Privacy Policy

Welcome to Nahw Academy (https://www.nahww.com). We are committed to protecting your privacy and being transparent about how we handle your personal data. This Privacy Policy explains what information we collect when you use our interactive Arabic grammar learning platform, why we collect it, and the choices you have.

By creating an account or using our services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the platform.

Depending on how you use Nahw Academy, we may collect the following:

• Account information: name, email address, profile picture (avatar), and password (stored in hashed form for email/password accounts only).
• Authentication data: OAuth provider identifier (e.g. Google via Firebase, or Quran Foundation), provider account ID, authorized OAuth scopes, and email verification status. For Quran Foundation sign-in, we also store OAuth access and refresh tokens to maintain your linked account and sync permitted features (such as bookmarks or collections).
• Learning data: lesson progress, exercise attempts, scores, streaks, points, time spent, achievements, and playground activity.
• Preferences: theme, language, display settings (e.g. diacritics, transliteration), learning preferences, and notification settings.
• Social features: buddy requests, Quran buddy connections, and challenge participation, where you choose to use those features.
• Technical data: IP address, browser user-agent string, session tokens, and activity logs related to sign-in and account events.

We do not intentionally collect sensitive categories of personal data such as government ID numbers, payment card details, or health information through the standard use of our platform.

We collect information through the following sign-in and account methods:

Email and password (database login)

When you register with an email address and password, we store your name and email in our database. Your password is hashed using industry-standard bcrypt hashing before storage — we never store or transmit your password in plain text.

Social sign-in via Firebase (Google)

You may sign in using Google through Firebase Authentication. When you choose this option, a sign-in popup is handled by Firebase and Google. We receive and verify a Firebase ID token on our servers, then create or link your account using your email, name, profile picture, and provider identifier. We do not receive or store your Google password.

Sign-in via Quran Foundation (Quran.com OAuth)

You may sign in or link your account using Quran Foundation OAuth (Quran.com). This uses an OAuth 2.0 authorization flow with PKCE. You are redirected to Quran Foundation to authenticate, and we receive an authorization code that we exchange for access and refresh tokens on our servers.

From this flow we receive your Quran Foundation subject identifier (sub), email address, and name (where provided). We store OAuth tokens and granted scopes in our database to keep your account linked and to access Quran Foundation features you authorize — such as bookmarks, collections, notes, or reading streaks, depending on the scopes you approve. You can also link an existing Nahw Academy account to Quran Foundation from your account settings without creating a new account.

We do not receive or store your Quran Foundation password. Token exchange and storage happen server-side only.

Quran Foundation content

Our Quran Reader feature displays Quranic text, translations, and related content sourced from the Quran Foundation Content API. This content is served through our platform and may be cached to improve performance. You do not need a Quran Foundation account to browse Quranic content, but signing in with Quran Foundation OAuth enables personalized features tied to your Quran.com account.

Automatic collection

When you sign in, we record your IP address and browser user-agent for session management, security monitoring, and activity logging. As you use lessons, exercises, and other features, we automatically save your progress and preferences to provide a personalized learning experience.

We use the information we collect to:

• Create, authenticate, and manage your account
• Deliver lessons, exercises, the Quran Reader, and other platform features
• Track and display your learning progress, streaks, and achievements
• Remember your display and learning preferences
• Sync Quran Foundation features you authorize (e.g. bookmarks, collections, notes, or streaks)
• Enable optional social features such as study buddies and challenges
• Send service-related communications and, if enabled, progress or streak reminders
• Maintain platform security, prevent abuse, and troubleshoot issues
• Improve our content, features, and user experience
• Comply with applicable legal obligations

We do not sell your personal information to third parties for their marketing purposes.

We use essential cookies to keep you signed in and to operate the platform securely. The primary session cookie is named nahw-session.

• Purpose: to authenticate your session after login
• Type: HTTP-only, secure in production, SameSite=Lax
• Duration: up to 7 days for email/password login, or up to 30 days for OAuth sign-in

Third-party authentication providers (Firebase, Google) may also set their own cookies or use local storage during the sign-in process, subject to their respective privacy policies. For more details, see our Cookie Policy.

We rely on trusted third-party services to operate Nahw Academy. These providers may process data on our behalf:

• Firebase (Google): social authentication (Google sign-in) and token verification. See Firebase Privacy.
• Google: identity provider when you choose Google sign-in. See Google Privacy Policy.
• Quran Foundation (Quran.com): OAuth sign-in and account linking, Quranic text and related scholarly content, and optional sync of user-authorized data (e.g. bookmarks and collections). See Quran.com Privacy Policy.
• Hosting & database providers: infrastructure and PostgreSQL database services used to store application data securely.

These third parties process data according to their own privacy policies and our agreements with them. We only share the minimum information necessary for each service to function.

We may share your information only in the following circumstances:

• Service providers: with vendors who help us host, secure, and operate the platform, under confidentiality obligations
• Legal requirements: when required by law, regulation, legal process, or governmental request
• Protection of rights: to protect the rights, safety, and security of Nahw Academy, our users, or the public
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice where required by law

We do not share your personal information with advertisers for targeted advertising.

We retain your personal information for as long as your account is active or as needed to provide our services. Learning progress, preferences, and account data are kept to maintain your experience across sessions.

If you delete your account or request deletion, we will remove or anonymize your personal data within a reasonable timeframe, except where we are required to retain certain records for legal, security, or fraud-prevention purposes.

Session records and activity logs may be retained for a limited period for security auditing before being deleted or aggregated.

We implement appropriate technical and organizational measures to protect your information, including:

• Password hashing with bcrypt
• HTTP-only, secure session cookies in production
• Server-side verification of Firebase authentication tokens
• Access controls and role-based permissions for administrative functions

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account and associated data
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent
• Export your data in a portable format, where applicable

You can update your name and profile picture from your account settings. To exercise other rights, contact us at ehsaan2611@gmail.com. We will respond within a reasonable time frame as required by applicable law.

You may also sign out at any time, which clears your session cookie on your device.

Nahw Academy is an educational platform intended for learners of Arabic grammar. We do not knowingly collect personal information from children under 13 (or the applicable age of digital consent in your jurisdiction) without verifiable parental consent.

If you believe a child has provided us with personal information without appropriate consent, please contact us and we will take steps to delete that information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or services. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice on the platform.

Your continued use of Nahw Academy after changes become effective constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: ehsaan2611@gmail.com
• Website: https://www.nahww.com

For terms governing use of the platform, please see our Terms of Service.