The short version. We collect the information needed to run a Qur'ānic learning platform for schools, teachers, parents and students. We do not sell personal information, we do not show advertising, and we do not use analytics or advertising trackers. Student information is shared only with the people who need it for the student’s education. AI features send only the minimum, with names, contact details and ids replaced by placeholders where our systems support it. You can see, export and ask us to delete your data. The detail is below.
This Privacy Policy explains how Shams AI (“we”, “us”) handles personal information when you use Shams AI, including our website, web application, mobile apps, notifications and AI features (the “Service”). You can reach us at support@shamsai.app.
Our role depends on the information:
We collect only what the Service needs. The categories below describe what exists in the Service; which of them apply to you depends on your role and on which features your school or you switch on.
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identity | Name, username, email address, mobile number (if you give one), role, password (stored only as a one-way hash), sign-in method, two-step sign-in settings, profile picture, language and appearance settings, time zone | You, or the school or parent who created the account |
| Student profile | Date of birth or age, gender, school, programme and class, teachers, parent links, enrolment details, and whatever else a school’s enrolment form asks (which may include emergency contacts and, where the school chooses, health or safety information, and uploaded documents) | The school, the parent or guardian, the student |
| Learning records | Daily lesson records (memorisation, revision, attached lessons, Nazirah/fluency, book lessons, tajweed), mistakes, performance ratings, comments, homework, attendance and absence requests, Juz-known data, goals, milestones, streaks, exams and test results, report-card comments, plans and forecasts, teacher encouragement, student check-ins, home-revision logs | Teachers, administrators, parents, the student; generated by the Service from those records |
| Student game and recognition | Points, coins, gems, badges, quests, items, leaderboard standing, Student-of-the-Month choices (a child is named to others only where the school and family allow it) | Generated from learning records and from the student’s own choices |
| Behaviour, notes and safety | Behaviour notices and student notes written by staff, parent notes and du‘ā sent through the Service, reports made about a message and their outcome | Staff, parents, other users |
| Messages and communications | Chat and direct messages (including earlier versions of edited or deleted messages), announcements, parent contact messages, student mailbox messages (for students who have one), attachments, delivery and read records | You and other users; inbound email to a student mailbox |
| Recitation recordings (optional) | Audio of a student’s recitation, with the date, the lesson and the student’s consent record. Recording is off unless the school switches it on and a parent (or an adult student) consents | The student, through the app |
| Uploads | Books and PDFs, enrolment documents, certificates settings and school logos, profile pictures | Schools, teachers, parents |
| Payments and billing | For subscriptions and school fees: amounts, dates, plan, status, billing contacts, tax details you give, and a payment-provider reference. Card numbers are entered with our payment provider (Stripe) and are not stored by us | You; our payment provider |
| Notifications and devices | Notification preferences, delivery records, web-push subscription details (a device endpoint your browser gives us), mobile number and its verification and opt-out status, quiet hours, study reminders | You; your browser or device |
| AI interactions | What you ask an AI feature and its answers (stored in your conversation history), approval and undo records for actions the Shams Agent takes, AI usage records (counts, time, feature and amount of text processed, never the text itself), consent records, and AI-generated reports and feedback you save | You; the AI features |
| Technical and security information | IP address, browser and device type, operating system, language, request and error logs with a request identifier, sign-in and two-step events, security and rate-limit events, and an audit log of significant changes (who changed what, and when) for school workspaces | Your device and our servers |
| Staff information | Teacher availability, leave (the reason is not copied into logs or notices), class cover, staff attendance where a school uses it, and scorecard measures | The school, the teacher |
| Support and feedback | What you send us through forms, email, bug reports and feedback | You |
Because Shams AI supports Qur'ānic learning, the fact that a person uses it, and their learning records, may reveal religious belief or practice. Some privacy laws treat that as especially sensitive. We use it only to provide the Service to you and your school; we do not use it for advertising, profiling for other purposes, or inferences about people. By creating an account, or by having an account created for you or your child by a school or parent, you (or they, on your behalf) agree to that processing, and you can withdraw consent by deleting the account as described below.
We do not run advertising or behavioural-analytics trackers and we do not use session-replay, fingerprinting or cross-site tracking. Our email does not use open-tracking or click-tracking. We do not collect precise location, contacts, or biometric identifiers. We do not currently apply voice-recognition, speaker-identification or automated speech analysis to recitation recordings.
| Purpose | Legal basis (where such a basis is required) |
|---|---|
| Provide, run, secure and support the Service; create accounts; show students’ progress to their teachers and parents; produce reports and analytics | Performing our contract with you or, for a school’s workspace, acting on the school’s instructions; the school’s legitimate educational purposes |
| Send service messages (security codes, receipts, account and school notices, attendance and progress notices you or your school have turned on) | Contract; legitimate interests in keeping you informed; consent for optional channels such as text, WhatsApp and push |
| Process payments and manage subscriptions, prevent fraud, meet tax and accounting duties | Contract; legal obligation; legitimate interests |
| Keep the Service safe: detect abuse, protect children, investigate reports, maintain audit trails, prevent unauthorised access | Legitimate interests; legal obligation; the vital interests of a child where needed |
| AI features | Contract and the school’s instructions; consent where required (always for children’s features, which need a parent’s permission); see the AI Use Notice |
| Optional features that involve a child’s voice, naming a child to others, or home-revision sharing | Consent of the parent or guardian (or of an adult student) |
| Improve and develop the Service using de-identified or aggregated information, and fix errors | Legitimate interests |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
We do not sell personal information, we do not “share” it for cross-context behavioural advertising, and we do not use student information for advertising or to build profiles for any purpose other than the school’s educational purpose. We do not make decisions that have legal or similarly significant effects on a person solely by automated means; people review the output.
Many users of the Service are children. We design for them as follows.
If you believe we have collected a child’s information without proper authority, contact support@shamsai.app and we will investigate and delete it where appropriate.
Some features use third-party AI services to write reports, answer questions, draft text or suggest plans. The AI Use Notice is the detailed statement and forms part of this policy. In brief: AI features run only where the role, school settings and consent allow; before information is sent to an AI service our systems replace names, contact details and identifiers with placeholders and strip identifiers where supported, and put the real names back only in what you see; we do not use your content to train our own models; AI providers process content under their business terms; conversations are stored and retained as set out in the retention table; and a person reviews output before it matters.
Checks on what students say to the AI. Where a student uses the learning coach or Shams Agent, an automatic system reads what the student writes, and what the assistant answers, for unsafe content (for example a student saying they are hurt or unsafe, bullying, or inappropriate language). It never stops a child from being answered. When something matches, it records a flag for the student’s school or independent teacher that shows the student, which assistant, when, and the kind of concern, but not the words. Staff do not read the conversation through this; a parent can read it where they have allowed the coach. A school can also add words of its own, and an answer that contains one is held back. The checker understands English only and is not a substitute for a person looking out for a child.
With your choice we may send notifications by in-app notice, email, web or mobile push, and, only if you turn it on and give your number, text (SMS) and WhatsApp messages. Text and WhatsApp messages contain the sender, a short fixed phrase and a link: never a child’s name, notes or the content of a message, and students are never texted. You can switch each channel off in Settings, reply STOP to a text, and use the unsubscribe link in email. See the Messaging Terms. Mobile numbers are used for notifications and sign-in codes only and are not shared with third parties for marketing.
We use first-party cookies and browser storage only to keep you signed in, protect against forgery and remember settings. We do not use advertising or analytics cookies. Details, including a list, are in the Cookie and Storage Policy. Our pages request fonts and code libraries from content-delivery services (such as Google Fonts, cdnjs and jsDelivr) and payment pages load Stripe’s scripts, so those providers receive your IP address and browser details when your browser connects to them.
Do Not Track and Global Privacy Control. Because we do not track users across sites or use their data for targeted advertising, our practices do not change when your browser sends a Do Not Track or Global Privacy Control signal.
We share personal information only as follows, and never for sale or advertising:
These are the categories of providers we use and what they do. Where more than one is shown for a function, the ones actually used depend on configuration, and the provider currently in use for AI is displayed in the assistant.
| Provider | Function | Information involved |
|---|---|---|
| Cloud application hosting (Fly.io; Heroku as an alternative host) and managed Redis | Runs the Service, background jobs and caching | All Service data in transit and in memory |
| Supabase (database and private file storage) | Stores the database, uploads, exports, profile pictures and recordings in private storage with short-lived access links | All stored Service data |
| Stripe | Subscription billing and card payments, including connected accounts for schools collecting fees | Billing contacts, amounts, payment details entered with Stripe |
| Bird (primary) and Mailjet (backup) | Email delivery and inbound email for student mailboxes | Email addresses, email content, delivery status |
| Bird and Twilio | Text (SMS) and WhatsApp delivery and sign-in codes | Mobile number, message text |
| AI model providers: OpenAI, Google (Gemini), Microsoft (Azure OpenAI), Anthropic, DeepSeek and Cerebras (one primary and, optionally, one fallback) | Generate AI output | Content submitted to an AI feature, with names, contacts and ids replaced where supported; see the AI Use Notice |
| Sentry | Error monitoring | Error details; configured to exclude request bodies, cookies and personal profile data |
| Google, Microsoft, Apple | Optional sign-in | Your verified email and sign-in confirmation, only if you choose them |
| Browser push services (such as those run by Apple, Google, Mozilla and Microsoft) | Deliver web-push notifications to your device | Notification content and device endpoint |
| Google Fonts, cdnjs (Cloudflare), jsDelivr, Stripe.js, OpenStreetMap Nominatim, Cloudflare DNS over HTTPS | Fonts and code libraries; payment forms; address search; domain verification for school single sign-on | IP address and browser details; address text you search; a school’s domain name |
| Backup storage | Encrypted backups for recovery | Copies of Service data |
We review providers’ security and privacy commitments and we require them to protect the information, use it only to provide their service to us, and not to use it for their own marketing. We will update this list when providers change; schools will be told of a material change as the Data Processing Addendum describes.
Our systems and providers are mainly in the United States, and some providers (including AI providers) process information in other countries. If you use the Service from elsewhere, your information will be transferred to and processed in countries whose data-protection laws may differ from yours. Where the law requires, we rely on an approved transfer mechanism, such as the European Commission’s Standard Contractual Clauses and the UK addendum, adequacy decisions or your consent, and we require appropriate safeguards of our providers.
We keep personal information only as long as needed for the purposes above, then delete or de-identify it. A school or independent teacher that controls its records may set shorter periods where the Service lets it. Unless a school’s settings or the law say otherwise, our standard periods are:
| Information | How long |
|---|---|
| Account and learning records | While the account (or the school’s workspace) is active. On deletion: see “Deleting an account” below. |
| Data export files you request | A personal export is available for download for 24 hours; a school data export for 7 days, after which the file is removed. |
| In-app notifications and delivery records | Read notices 90 days, unread notices 180 days; email and provider event logs 90 days. |
| Learning-coach conversations | 90 days (a school or the law may set a different period between 1 and 365 days), then deleted automatically. |
| Shams Agent activity (runs, steps and approvals) | 365 days; drafts 90 days; documents the agent created 90 days; unconfirmed approval prompts 30 minutes. |
| AI usage records (counts and cost, not text) | Up to 400 days. |
| Recitation recordings | Set by the school or teacher between 7 and 365 days, or sooner if a parent withdraws consent, the child changes school, or a recording is deleted. Deletion removes the audio first. |
| Student-mailbox messages | Messages a student deletes are kept hidden for up to 90 days while a school oversees the mailbox (and longer while a safety flag is open), then deleted. |
| Parent notes; home-revision logs | Parent notes up to 12 months; home-revision logs 24 months (or 30 days after the family link ends). |
| Student sessions on staff devices | 12 months. |
| Activity (audit) log of a school’s changes | Up to 3 years; finance-related events up to 7 years. |
| Billing and tax records | As long as tax, accounting and payment laws require. |
| Security and server logs | Kept for a limited period needed for security and troubleshooting. |
| Backups | Encrypted backups are kept for up to about 62 days, then overwritten or destroyed. Information you delete may remain in backups until then and is not restored to the live Service afterwards except to recover from a failure. |
| Record that a deletion or export happened | Kept without identifying you, as proof that we honoured a request. |
When you ask to delete an account (or a parent asks to delete a child’s account), the account is switched off at once and you have 14 days to change your mind. After that, the account and its learning records are permanently removed from our systems, and from our backups within a further period of up to 62 days. Where a parent asks to delete a child’s record held by a school, the school reviews the request first and has 30 days to respond; the school may decline for a legal or record-keeping reason, which it must explain. We may keep payment amounts and dates, and records that the law requires us to keep, in a form that does not identify the child where possible. Some deletions are blocked while a duty is outstanding (for example the only administrator of a school, or a pending payment); we explain why and how to proceed. Information about other people (such as messages you sent that others received) may remain with them, shown as deleted where the Service allows.
We protect information with technical and organisational measures that are described on our Security page, including encryption in transit, encryption at rest by our infrastructure providers, hashed passwords, role-based access, optional two-step sign-in, private storage with short-lived links, audit logs, session limits and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects personal information, we will notify affected schools, users and regulators as the law requires and without undue delay; for school workspaces, we will notify the school so it can meet its own duties.
Depending on where you live and your role, you may have the right to: access your personal information; correct it; delete it; receive a portable copy; restrict or object to some processing; withdraw consent at any time (without affecting earlier lawful processing); and not be subject to certain solely automated decisions. You also have the right to complain to your data-protection authority. We do not discriminate against anyone for exercising their rights.
European Economic Area, United Kingdom and Switzerland. We process personal information on the bases listed above. Rights listed above apply, including the right to object to processing based on legitimate interests. You may complain to your local supervisory authority.
California and other US states. In the last 12 months we collected the categories of personal information listed under “Information we collect” (identifiers, personal records, commercial information such as subscriptions, internet or device information, audio recordings, education information, inferences within the Service such as learning progress, and sensitive information such as a child’s information and information revealing religious belief). We disclosed them for business purposes to the categories of providers listed above. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not knowingly sell or share the personal information of anyone under 16. Residents of California, Colorado, Connecticut, Virginia and some other states may know, access, correct and delete their personal information, and appeal a refusal, by contacting us.
Canada, Australia and elsewhere. You may have similar rights to access and correct your information and to complain to a privacy regulator. Contact us to use them.
The Service may link to external websites and services. We do not control them and are not responsible for their privacy practices; read their policies before giving them personal information.
We may update this policy as the Service or the law changes. We will post the new version with a new effective date and, for material changes, notify you by email or in the Service at least 30 days before they take effect where we can (and tell schools sooner where the Data Processing Addendum requires). Where the law requires your consent to a change, we will ask for it.
Shams AI.