Privacy Policy

Version: 2026-10-14.5

Effective date: 2026-10-14.5

1. Who is responsible for your data

Operator: Founder

Postal address: N/A

Country: Uzbekistan

Privacy and support contact: [email protected]

This policy explains how Arabiyo, a free private Arabic learning hobby project for an invited circle of adults aged 18+, processes personal data. It is maintained by an individual in Uzbekistan, not presented as a registered company. The Republic of Uzbekistan Law No. ZRU-547 on Personal Data applies where the processing is within its scope. Article 3 contains a personal/household-use exception; the label “hobby” or the absence of payment does not, by itself, establish that exception. Any exemption must be assessed against the actual use and participants. The production infrastructure is in Saudi Arabia; relevant Saudi data-protection requirements must also be addressed. The current Uzbek law is the official source; LexUZ also provides a Russian text. The operator is responsible for its own account administration and security processing. The project does not represent itself as a school, commercial education provider or registered company. An invitation alone does not establish a lawful basis for processing.

2. Information we collect and where it comes from

• Accounts and invitations: your name, email address, password hash, assigned roles, account status, creation dates, invitation redemption and course enrolment. The owner may provide your email address when preparing a restricted invitation; authorised staff may enrol you in a course. Invitation codes are stored as hashes.
• Registration confirmations: your 18+ self-declaration, acceptance of Terms, separate processing and Saudi Arabia transfer/storage consents, the exact notice and document text accepted, document fingerprints and the server-recorded acceptance time. We do not collect a birth date or identity document for this self-declaration. These records are kept to establish what was acknowledged or authorised.
• Learning: lesson completion, assessment questions and snapshots, answers, revisions, attempt times and deadlines, scores, grading status and teacher feedback, including internal review notes where used. Questions, content and uploaded files may contain personal information supplied by their authors.
• Voice and other media: recordings you choose to upload, the file name, file type, file size, uploader, creation time and links to the relevant course or attempt. Avoid including other people's voices or unnecessary sensitive information.
• Listening and speaking voice messages: the host and course, joined participants, selected letters or speaking replies, feedback and timestamps. A recording preview stays on your device until you press Send. Sent teacher prompts, student pronunciation replies and voice feedback are temporarily uploaded to the platform's protected storage. Teacher prompts are available to course participants who join the room; speaking replies and feedback are available only to that student and the host. Microphone access is requested explicitly from the person recording; you can alternatively choose a short audio file. This uses ordinary uploads and playback, not peer-to-peer calls or STUN/TURN services.
• Account security: session identifiers and expiry, browser/device information and IP address where collected by authentication, password-reset records, rate-limit records and administrative/security events. The hosting or email provider may also process connection and delivery logs as described in its applicable arrangements.
• Support and rights requests: information you provide when contacting the operator, and the minimum records needed to resolve your request.

We obtain information from you, your browser, platform activity and authorised education staff. We do not request identity documents, health information, religious beliefs or other special-category information as part of ordinary account creation. Do not put unnecessary sensitive information in lesson answers, recordings or support messages.

3. Why we use information

We use account and learning information to provide authorised access, deliver courses, preserve your progress, administer assessments and enable teacher review. Security information supports authentication, account recovery, abuse prevention and the investigation of unauthorised activity. Support records allow us to respond to enquiries and exercise data-protection rights. We may retain or disclose limited information where an applicable legal obligation requires it.

At registration we ask for a separate, unselected consent to account/learning data processing and a separate, unselected consent to transfer, processing and storage in Saudi Arabia. Neither is inferred from your age confirmation, Terms acceptance or an invitation. You can decline; we then do not create an account on this Saudi-hosted service. You may withdraw either consent by emailing [email protected]. Withdrawal may require stopping access and reviewing deletion because the service depends on that processing; it does not authorise continued processing without a separate applicable basis.

Under Article 18 of the Uzbekistan Law on Personal Data, processing may be based on necessary performance of an agreement with the individual, applicable legal duties, or another permitted basis, including consent where required. Necessary security processing may serve lawful interests only where the statutory conditions are satisfied. The actual purpose, necessity and basis must be documented; legal duties and foreign-storage requirements cannot be replaced by an invitation or a general checkbox.

Where the GDPR or UK GDPR additionally applies, processing necessary to provide the service you requested may rely on performance of a contract; necessary and proportionate security and service administration may rely on legitimate interests, subject to an assessment of your rights; and specific statutory duties may rely on legal obligation. A school or public education provider may have a different applicable basis for its own processing. The operator must identify the basis for each actual processing purpose. We do not treat acceptance of Terms, an invitation code or browser microphone permission as blanket consent to processing. Where consent is required, it must be separately obtained and can be withdrawn without affecting the lawfulness of earlier processing.

The platform does not include advertising tracking, third-party analytics, the sale of personal data or AI-training use of learner recordings. If those purposes change, the operator must provide an updated notice and establish the necessary legal basis before the new processing starts.

4. Voice recordings

Microphone access is requested after you choose to record. A recording preview remains in your browser until you select Use recording, which uploads it for the exercise. Closing a preview or deleting it locally does not delete an already uploaded copy. Contact the privacy contact above if you want an uploaded recording reviewed for deletion or an alternative to a recording exercise.

Recordings are used for authorised educational review. We do not perform voice identification, create voiceprints or provide automatic pronunciation scoring. Voice recordings are personal information. Uzbekistan’s statutory definition of biometric data is broader than an identification-only technical use, so the operator must obtain an assessment of whether stored learner audio falls within that category. If it does, Article 27¹ requires the applicable data to be stored in Uzbekistan and Article 20 requires registration of the relevant database. A disclosure in this policy or consent to overseas hosting does not waive those duties. Do not upload unnecessary sensitive information; the platform does not collect genetic data.

5. Who can access information

Access is limited by role and course permissions. Authorised teachers and reviewers can inspect submissions for courses they manage. Administrators and the owner can access records necessary for authorised management and review. Other learners do not receive your private assessment answers, grades or recordings through a public class ranking or public profile.

Assessment results are hidden by default; your teacher controls ordinary result release. Those visibility settings do not remove rights you have under data-protection law to request your personal information, subject to applicable exceptions and the rights of other people.

Service providers: Oracle Cloud Infrastructure provides hosting infrastructure. The specific contracting entity and applicable data-processing terms are those in the operator’s Oracle agreement.

Password-reset email processing: [Transactional email provider and processing countries, or confirmed self-hosted email arrangements]

Providers may process information only for their documented service responsibilities and subject to the applicable agreements and safeguards. Personal data may be disclosed to public authorities where required by a valid legal obligation, or to professional advisers where necessary to address a specific legal matter. We do not grant unrelated third parties unrestricted access to learning records.

6. Where information is stored and international transfers

Hosting locations for the database, media and backups: Oracle Cloud Infrastructure, Saudi Arabia Central (Riyadh), Saudi Arabia (me-riyadh-1), for the production server, database and uploaded media.

International transfers and safeguards: [Document the applicable Uzbekistan Article 27¹ foreign-storage condition, Article 15 transfer basis and any Saudi outbound-transfer safeguards; Saudi Arabia is absent from the Resolution No. 415 list; no approved foreign-storage mechanism has yet been confirmed.]

Production use entails processing in Saudi Arabia outside Uzbekistan. Remote access from Uzbekistan and any other provider locations must be included in the transfer assessment. Oracle’s region documentation identifies Riyadh as Saudi Arabia Central. The regional choice does not establish that all support, account-management or email processing takes place only there.

For Uzbekistan citizens, the current Article 27¹ separately regulates foreign storage of data outside the categories requiring local storage: an applicable adequacy decision, approved-standard contractual/corporate rules, or compliance with approved international standards must be established. Cross-border transfer under Article 15 also requires an applicable basis. Saudi Arabia is absent from the list approved by Uzbekistan Cabinet Resolution No. 415 of 29 July 2026, effective 3 August 2026. Paragraph 4 addresses the legal, organisational and technical conditions for transfers to countries outside that list. We therefore request separate express consent to Saudi Arabia transfer and storage; this records your choice for the purposes described here, rather than asserting that all of the operator’s foreign-storage obligations have been fulfilled. We do not assert that the operator has completed an approved storage mechanism. Consent to a transfer alone is not presented as satisfying the separate foreign-storage requirements.

Hosting in Saudi Arabia also requires assessment of the applicable Saudi Personal Data Protection Law and any relevant rules for access or transfer outside the Kingdom. The Saudi Data and AI Authority publishes the applicable instruments.

Backup arrangements: No application-managed archival backup is configured for this live-testing deployment.

The operator must identify actual storage, support access and email-delivery locations. Using a local-storage implementation does not itself establish the physical country of a production server or backup. Where the GDPR, UK GDPR or another applicable law restricts transfers, the operator must use the required lawful transfer mechanism and make information about the safeguards available on request. Any applicable localisation duties must also be met; acceptance of these Terms does not override them.

7. Cookies and browser storage

The platform uses essential authentication cookies. The default session cookie is named better-auth.session_token, or __Secure-better-auth.session_token on HTTPS deployments. Its configured session lifetime is 7 days and it can be renewed during continued use. Signing out or revoking a session invalidates its access. The authentication library may also use an essential better-auth.dont_remember preference cookie for browser-session-only access. Server-side session caching in browser cookies is disabled in this configuration.

These cookies are used for the requested sign-in service, rather than advertising. Browser microphone permission is controlled by your browser. You can block cookies or revoke microphone access using browser settings, but sign-in or recording features may then be unavailable. Local recording previews use temporary browser memory/object URLs. The current platform does not install an advertising or analytics cookie consent banner because it does not include those trackers; any later addition must be assessed before use.

8. Retention and deletion

We keep personal data only while it is necessary for the stated purpose or a specific applicable obligation. The criteria are:

Data	Retention approach
Account, enrolment and progress	For active educational access; after access ends, review whether outstanding coursework, support, a dispute or a specific statutory duty still requires identifiable records. Remove or anonymise information no longer needed.
Assessment answers, grades and review notes	While needed for teaching, review, applicable assessment records or a documented dispute. Historical integrity is not, by itself, a reason for unlimited identifiable retention.
Uploaded voice recordings	The current configured cleanup threshold is 180 days from upload. Expired files are removed by the retention maintenance process. A changed setting may alter the threshold; legitimate deletion requests must also be reviewed separately.
Listening/speaking messages	Access to temporary recordings ends when the session ends, and uploaded bytes are deleted immediately where deletion succeeds. Files that cannot yet be removed stay in a cleanup queue. Recordings expire after 24 hours at the latest; expired files and abandoned upload files are removed by the scheduled expiry/retention maintenance process. Sessions close after at most 24 hours. Non-audio session, participant, answer and feedback history is removed 30 days after the session ends. Local discarded previews are never uploaded. Backup copies require the operator's documented deletion/rotation process.
Consent/acknowledgment evidence	While necessary to establish the scope and history of a permission, comply with a specific legal duty or address a documented dispute; withdrawal and data-rights requests require separate review, not unlimited retention by default.
Sessions and reset tokens	Access expires according to the authentication settings; expired or revoked records still require maintenance cleanup. Token expiry does not itself delete every database record.
Invitation and audit/security records	While necessary to establish authorised access, investigate an incident or meet a specific obligation; limit identifiers and review the continued need for them.
Support and rights requests	While needed to complete and document the response, and for a specific applicable legal requirement or dispute.
Backups and provider logs	Under the operator's documented backup rotation and provider retention arrangements; restrict access and avoid returning erased data to active use after a restore.

Deleting an account or file is not a self-service feature of the current platform. Requests are handled by the operator. Records may need to be redacted, anonymised or lawfully preserved rather than deleted indiscriminately. The operator must explain any applicable exception and must not rely only on a technical database restriction to refuse a valid request. Backup copies may remain until the applicable rotation completes, with access restricted and deletion decisions reapplied on recovery.

9. Security

The application uses password hashing, server-side sessions, role and course access checks, protected media endpoints, upload validation and request-origin checks. The operator is responsible for secure deployment, access control, updates, backups and any breach response or notification required by applicable law. No system can guarantee absolute security. Contact the operator promptly if you suspect account misuse.

10. Your choices and rights

Contact the privacy contact above to ask for access or a copy of your information, correction, deletion, restriction or an explanation of processing. Depending on the applicable law and legal basis, you may also have rights to portability, to object to processing, and to withdraw consent where it is relied on. We may ask for proportionate information to verify your identity; never send your password or invitation code with a request.

Under Uzbekistan law, correction or supplementation following your request is subject to the three-day period in Article 11; a written refusal of an information request and the response to an objection to a solely automated decision have ten-day requirements under Articles 22 and 24 respectively. Contact us in writing, including by email, to withdraw consent where it is used. You may approach the competent Uzbekistan personal-data authority or a court; the state personal-data portal provides an official starting point.

Where the GDPR additionally applies, requests normally require a response within one month, with a permitted extension of up to two further months for complex or numerous requests if you are informed within the first month. Other jurisdictions may prescribe different or shorter periods. Mandatory applicable deadlines take precedence. We will explain a lawful refusal or limitation and available complaint options. You may complain to your competent data-protection authority or seek a judicial remedy; you do not need to waive that right or contact us first. EU/EEA authorities are listed by the European Data Protection Board; UK concerns can be raised with the Information Commissioner's Office, where applicable.

11. Automated assessment processing

Objective questions can be scored using teacher-configured accepted answers, matching rules and point values; assessment deadlines are enforced automatically. Voice responses and other designated work require manual review. The platform does not itself make solely automated decisions about employment, credit or admission, or create advertising profiles. If an education provider uses a score for a significant decision, it must assess that use separately and explain any applicable review or challenge rights. Ask your teacher or the operator to review an assessment issue.

12. Age and changes

Eligibility and any guardian or school arrangements: Adults aged 18+ only; private invitation-only access.

We do not offer accounts to people under 18. If you believe a minor has been enrolled or their information has been uploaded, contact the privacy contact so the operator can restrict access and assess the necessary removal. An invitation issued in error does not make a minor eligible.

The document version and effective date appear above. Material processing changes must be communicated before the new processing starts where required. Terms acceptance does not authorise unrelated processing, and existing consent cannot be assumed to cover new purposes.