This policy explains how the “Najah” app (“the app”, “we”, “us”) collects, uses, stores and protects personal data, and what your rights are. The app is free, supported by advertising, and has no in-app purchases. It is developed and operated by Tamkeen360.
In short: we only collect what is needed to run the study services. Your data is stored on our own servers, we never sell it, and we use no third-party analytics other than Google AdMob for ads. You can delete your account and all of your data at any time from the app or from the account deletion page.
Data controller
The controller of your data is Tamkeen360, the developer of the Najah app. For privacy questions or to exercise your rights: tamkeen3600@gmail.com.
Data we collect
1. Account data
- Name, email address and/or phone number.
- Password, stored only as a one-way hash — nobody, including us, can read it.
- Your account identifier at the sign-in provider (Google or Apple) if you use it, and the email it shares with us.
- Role (student, parent, teacher), preferred language and profile photo if you add one.
2. Study data
- Level and stream, school, wilaya, and birth year and gender if you provide them (optional).
- Study activity: completed lessons, attempts, answers and results, XP, streak and badges, flashcards, bookmarks, study planner, reminders and focus timer.
- Grades and averages you enter in the grade calculator, and your goals (target average, desired programme).
3. AI tutor
- The questions you type and the replies you receive.
- Exercise photos you upload: they are processed to extract text (OCR) and generate an answer, and kept in your conversation until you delete it or your account.
4. Community and groups
- Posts, answers, comments, attached images and votes.
- Your study-group memberships and the messages you send in them.
- Reports you submit or that concern your content, and related moderation actions.
5. Private tutors and parents
- Contact requests you send to a tutor in the directory (message and chosen contact method), and your tutor profile if you register as a tutor.
- The parent link code and parent–child links.
6. Device, notifications and support
- Push tokens (APNs on iPhone, a device identifier for our own notification channel on Android), operating system and app version.
- Support requests and their content.
7. Advertising
- The advertising identifier (IDFA on iOS if you allow it in the tracking prompt, AAID on Android) and technical device information, processed by Google AdMob to serve and measure ads and prevent fraud.
- Aggregated ad events (request, impression, click, reward) recorded on our servers to calculate AI-tutor rewards.
8. Technical logs
- IP address, date and time, and requests sent to the server, for security, abuse prevention and troubleshooting.
We do not collect your precise location or your contacts, and we use no third-party analytics or tracking tools other than Google AdMob.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in and keeping it secure | Performance of the service you requested |
| Showing content for your level and stream, saving progress and results | Performance of the service |
| Answering your AI-tutor questions and processing exercise photos | Performance of the service |
| Running the community and groups, moderating and protecting users | Performance of the service, legitimate interest and protection of minors |
| Sending notifications (reminders, replies, group activity) | Your consent (can be turned off in settings) |
| Showing the ads that fund the free app | Legitimate interest, and your consent where required by law or the platform (e.g. the iOS tracking prompt) |
| Answering support requests | Performance of the service |
| Security, fraud prevention and legal obligations | Legitimate interest and legal obligation |
| Linking a parent account to a child’s account | Consent of the student (sharing the code) and the parent |
We make no automated decisions with legal effects on you. Statistics and averages shown in the app are indicative only.
Children’s privacy
The app is intended for all students, including primary-school pupils (roughly 6 to 11 years old). We therefore apply extra protections:
- Parental consent: an account for a child under 13 (or under the age of digital consent in their country) must be created with the consent and under the supervision of a parent or guardian. We encourage parents to link their account to their child’s with the link code to follow their activity. If we learn that a child is using the app without parental consent, the parent can ask us to delete the account immediately.
- Child-safe advertising: we ask Google AdMob to treat children’s ad requests as child-directed (tagForChildDirectedTreatment) and show them non-personalised ads only — no behavioural targeting or remarketing — with a maximum ad content rating of G (general audiences), using settings and ad networks certified for Google Play’s Families programme.
- Data minimisation: we only ask children for what studying requires; birth year, gender and school are optional.
- No public exposure: children’s contact details (phone, email) are never shown publicly. In the community only a short display name and level appear; all content is filtered and moderated, and any user can be reported and blocked.
- We enforce a zero-tolerance policy on any exploitation or abuse of children.
Who we share data with
We never sell or rent your personal data. We only share it where necessary with:
- Google (AdMob): the advertising identifier and technical device information to serve and measure ads, under Google’s privacy policy.
- Apple and Google (sign-in): if you choose “Continue with Apple/Google” we receive an identifier and email to verify your identity; iPhone notifications are delivered through the Apple Push Notification service.
- AI processing service provider: we send only the question text, or the text extracted from an exercise photo, to generate the answer — never your name, email, phone number or any identifier.
- Delivery providers: SMS or email providers, only to send verification codes to your number or address.
- Hosting: your data is stored in a PostgreSQL database on our own servers, which we administer ourselves.
- Other users: what you post in the community or groups is visible to the relevant users; a linked parent sees a summary of their child’s progress; a tutor receives the contact request you send them.
- Authorities: where legally required or upon a valid legal request, or to protect someone’s safety — especially in cases of child exploitation.
Retention
- Account data, study activity and content: for as long as the account exists, until you delete it.
- After deletion: data is removed from the database immediately and disappears from encrypted backups as they rotate, within 30 days at most.
- Technical and security logs: 90 days, then deleted automatically.
- Verification codes (OTP): valid for 10 minutes and stored hashed.
- Push tokens: deleted on sign-out or when the device stops responding.
- Moderation records: anonymised reports may be kept as long as needed to protect users or as required by law.
Security
- All traffic between the app and our servers is encrypted with HTTPS/TLS.
- Passwords and verification codes are hashed (bcrypt); sensitive secrets are encrypted.
- Role-based, limited staff access with two-factor authentication and an activity log.
- Rate limits against guessing and abuse, and regular encrypted backups.
No system is 100% secure, but we continuously work to protect your data and will notify you and the competent authority of any breach affecting you, as required by law.
Your rights
Under Algerian Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, you have the right to:
- information about the data we process and why (the purpose of this policy);
- access a copy of your data;
- rectification, from your profile in the app or on request;
- deletion of your account and all your data;
- objection to a specific processing on legitimate grounds, and to withdraw consent (e.g. notifications or ad tracking in your phone settings).
To exercise your rights, email tamkeen3600@gmail.com; we reply within 30 days at most. You may also lodge a complaint with Algeria’s National Authority for the Protection of Personal Data (ANPDP).
Users outside Algeria
The app is primarily intended for students in Algeria and data is processed on our servers. If you use it from another country, your local law may give you additional rights (for example the EU GDPR), which we will honour on request by email. Some services (ads, AI, sign-in) may involve transferring technical data to providers outside Algeria within the limits described above.
Account deletion
- In the app: Me → Settings/Account → “Delete account”, then confirm.
- On the web: at https://najah.tamkeen360.cloud/delete-account, verifying with your password or a code we send you.
This permanently deletes your account and all associated data as described above.
Changes to this policy
We may update this policy when our services or the law change. We will update the “last updated” date above and notify you in the app before any material change.
Contact
For any privacy question: tamkeen3600@gmail.com — Tamkeen360.