Loading…
How we handle your personal data.
Draft for review — this policy is a starting point and is not yet legally binding. It must be reviewed by qualified counsel and the bracketed details completed before launch.
Alif Academy (“we”, “us”) operates this Arabic and Qur’anic learning service (the “Service”). The data controller is iTechfinity LLC, registered at 4468 Oakdale Crescent CT, 937, Fairfax, VA, 22030, USA. For any privacy question or to exercise your rights, contact us at support@langhawks.com.
Account data you provide at sign-up: your name, email address, password (stored only as a secure hash by our authentication provider — we never see it), and — where you choose to provide them — a phone number and date of birth. For a child or student account, the information a parent, guardian or teacher provides about that learner.
Learning data generated as you use the Service: lessons completed, progress, XP, streaks, assessment results, settings and preferences.
Technical data: an approximate country derived from your device’s time-zone at sign-up (coarse, not precise location), and information stored locally in your browser (see “Cookies and local storage”).
To create and secure your account; to deliver lessons and save your progress across devices; to send transactional messages necessary to run your account (activation links, password resets, security and billing notices); with your consent, to send optional progress reminders and updates; to understand aggregate usage so we can improve the Service; and to comply with legal obligations.
[FOR EU/UK USERS — CONFIRM WITH COUNSEL] We rely on: performance of our contract with you (to provide the Service); your consent (for optional marketing/notifications, withdrawable at any time); our legitimate interests (to secure and improve the Service); and legal obligation (e.g. to retain billing records). Where we rely on consent, you may withdraw it without affecting prior processing.
We do not use third-party advertising or analytics trackers. We do use storage that is strictly necessary to run the Service: our authentication provider sets a session token so you stay logged in, and we cache your settings and a copy of your progress in your browser’s local storage for instant, offline-friendly reads. Clearing your browser storage signs you out and removes the local cache; your account data on our servers is unaffected.
We do not sell your personal data. We share it only with service providers that run the Service for us, under contract, and only what each one needs: Supabase (sign-in, database and hosting); Resend (sending our emails — account, consent, billing and class messages); Stripe (payments, when paid features are switched on — we never see or store full card numbers); and Google (only if you choose to sign in with Google). [CONFIRM WITH COUNSEL: a data-processing agreement is in place with each.]
Your browser also loads our fonts from Google Fonts and, in the Qur’an reader, recitation audio from everyayah.com. Like any website, those services receive your device’s IP address when your browser requests the file, but no account details. Our administrators’ map of sign-ups uses Google Maps with city-level counts only — never names or contact details. Lesson voices are generated with Microsoft Azure text-to-speech from our own lesson text; no user data is sent to it. We may disclose data where required by law.
Children use the Service only through a parent, legal guardian or authorised teacher (a “Guardian”), who adds the learner from their own account. A child under 13 cannot create their own account.
How we get consent (“email plus”). When a Guardian adds a learner under 16, the Guardian ticks a consent statement. We then email a confirmation link to the Guardian’s own sign-in address; the link is signed and expires after 7 days. When the Guardian opens it and presses Confirm, we record the consent — the date and time, the version of this policy, and a one-way hash of the request’s network details (never the IP address itself) — and send a second email confirming it. Until consent is confirmed the learner’s account is limited: lessons can be used on the Guardian’s own device, but the learner cannot have their own sign-in and cannot join live video classes. Live video classes need a separate consent, which the Guardian gives or withdraws in Manage Accounts. We use this method because we do not disclose children’s personal information to third parties. [CONFIRM WITH COUNSEL]
What we collect from or about a child: the name, date of birth and (optionally) grade the Guardian enters; lesson progress, points, streaks and assessment results; daily activity totals (see section 13); and, only if the Guardian gives the learner their own sign-in, an email address and a password held by our sign-in provider. A leaderboard name is shown to other learners only if the Guardian turns it on. We do not show ads, do not sell or rent children’s data, do not use it for marketing, and do not send it to any AI service. (Speech recognition is switched off while a child is learning: the browser’s recogniser can send the audio to the browser maker, so a child’s speaking activities fall back to “read it aloud and mark yourself”, and no child audio leaves the device.)
Your rights as a Guardian, and how to use them. Review: open Manage Accounts and choose the learner to see their details and progress, or download everything we hold with “Download my data” in Settings. Correct: edit the details on the learner’s page and save. Delete: on the learner’s page choose “Delete this learner” — this permanently deletes the profile, the learner’s own sign-in and all their progress; deleting your own account deletes your children’s profiles too. Withdraw consent: on the learner’s page choose “Withdraw consent”, or turn off “Live video classes”; this stops further collection under that consent and returns the learner to the limited state, and you can then delete the data. You can also email support@langhawks.com and we will act within [30] days. [CONFIRM WITH COUNSEL]
We keep your account and learning data while your account is in use. Child learners: when a learner under 18 who is managed by a Guardian has had no activity for 24 months — no lesson progress and no sign-in — we delete the learner’s profile and progress automatically. We email the Guardian 30 days before the deletion date; opening any lesson as that learner before then keeps the account. Daily activity totals are kept for 13 months (section 13).
When you delete your account or a learner, we delete or anonymise the data straight away, except records the law requires us to keep. Billing records (orders, invoices, charges and refunds) are kept for as long as tax and accounting law requires — typically 6 to 10 years — with names, email and postal addresses removed. We keep a record that an erasure took place, holding no personal data, to show that we complied. A consent record keeps nothing about the child once the learner is deleted — only that a consent was given, when, and under which version of this policy. [CONFIRM RETENTION PERIODS, INCLUDING BACKUP COPIES, WITH COUNSEL.]
Subject to your local law, you may request access to the personal data we hold about you, correct inaccurate data, delete your account and data, object to or restrict certain processing, withdraw consent, and request a copy of your data in a portable format. You can delete your account from your profile settings today; for the other requests, contact support@langhawks.com. You also have the right to complain to your local data-protection authority.
Passwords are handled by our authentication provider and stored only as secure hashes. Access to personal data on the server is restricted by row-level security so each account can reach only its own data. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the relevant authority of a breach where required by law.
[CONFIRM WITH COUNSEL] Our providers may process data in countries other than yours. Where required, such transfers are made under appropriate safeguards (for example, standard contractual clauses).
We may update this Privacy Policy from time to time; material changes will be notified in-app or by email. Questions or requests: support@langhawks.com, iTechfinity LLC, 4468 Oakdale Crescent CT, 937, Fairfax, VA, 22030, USA.
We record how many days you are active, minutes spent, sessions, and sign-ins — daily totals only, never a page-by-page log, never your exact click times, IP address or device fingerprint. This is used to run and improve the Service and to support you (or your child, if you are a parent or guardian) — never for advertising, and it is never sold. We keep these daily totals for 13 months. You (and your guardian, if you are a child account) can see your own numbers in Settings → “Your activity”; Alif Academy admins can see aggregate and per-account numbers to operate the Service.
Some speaking activities ask you to say a line out loud. Your microphone is used only while you are on that activity, only after your browser has asked your permission, and you can always skip it. Alif Academy does not record, upload or store your voice: no audio is ever sent to our servers.
To judge what you said, we use the speech-recognition feature built into your browser. In some browsers — including Google Chrome and Microsoft Edge — that feature sends the recorded utterance to the browser maker’s own speech service (Google or Microsoft) to be turned into text, under that company’s privacy policy rather than ours. Only the resulting text returns to the page, where it is compared with the expected sentence and then discarded; it is not saved on your device or ours. If you would rather no audio left your device, do not use the microphone: every speaking activity can be skipped, and the rest of the lesson works without it.
Lesson voices and illustrations are AI-generated.
There is no AI chat in the app, and we do not use AI to make decisions about you or your child.
© 2026 Alif Academy, a product of iTechfinity LLC. All rights reserved.