Privacy Policy

Last updated: May 18, 2026

Ya Qalbi is a Lebanese Arabic learning app built by Chay Dib (Chayland Design, a sole proprietorship in California, USA). This Privacy Policy explains what data we collect, why we collect it, and how you can control it.

Plain summary: we collect the minimum needed to run the app, we never sell your data, you can delete your account at any time, and you can use the app fully without an account if you prefer.

1. Information we collect

1.1 If you use the app without signing in

Your progress (current streak, XP, completed lessons, gems, selected phoenix, profile choices) is stored locally on your device. We do not receive or store any of this on our servers. If you uninstall the app or clear its data, this progress is permanently lost.

1.2 If you sign in

When you sign in with Google, Apple, or email, we receive and store the following in our database (hosted by Supabase, an EU-headquartered cloud provider, in their US region):

• A unique user ID (assigned by the auth provider; not a publicly visible identifier)
• Your email address (from the auth provider)
• Your display name (from the auth provider, if shared)
• The username you pick inside the app (shown publicly on the leaderboard)
• Your selected phoenix character
• Your learning progress: total Nour (XP), current Nar (streak), Dahab (gems), longest streak, completed lesson IDs, last active date

We do NOT collect: precise location, contacts, photos, browsing history, advertising identifiers, microphone or camera access, or any biometric data.

1.3 If you join the waitlist on yaqalbiapp.com

We store the email address you submit, plus a non-identifying record of your browser user-agent and the page that referred you. We use this only to send the launch announcement and any future Ya Qalbi product updates you opt in to.

1.4 If you submit a bug report from inside the app

The flag/report button collects your note plus the lesson context (lesson ID, page type, the question you saw, your answer, and the expected answer) so we can investigate. No personally identifying information is attached unless you include it yourself in your note. Reports go to our internal Slack channel.

2. How we use your information

• Run the app for you. Sync your progress across devices, render the leaderboard, surface your profile.
• Send the launch email. One transactional email when the iOS or Android version goes live, if you joined the waitlist.
• Respond to support and bug reports. Reply to the email you used to contact us.
• Improve the curriculum. Aggregate stats like which lessons people complete most often, so we know what to expand.

We do not use your data for advertising or behavioral profiling. We do not run ad networks inside the app. We do not sell, rent, or share your data with anyone for marketing purposes.

3. Service providers we use

Three services receive parts of your data so the app can function:

• Supabase (database + authentication). Stores your profile and progress. Supabase Privacy Policy.
• Resend (transactional email). Receives your email address only when we send you an email (e.g. the waitlist launch announcement). Resend Privacy Policy.
• Vercel (web hosting for yaqalbiapp.com). May collect standard server logs (IP address, browser type, page requested) for security and performance. Vercel Privacy Policy.

These are data processors, not data resellers. They act on our instructions and cannot use your data for their own purposes.

4. Children's privacy

Ya Qalbi is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please email yaqalbiapp@gmail.com and we will delete it.

5. Your rights and choices

• Access: email us and we'll send you a copy of everything we have on you.
• Correction: edit your profile inside the app, or email us if a field isn't editable.
• Deletion: tap Settings → Sign Out → Delete Account in the app, or email us. We delete your profile, progress, and any associated rows within 7 days. The waitlist email is deleted separately on request.
• Opt out of the launch email: every email we send has an unsubscribe link, or email us to be removed from the list.
• California residents (CCPA / CPRA): you have the right to know, delete, correct, and opt out of "sale" or "sharing" of your personal information. We do not sell or share your data; the rights to know, delete, and correct are exercised by emailing us as above. You may also designate an authorized agent to make these requests on your behalf.
• EU / UK residents (GDPR): you have the rights of access, rectification, erasure, restriction, portability, and to object to processing. Email us to exercise any of these. Our legal basis for processing your account data is performance of a contract (Article 6(1)(b)). Our legal basis for the waitlist email is consent (Article 6(1)(a)).

6. Data retention

Account data is retained as long as your account is active. After you delete your account, we remove your profile and progress within 7 days. Backups expire on a 30-day rolling schedule.

7. Data security

Your data is transmitted over HTTPS and stored encrypted at rest by Supabase. Access is restricted by row-level-security policies so only you can read or modify your own data. We do not store passwords directly; authentication is handled by Apple, Google, or Supabase's built-in auth (which uses bcrypt hashing for email/password accounts).

No system is perfectly secure. If we ever experience a breach affecting your personal data, we will notify affected users by email within 72 hours of discovery, as required by applicable law.

8. International transfers

Our servers are located in the United States. If you are using the app from outside the US, your information will be transferred to and processed in the US. Supabase and our other processors maintain Standard Contractual Clauses (or equivalent transfer mechanisms) for international data transfers from the EU and UK.

9. Cookies and similar technologies

The yaqalbiapp.com website uses no tracking cookies, no analytics scripts, and no advertising pixels. The iOS app uses only the local-storage and authentication tokens needed to keep you signed in across app launches.

10. Changes to this policy

If we make material changes, we will notify signed-in users via email and update the "Last updated" date at the top of this page. Continued use of the app after the change constitutes acceptance.

11. Contact

Questions, requests, or complaints:

yaqalbiapp@gmail.com
Chay Dib · Chayland Design · California, USA