Privacy policy
Last updated 1 October 2026
The short version
- We collect only what we need to run Rafiq: your email and name, your learning progress, and, if you subscribe, your plan.
- We never sell your data, show you ads, or use advertising or tracking cookies.
- Card details are handled by Stripe. We never see or store them.
- You can delete your account and everything in it at any time, in Settings.
- Questions? Email support@rafiq-arabic.com.
- Who we are
- What we collect
- Why we use it
- Smart answer checks
- Who we share it with
- Storage on your device
- How long we keep it
- Your rights
- Children
- Changes
1. Who we are
Rafiq (rafiq-arabic.com) is an app for learning Arabic, run by a business called Rafiq, based in Leicester, United Kingdom. We are the “controller” of your personal data under the UK GDPR and the Data Protection Act 2018. You can reach us about anything in this policy at support@rafiq-arabic.com.
2. What we collect
| What | Details |
|---|---|
| Your account | Your email address, the name you give us, and your password, which is stored scrambled (hashed) so we can’t read it. |
| Where you found us | The website or link that first brought you to Rafiq (for example “instagram.com”, or a tag on a link in one of our posts). |
| Your answers at sign-up | Whether you can read Arabic, your level, how much time you have a day and, if you choose to tell us, why you’re learning. |
| Your learning | Which lessons and words you’ve done, how well you knew them, when they’re due for review, your streak and your settings. |
| Your plan | Your free week, which plan you’re on and its dates, and the reference numbers Stripe gives us. Not your card details. |
| Messages to us | What you send through “Report a problem”, the help page or by email. If you choose to include it, a copy of what was on your screen at the time (the question and your answer). |
| Technical information | When you use a report form: your browser and device type. Our hosting providers also keep short-lived logs (such as IP addresses) to keep their services secure. |
We don’t ask for, and don’t want, sensitive information such as your religious beliefs or health. Rafiq teaches Arabic that many Muslims use for prayer, but using it doesn’t record anything about your faith.
3. Why we use it, and our legal basis
- To provide Rafiq to you (contract): your account, lessons, reviews, progress across devices, your plan and payments.
- To email you about your account (contract): confirming your email, resetting your password, your welcome email, reminders before your free week ends, and messages about your plan. These aren’t marketing.
- To help you and fix problems (legitimate interests): answering your messages and reports, and keeping Rafiq secure and working.
- To keep records the law requires (legal obligation): for example, payment records for tax.
We don’t send marketing emails. If we ever want to, we’ll ask first, and you’ll be able to say no or change your mind at any time.
4. Smart answer checks
When you type an answer in your own words (a sentence, a reply in a conversation), Rafiq may check it on its meaning rather than letter by letter. To do this, the text you typed and the question are sent through our checking service (run on Cloudflare) to TypeSafe, which judges whether the answer is right. Your name and email are not sent, only the words of the question and your answer. We use the result to mark your answer and nothing else.
5. Who we share it with
We use trusted services to run Rafiq. They handle your data only on our instructions, under contracts that require them to protect it:
| Service | What it does for us |
|---|---|
| Supabase | Stores your account, progress and plan; runs our server functions. |
| Cloudflare Web Analytics | Counts visits to our pages: which pages are visited and where visitors came from, without cookies and without identifying you. |
| Stripe | Takes payments and manages subscriptions. Stripe is also responsible for your card details under its own privacy policy. |
| Resend | Sends our emails (confirmation, password reset, welcome, reminders). |
| Cloudflare and TypeSafe | Smart answer checks (see section 4). |
| GitHub Pages | Hosts the website itself. |
| Quran Foundation (Quran.com) and QuranicAudio | Provide the Quran recitation, translation and word timings in Your salah. We ask for them without sending anything about you; your browser then plays the recitation from their servers, so, like any website you visit, they see your IP address. |
| Google Fonts and jsDelivr | Deliver the fonts and a code library the pages use. Like any website you visit, they see your IP address when your browser fetches them. |
| ImprovMX and our email provider | Receive the emails you send to support@ and feedback@. |
Some of these companies store data outside the UK, for example in the United States or the European Union. When that happens, the transfer is protected by the safeguards UK law requires, such as the UK’s International Data Transfer Agreement or addendum, or a UK “adequacy” decision.
We never sell your data. We’d only share it with anyone else if the law requires us to, or to protect people’s safety.
6. Storage on your device
Rafiq doesn’t use advertising or tracking cookies, and doesn’t use analytics that follow you around the web. We count visits to our pages with Cloudflare Web Analytics, which uses no cookies and stores nothing on your device. On the sign-up page we also count, per day, how many people open it from “Start your free week” and press the buttons to create an account, without recording who. Your browser does store a few things for Rafiq, all needed for it to work:
- keeping you signed in (in a web browser, signing you out after 24 hours without use, for safety on shared devices; the app on your home screen keeps you signed in)
- your settings, such as the voice, sounds, keyboard and theme
- a copy of your progress, so lessons still work when your signal drops
- where you first came from (for example a link in an Instagram post), which is saved with your account if you sign up, so we know which posts help people find Rafiq
Clearing your browser’s site data removes these; your progress is kept safely in your account.
7. How long we keep it
- Your account and learning: until you delete your account. Deleting it (Settings → Delete my account) removes your account, progress and settings straight away.
- Payment records: Stripe keeps records of payments, and we keep invoices, for 6 years, as UK tax law requires, even after an account is deleted.
- Messages and reports: for as long as we need them to help you, and no longer than 2 years.
- Backups: our database provider keeps short-term backups, which are overwritten within days.
8. Your rights
Under UK data protection law you have the right to:
- see the personal data we hold about you and get a copy of it
- correct anything that’s wrong (you can change your name in Settings)
- delete your data, which you can do yourself in Settings
- take your data with you in a common format
- object to, or ask us to restrict, how we use it
To use any of these, email support@rafiq-arabic.com. We’ll reply within one month. If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.
9. Children
Rafiq is for people aged 13 and over. Children under 13 can use Rafiq only with a parent or guardian’s permission: the parent or guardian should set up the account, or agree to it, and is responsible for any subscription. If you’re under 18, please ask a parent or guardian before you subscribe. If you think a child under 13 has an account without a parent’s permission, email us and we’ll delete it.
10. Changes to this policy
If we change this policy, we’ll update the date at the top. If a change affects you in a big way, we’ll tell you by email or in the app before it happens.