Privacy Policy — Qalam Altalib

Effective date: 3 November 2026 · Developer (data controller): Ali Al-Qarni (علي القرني), Saudi Arabia · Contact: ali5250111@gmail.com · +966555821452

Qalam Altalib ("the app") is a free, ad-supported homework helper for school students. You photograph a question and the app explains the solution step by step. We collect as little as possible: no sign-up, no name, no email, no phone number. This policy is written to meet Apple's App Store rules, the US Children's Online Privacy Protection Act (COPPA) and the Saudi Personal Data Protection Law (PDPL).

1. What we process and why

Data	Purpose	Where it goes	Retention
Random anonymous device ID (UUID), created by the app and stored in the iPhone Keychain	Daily free-solve counter, reward-ad limits, abuse prevention, linking your push token so it can be deleted	Supabase (our server)	Until you tap "Delete my account & data"
Photo of the question (only the area you choose)	To solve it	Compressed on your device, sent over TLS to our server and on to Anthropic	Not saved by our server: it is held in memory only while the request runs. Anthropic may keep it for a limited period (see §3)
Text read from the photo (OCR, done on your device)	To solve it, and to reuse answers to identical questions	Our server, Anthropic	Not stored as text. Only a one-way SHA-256 hash of it is used as a cache key
Cached answer (hash key + the answer + hit count)	Reply instantly to repeated questions at no cost	Supabase	Served for up to 180 days, then no longer used. The cache holds no photo and no device ID
Daily quota counters (solves used, bonus solves, reward-ad count and time)	Enforce 10 free solves a day, +3 per rewarded ad	Supabase, one row per device per day	Short-term: needed only for the current day. Rows older than 7 days are deleted automatically by a daily job, and are deleted at once when you delete your data
Push token and language (only if you allow notifications)	Send study reminders and app news	Supabase (token), Firebase Cloud Messaging (Google) for delivery	Until you turn push off or delete your data
Age group, consent choices, solution history, settings	Child protection, ad settings, reviewing past solutions	Stay on your device	Until you delete them or the app
Advertising identifier (IDFA, only if you are 18+ and allow tracking), device and ad-interaction data	Show and measure ads	Google AdMob	Per Google's policy

We do not sell personal data, we do not build profiles, and we do not use your photos to train AI models.

2. Camera and photos

The camera and photo library are used only when you tap to photograph or pick a question. Please don't photograph names, phone numbers, ID numbers or faces. The AI is instructed to ignore and never repeat personal data it sees.

3. Service providers (processors)

Provider	Role	Location
Supabase Inc.	Server functions and database	Seoul, South Korea (ap-northeast-2)
Anthropic PBC (Claude)	Produces the step-by-step solution	United States
Google LLC — AdMob	Ads, consent (UMP)	United States / global
Google LLC — Firebase Cloud Messaging	Push notification delivery only	United States / global
Apple	On-device AI (Foundation Models), OCR, App Store	On your device

Simple English questions may be solved by Apple's on-device model, in which case nothing leaves your phone.
Under Anthropic's commercial terms, API data is not used to train its models; Anthropic may retain inputs for a limited period for trust-and-safety purposes.
Data transfers outside Saudi Arabia are explained in our Cross-border Data Transfer Terms.

4. Children

The app asks for an age group on first launch (age gate). It has no accounts and collects no names or contact details from anyone.
Under 13: all ad requests are tagged as child-directed (COPPA, `tagForChildDirectedTreatment`) and limited to non-personalised, G-rated ads; we never request tracking (ATT) and never use the IDFA.
13–17: ads are tagged as under the age of consent (`tagForUnderAgeOfConsent`), non-personalised, with no tracking.
Parental consent: a child under 13 should use the app with a parent's or guardian's permission. Because we do not collect a child's name, contact details or IDFA, the only identifier is the random device ID, which a parent can erase at any time with "Delete my account & data", or by emailing us.
Parents may contact us to review or delete their child's data: ali5250111@gmail.com.

5. Ads and consent

Ads come from Google AdMob. Where required (e.g. EEA/UK) a Google consent form (UMP) is shown, and you can change your choice from Settings → Ad privacy. Apple's tracking prompt (ATT) is shown only to users aged 18+; if you decline, ads are non-personalised.

6. Legal basis (PDPL)

We process data on the basis of your consent (given in the app on first launch and through the iOS permission prompts) and because processing is necessary to provide the service you ask for. You may withdraw consent at any time by turning permissions off or deleting your data.

7. Your rights

Under the PDPL (and similar laws) you have the right to: be informed; access your data and get a copy; correct it; have it deleted; withdraw consent; and complain.

Delete: Settings → Delete my account & data deletes your quota counters and push token from our server, wipes your history on the device and gives you a new anonymous ID. It works instantly and needs no email.
Access or other requests: email ali5250111@gmail.com (include the device ID shown in the app if you have it). We reply within 30 days.
Complaints: you may complain to the Saudi Data & AI Authority (SDAIA) or your local authority.

8. Security and breaches

See our Security page and our Data Breach Response Plan. If a breach affects your data we will notify SDAIA within 72 hours and inform affected users without undue delay.

9. Changes

We will post updates on this page and change the effective date. Material changes are shown in the app.

10. Contact

Ali Al-Qarni · ali5250111@gmail.com · +966555821452 · Saudi Arabia