1. Introduction

This policy explains what data we collect and how we use and protect it when you use Tafawwuq. Our practices are designed in the spirit of the Saudi Personal Data Protection Law (PDPL) and standard privacy principles: minimum data, specific purposes, serious protection.

2. Data We Collect

Account data: email, optional name, and password — passwords are stored only as scrypt hashes and are never visible to us in plain text. Training data: your progress, XP, mistakes, practice answers, and the essay texts and speaking answers you submit for evaluation. Payment data: payments happen entirely at the external payment gateway; we never receive or store card numbers.

3. AI Processing

To generate evaluations, questions and replies, your relevant inputs (such as your essay text, the transcript of your spoken answer, or your question to the AI tutor) are sent to trusted third-party AI model providers engaged by the Platform, and are processed under their agreements for the sole purpose of generating the feedback you requested. We send the minimum necessary data, we do not sell your data, and we do not use it for advertising.

Voice: speech recognition in speaking exercises is performed by your own browser’s speech service (your browser vendor may process the audio under its own policies); the Platform receives only the resulting text and does not store your voice recordings. Listening-lab clips are pre-produced recordings.

4. Storage & Security

Account records are stored fully encrypted at rest (AES-256-GCM) with our cloud hosting provider, data travels over encrypted connections (TLS), and sessions are cryptographically signed (HMAC). No system guarantees absolute security, but we adhere to well-established good practices.

5. Cookies

We use essential cookies only: the sign-in session (tfq_session), the paid-plan status (tfq_premium), and the interface language (NEXT_LOCALE). We use no advertising or tracking cookies.

6. Local Storage & Sync

Your practice progress is kept in your browser’s local storage. When you are signed in, a snapshot of this progress is synced to your encrypted cloud account so it follows you across devices.

7. Your Rights

You may request access to your data, its correction, a copy of it, or permanent deletion of your account and data, by contacting support from the email registered to your account. We will fulfil requests within a reasonable time.

8. Retention & Age

We retain your data while your account is active and delete it upon your request. The Platform is intended for students aged 13 and above; use by minors is assumed to be with guardian consent.

9. Updates & Contact

We may update this policy from time to time, publishing the latest version here with its date. For any privacy or data question, contact us via the support email shown on the Pricing page and in the site footer.