How we look after your family

You hold the account. Your children have profiles on it - no logins, no email addresses, no passwords of their own, nothing for them to lose.

For each child we store a first name, an age, and whether they are a boy or a girl. That is the whole of it. The gender is not demographics: Arabic changes the words for "I am ..." depending on who is speaking, so there is no grammatically neutral sentence to fall back on.

We never store a photograph, a surname, an address, a school, or a date of birth. We never ask for them, so there is nothing to leak.

If you tap one of the dialects we have not built yet, we store that: your account, which dialect, and when. It is how we decide what to build next, it is counted once per family however many times you tap, and it goes when your account does.

If you take a paid plan, the payment is handled by Stripe, our payment processor - behind your password, so it is your choice and not your child's. Your card details go straight to Stripe and never touch our servers; we could not see them if we tried. What we keep is small: an id that points to your account at Stripe, and whether your plan is active - which is only how the right lessons open. It goes when your account does. That, and the dialect tap above, are the only things here that are about you rather than about teaching your child.

Two things leave our server for OpenAI, who provide the AI in this product.

The phrases we read aloud. We send the Arabic text of a phrase and get audio back. Your child never has to see that text - it is only what makes the speech sound right.

What your child says into the microphone. Speaking is the product - hearing a phrase and saying it back is how a child learns here - so recording is part of using Yalla Nehki for every child, and you agreed to exactly that when you created the account. The recording is sent to be turned into text, so we can tell them how close they were; the recording itself is never stored, by us or in any library here. Nothing is sent unless your child is holding the button down. If you no longer want your child recorded, closing the account from the Family page stops everything and erases what it holds with it.

What we send is deliberately narrow: the lesson phrase to be read aloud, which can contain a first name you added when the lesson uses it, and the recording your child deliberately makes for a speaking attempt. We do not send their age, interests or whole profile with those requests. Your email address, your password and your payment details are never part of them.

The first four lessons are free for as long as you like, and always will be. A paid plan opens the rest of the road for every child on the account.

Payments run through Stripe, a payment company used by a large part of the internet. When you subscribe you enter your card on Stripe's own page, not ours - your card number and its expiry never reach our servers, and we could not charge you anything Stripe did not tell us to.

From Stripe we keep two small things: an id that points to your record at their end, and whether your plan is active, past due, or canceled - which is only how we know which lessons to open. To cancel, change your card, or read an invoice, you open Stripe's own billing page from the Family page; we do not build those screens.

If you cancel, you drop back to the free lessons and nothing you have learned is lost - every star, every phrase in review, all their progress stays exactly as it was. Taking away what a child has already learned because a plan ended is the opposite of the promise on the front of this product.

No advertising, and no advertising identifiers. Nobody is buying your child's attention here.

No analytics, no tracking pixels, no session recording, no third-party tags. Pages a child opens make no request to anybody but us. Nothing here watches what you do: the only things we record about you are the dialect you tapped to ask for and, if you subscribe, that your plan is active - both above, and each one your own deliberate choice.

No email to a child, ever. We hold no child email address to send one to. The only messages we send are to you: confirm your address, and reset your password.

We do not sell or rent your family's information. Two companies receive anything at all: OpenAI, for the two speech purposes above, and - only if you choose to pay - Stripe, to take the payment. Nobody else.

Delete a child's profile: Family page. Their progress and everything else attached to them goes at the same moment.

Delete your whole account: also on the Family page, behind your password. Nothing is removed for seven days, and the account is signed out everywhere in the meantime - signing back in during that week cancels it. After the seven days, everything goes: your account, every profile, all progress, your consent records and your email address. Emailing us works too, and either way it is complete within 30 days of your request.

Two things survive a deleted account, and we would rather say so than have you find out: our billing records of what the AI cost us, with your account stripped off them so they no longer belong to anyone; and one anonymous line saying a deletion happened, when, and how many rows went - so we can prove to you, or to a regulator, that it did. Neither can be traced back to you or your children.

Take a copy of everything: Family page, one button, one readable file - your account, each child's profile, their family and interests, and their progress. No password prompt in front of it; reading your own data is not a privilege.

Passwords are stored as scrypt hashes - we cannot read yours, and neither can anyone who obtained a copy of our database. Password reset and confirmation links are stored the same way, so a stolen backup does not hand somebody a working set of them.

Every query for your family's data is scoped to your account in the database itself rather than checked once and trusted afterwards, and there is a test suite whose entire job is to try to read one family's data as another and fail.

This is a small product run by one person. It is built carefully, and it is not backed by a security team. We would rather you knew that than assumed otherwise.