Privacy Policy

1. Who we are

QalaMishkat is an educational eLearning platform for teaching Tajweed, memorization, and understanding of the Quran. It is operated as a project of the dawasite ecosystem and contactable at partakeinprogress@gmail.com.

2. Information we collect

We collect the minimum information needed to deliver the Service:

• Account information: full name, email address, hashed password, and chosen role (student, teacher, or admin) when you sign up.
• Email verification token: created by Supabase Auth when you sign up; deleted after verification.
• Class data: classes you create as a teacher, the classes you join as a student, the rules you select, and your enrollment record.
• Learning activity: per-attempt records of which verse you saw, which rule was being practiced, what hints you used, and whether the attempt was correct. We use these records solely to show your progress and to let your teacher review their class.
• AI assist prompts: when a teacher uses the “Generate with AI” feature, the natural-language intent they typed and the recitation context are sent to our backend and to Anthropic for processing. Prompts are not used to train models.
• Technical logs: minimal request metadata (timestamp, route, status code) for debugging and abuse prevention. We do not log personally identifiable user content in these logs.

We do not collect government IDs, payment information (the Service is free), location data, contact lists, or device sensors.

3. How we use it

We use the information above to:

• Authenticate you and keep your session secure.
• Enable teachers to design classes and students to take them.
• Display your learning progress to you and to your teacher.
• Generate AI-assisted class suggestions when a teacher uses that feature.
• Detect abuse, debug errors, and keep the Service available.
• Send transactional emails (sign-up verification, password resets, admin invitations).

4. Where your data is stored

Your account, profile, and class data are stored in our Supabase project (Postgres). Authentication is handled by Supabase Auth. Static assets and server functions are hosted on Vercel. We rely on row-level security policies in the database so that one user cannot read or modify another user’s data unless explicitly permitted (for example, a teacher reading enrollments in their own class).

5. Third parties we work with

• Supabase: database, authentication, and email delivery for sign-up verification and admin invitations.
• Vercel: hosting and edge network. Vercel may log request metadata for the operation of its platform.
• Anthropic: processes the natural-language input you send through the “Generate with AI” feature. Per Anthropic’s policy, prompts are not used to train models.
• Quran.Foundation: source of Quranic text, tajweed tagging, reciter audio, and translations. Read-only fetches; no personal information is sent to Quran.Foundation.

Each of these providers has its own privacy policy that applies to the data they process on our behalf. We do not sell or rent personal information to any party.

6. Cookies and similar

We use first-party cookies set by Supabase Auth to keep you signed in. These are essential for the Service to function. We do not use advertising cookies, third-party trackers, or fingerprinting. Browser localStorage is used to keep small preferences such as the last route you visited.

7. Your rights

You can:

• Access the personal information we hold about you by signing into your account.
• Correct your name or other profile details by editing your profile.
• Delete your account and the associated data by emailing us at partakeinprogress@gmail.com. We will delete your profile, classes you own as a teacher, your enrollments, and your learning attempts within 30 days.
• Export your data (request a JSON copy of your account, classes, and attempts) by emailing the same address.
• Object or restrict processing where applicable under your local law.

California residents have rights under the CCPA / CPRA, including knowing what we collect and requesting deletion. EU and UK residents have rights under GDPR including portability and lodging a complaint with a supervisory authority.

8. Children’s privacy

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you are a parent or guardian and believe a child under 13 has created an account, please contact us at partakeinprogress@gmail.com and we will delete the account promptly.

For users between 13 and 18, we recommend involving a parent or guardian in the sign-up process.

9. Data retention

We keep account and learning data for as long as your account is active. After you delete your account, your data is removed within 30 days, with the exception of records we are legally required to keep (for example, tax or fraud-prevention records, none of which currently apply since the Service is free).

10. Security

Passwords are stored hashed by Supabase Auth. All traffic is over HTTPS. Database access is gated by row-level security. The service-role API key that bypasses row-level security is held in a server-only environment variable and never sent to the browser. Despite our efforts, no system is perfectly secure; please notify us if you believe an account has been compromised.

11. International transfers

Our infrastructure providers may store and process data in regions outside your home country (typically the United States). When we transfer personal information internationally, we rely on the legal mechanisms provided by those providers (for example, Standard Contractual Clauses for transfers from the EU).

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective” date at the top of the page shows when the most recent version took effect. Material changes will be announced in the application or by email.

13. Contact

Questions, requests, or complaints? Email partakeinprogress@gmail.com.