Effective date: 3 November 2026 · Responsible person: Ali Al-Qarni (data controller) · ali5250111@gmail.com · +966555821452
This plan explains what we do if personal data processed by Qalam Altalib is accessed, disclosed, changed or lost without authorisation. It follows the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
What data could be affected
Our servers hold only: random device IDs, daily quota counters, push tokens with a language code, and cached answers (no photos, no device IDs). No names, emails, phone numbers or photos are stored.
1. Detection
Monitoring of Supabase function logs, database logs and security advisors, and Anthropic and Google usage dashboards for unusual spikes.
Spending alerts on Anthropic usage.
Reports from users, researchers and providers to ali5250111@gmail.com (subject "Security").
Every report is logged with time, source and description, and acknowledged within 24 hours.
2. Containment (within hours)
Disable affected edge functions or block traffic if needed.
Rotate keys: revoke and replace the Anthropic API key and update the Supabase secret; rotate the Supabase service-role and publishable keys (the app is updated if the public key changes); rotate Firebase server credentials if affected.
Review and tighten RLS policies and database privileges.
Preserve logs and evidence before any cleanup.
3. Assessment
What data, how many devices, the time window, and the cause.
Risk to individuals, with extra weight for children.
Whether processors (Supabase, Anthropic, Google) are involved; we ask them for their incident details.
4. Notification
SDAIA: where the breach may harm individuals, we notify the Saudi Data & AI Authority within 72 hours of becoming aware of it, with the nature of the breach, data and people affected, likely consequences, measures taken, and our contact details.
Affected users: we inform them without undue delay through an in-app notice, push notification and this website, in plain Arabic and English, including what happened and what they can do (for example, delete their data from Settings). Parents of children are addressed directly in the notice.
Apple / providers: informed where their terms require it.
5. Recovery and log review
Review Supabase, function and provider logs to confirm the attacker's access is closed and no data remains exposed.
Restore services only after fixes are verified.
Delete any data that should no longer exist.
6. Post-incident report
Within 30 days we write a report covering the timeline, root cause, impact, notifications sent, and permanent fixes. We keep it as a record and update this plan and the security page if needed.
7. Testing
We review this plan at least once a year and after any major change to the app's backend.
Contact
Ali Al-Qarni · ali5250111@gmail.com · +966555821452