoS protection and caching. See Cloudflare's Privacy Policy.
• Google Fonts — the App may make a one-time request to fonts.googleapis.com to download display fonts on first launch. Google may log the request IP. See Google's Privacy Policy. This request does not include your account information.
• Apple Text-to-Speech (iOS) — the App uses the on-device iOS TTS engine to pronounce Arabic text. Audio processing happens entirely on your device; no audio or text is sent to Apple servers by our App.

6. Data Retention

We retain your account and learning data for as long as your account is active. If you delete your account (see Section 7), all associated data is permanently deleted from our database immediately. Server access logs may retain your IP address for up to 30 days for security and debugging purposes.

7. Your Rights

You can exercise the following rights at any time through the App:

• Access and correct your display name via Settings → Profile.
• Change your password via Settings → Change Password.
• Delete your account permanently via Settings → Account → Delete Account. This removes all your data immediately and cannot be undone.

For any other data requests or questions, contact us at [email protected].

8. Children's Privacy

Tasreef Roots is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy occasionally. The "Last updated" date at the top will reflect any changes. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Email [email protected].