Privacy Policy

Last updated: 2 November 2026

1. Who we are

Sharihah ("we") is responsible for your data and runs the Sharihah website, iPhone app and API (together the "Service"). We process personal data under the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

2. What we collect

• Account identifier: an anonymous identifier from Sign in with Apple or Google. We do not keep your email, name or photo.
• What you add: the deck description, your answers, the files, links and text you upload, your organisation's template and logo, and the decks we build.
• Subscription status: Apple's signed proof of purchase (transaction id, plan, expiry), or a signed notice from Polar if you subscribe on the website (plan and expiry). We never see or store your card details.
• Usage numbers (optional): stage times, question counts and your rating, never your content, and only if you allow them.
• Notification token: if you allow notifications on iPhone. Notifications never carry your deck's title or content.
• API keys: if you create one, we store only its hash and cannot show it to you again.
• Reviewers' notes: if you share a deck by review link, we keep what the reviewer writes (decision, note, and name if given).
• Security log: sensitive events (sign-in, account changes, rejected attempts) with no content and a hashed IP that does not identify you.

We do not collect your location, contacts or advertising identifier, and we use no third-party trackers or ads.

3. Why we use it

Only to provide the Service: reading your references, asking questions, building and editing the deck, keeping your decks in your account, applying your plan's limits and protecting the Service from abuse. Our basis is performing the service you asked for, and your explicit consent where we ask for it (sending your texts and files to the AI provider, usage numbers). We do not sell or rent your data, use it for advertising, or train our own models on it.

4. Who receives it (processors)

• The AI provider (—): receives your texts and files only after your explicit consent, which you can withdraw at any time. We enable a provider only after confirming its commitment not to train on your data. It may process data outside Saudi Arabia. Without your consent nothing is sent and the deck is built on the local path.
• Hosting and storage: Google Cloud, to run the Service, hold temporary files and schedule jobs.
• Database: Supabase (PostgreSQL) for accounts and decks. The provider has no region inside Saudi Arabia at present, so this data may be stored outside the Kingdom (Europe or Asia, depending on the region chosen).
• Moyasar: if you pay on the website. A Saudi payment gateway that receives your card or mada details directly on its own page and tells us only that the invoice was paid (invoice number and amount). We never see or store your card details.
• Polar: if you subscribe on the website. Polar is the seller of record; it receives your email and payment details from you directly on its own page and sends us only your subscription status with your account number here. We never see your card details.
• Apple and Google: only to verify sign-in and subscriptions.
• Voice input: we never receive or store your voice. On iPhone speech becomes text on your device. On the website your browser converts it: on your device where supported, otherwise through the browser's own speech service (Google in Chrome, Apple in Safari) and only after you agree in that browser. We receive only the text, after you review and send it.
• Wikimedia Commons: if you choose web photos, short English search words describing a photo, nothing else.

When data leaves the Kingdom we follow the safeguards the law requires and transfer only what the Service needs.

5. Google user data

Google sign-in requests the basic openid scope only, and we store only the anonymous identifier. We do not access your Google email or files and do not share any Google data with third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Review links

If you create a review link, anyone who has it can open the deck and leave a note without an account, for 7 days or until you cancel it. Share it only with people you trust. We store a digest of the link, not the link itself.

7. Retention

Sessions, files and decks are deleted automatically 7 days after the last change, unless you keep a deck. Usage numbers and AI call records (numbers only) are deleted after 90 days. Your account identifier stays until you delete the account, and deleting it removes all your data immediately.

8. Your rights

• See your data and where it goes ("Where my data goes" in Settings).
• Ask us to correct your data or send you a copy.
• Withdraw consent for texts, files or usage numbers at any time, without affecting what happened before.
• Delete your account and all its data from Settings on the web or in the app; this also revokes Sign in with Apple.
• Complain to the Saudi Data and AI Authority (SDAIA) if you believe your data was handled unlawfully.

9. Security

Connections to the Service and to its database are encrypted (HTTPS/TLS). Sign-in uses a signed session token you can withdraw from every device with "Sign out everywhere". Each account sees only its own data and the sensitive tokens we keep are encrypted at rest. Every Apple or Google sign-in is accepted only once, and uploaded files are cleaned of outside links before the server opens them. The site's fonts are served by us, so no third party learns that you visited. If an incident affects your personal data we will notify you and the competent authority within the periods the law sets.

10. Children

The Service is for adults at work and university and is not directed at children under 13; we do not knowingly collect children's data.

11. Contact

Questions or data requests:

We may update this policy and will post the new date above; for material changes we will tell you inside the Service before they take effect.