Privacy Policy

Section 01

Who we are

Alfaheem is an education platform provided by DoubleY. It brings recorded courses, live classes, exams, attendance and the management of schools and institutes together in one place.

DoubleY is responsible for your personal data on the platform, except when an educational organization (a school, university or centre) manages your account: the organization is then responsible for the data it enters about you, and we process it on its behalf (see Organizations).

Privacy questions: alfaheem.2y@gmail.com

Section 02

Data we collect

Data you give us:

• Account data: name, email, phone number, username, role (student, teacher, parent, organization staff) and password (stored as a one-way hash we cannot read).
• Profile data: photo, grade, school, and any extra details your organization asks for or that teacher verification requires (such as documents).
• What you upload or write: assignments and files, exam answers, messages, complaints and comments, and your questions to the AI assistant.

Data created while you use the app:

• Learning activity: the courses you join, lesson progress and view counts, grades, attendance and absences.
• Device data: device identifier, model and operating system, app version, IP address and push notification token.
• Live session data: join and leave times, display name, and what you choose to share in the session (camera, microphone, screen, board and chat).
• Security logs: sign-in attempts and sensitive actions, to protect your account.

We do not collect your precise location. Offline attendance uses Bluetooth and nearby devices only to pass your attendance through a connected classmate's phone; your location is not stored.

Section 03

Why we use your data

We use data only to:

• Create your account, sign you in and verify your email or phone.
• Deliver courses, lessons and exams, grade them, and show grades and reports to the people entitled to see them.
• Run attendance, timetables, live classes and meetings.
• Send notifications about your studies or your work on the platform.
• Protect paid content, prevent cheating and abuse, and keep your account safe.
• Answer your questions and complaints and give support.
• Improve the platform using aggregated statistics that do not identify you.
• Comply with the law and binding official requests.

We do not use your data to build advertising profiles, and we do not show third-party ads that track you.

Section 04

Google user data

You can connect your Google account to Alfaheem. When you do:

• Sign in with Google: we receive only your name, email address and profile picture, to create your account and sign you in.
• Google Drive: the app can reach only the files it creates or that you pick yourself (the drive.file scope); it cannot see the rest of your Drive. We use this to save meeting and class recordings to your own Drive when you ask us to.
• Google Forms: we read only the form you choose to import, to turn its questions and answer key into exam questions.

We do not sell Google user data or share it with third parties, we do not use it for advertising, we do not use it to train general-purpose AI models, and no person reads it unless you agree or it is needed for security or legal reasons.

You can disconnect at any time inside the app, or from your Google account permissions page: https://myaccount.google.com/permissions

Alfaheem's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Section 05

Who we share data with

We never sell your personal data. Data is shown or shared only with:

• Your course teachers: they see your progress, grades and attendance in their own courses only.
• Your parent or guardian: if they link their account to yours, they see your progress, grades and attendance.
• Your organization: if you join one, its staff see your data inside the organization according to their roles.
• Service providers that run the platform for us: hosting and storage, Google Firebase (push notifications and crash reports), Google sign-in, payment providers, and email and messaging services. They must protect the data and use it only to provide their service.
• Authorities: when the law requires it, or to protect the safety of our users.

If the platform ever changes ownership, the data moves with it under these same commitments, and we will tell you beforehand.

Section 06

Students, children and parents

Many of our users are students under 18. That is why:

• A minor uses the platform with a parent's or guardian's consent, or through their school or organization, which is responsible for obtaining that consent.
• We collect from students only the minimum needed for learning, and we never show them targeted ads.
• A parent can link their account to their child's to follow progress, grades and attendance, and can ask us to see, correct or delete their child's data.
• If we learn that we collected a child's data without valid consent, we delete it.

Parents: write to alfaheem.2y@gmail.com for any request about your child's data.

Section 07

Organizations

When a school, university or centre uses Alfaheem to manage its students and staff:

• The organization decides what data it enters (enrolment, grades, timetables, academic advising, requests and councils) and is responsible for its legal basis.
• We process that data on the organization's behalf and following its instructions, and for no other purpose.
• Staff see only what their roles allow, and important actions are kept in an audit log.
• Requests to see or delete your data inside an organization go to the organization first, and we help it carry them out.

If you leave the organization your personal account stays, and the organization keeps the academic records the law requires it to keep.

Section 08

Payments

Payments are made through approved payment providers. We never store your full card number or security code: the provider handles them directly under card security standards.

We keep a record of every transaction (amount, date, course or plan, reference number and status) to grant access to content, to calculate teachers' earnings, and for accounting and legal obligations. Wallet points and their usage history are treated the same way.

Section 09

Live sessions and recordings

• Your camera, microphone and screen sharing work only when you turn them on yourself, after your device asks for permission.
• The host of a class or meeting can record it. Everyone sees a clear indicator while recording is on, and the recording includes what the session shows (audio, video, the board and shared content).
• Recordings are stored on our servers, or in the host's own Google Drive if they choose that, and only the people the host, course or organization allows can watch them.
• Guests who join through a link are asked only for a display name; no account is created for them.
• The session chat and what is drawn on the board are visible to the participants and may be kept with the recording.

Section 10

Device binding and content protection

To protect teachers' rights and stop account sharing, we bind a student account to a limited number of devices using a device identifier the app sends with each request. The platform administrator sets how many devices are allowed and how often a device can be changed.

• Some screens (such as the lesson player and exams) may block screenshots and screen recording.
• Lessons you download to watch offline are stored encrypted on your device and do not play outside the app.
• The device identifier is used for these security purposes only, never for advertising tracking.

Section 11

Cookies and local storage

• The app stores sign-in tokens on your device (in secure storage on phones, and in the browser's local storage on the web) together with your preferences such as language, theme and font.
• The website alfheemacademy.com stores only your language choice.
• Firebase services may store an identifier on your device to deliver notifications and crash reports.
• We do not use advertising cookies or third-party tracking cookies.

You can clear this data by signing out or by clearing the app's or the browser's data.

Section 12

The AI assistant and AI tools

The AI assistant answers your questions from the platform's content and your courses, and AI tools help teachers write questions and grade answers. By default these models run on our own servers. If the platform administrator turns on an external provider, only the text needed for the answer is sent to it.

We keep conversations to show them to you and to improve answer quality, and you can delete them. We never use Google user data we receive to train any model.

Section 13

How we protect your data

• All connections are encrypted (HTTPS), the mobile app checks the server's certificate, and request bodies carry an extra layer of encryption.
• Passwords are stored as one-way hashes, and two-step verification is required for administrator accounts.
• Access to data is limited by roles and permissions, and sensitive actions are logged.
• Downloads on your device are encrypted.

No system is perfectly secure, but we review our protections continuously. If a breach affects your data we will tell you and the competent authorities as the law requires.

Section 14

How long we keep data

• We keep your account data for as long as the account is active.
• When you ask to delete your account it is switched off at once and permanently deleted after 14 days (signing in during that time cancels the deletion).
• A copy of your data you ask to download is deleted from our servers after 3 days.
• Payment and invoice records are kept for as long as the law requires.
• Security logs are kept for a limited time, no longer than 12 months.
• Recordings stay according to the host's or organization's settings until they delete them.
• Backups rotate regularly, and deleted data leaves them within 90 days.
• Organization data is kept according to its agreement with us and the periods the law requires.

Section 15

Your rights and choices

At any time you can:

• See your data and download a copy: Settings → Download a copy of my data.
• Correct your data: Settings → Edit account.
• Delete your account: Settings → Delete account, or by writing to us.
• Turn notifications off in the notification settings or on your device.
• Disconnect Google or any other external service.
• Object to or ask us to restrict a particular use, or complain to the data protection authority in your country.

If an organization manages your account we may pass your request to it. We answer requests within 30 days.

Section 16

Changes to this policy

We may update this policy when we add features or when laws change. We change the version and effective date at the top of the page, and we tell you in the app before any significant change.

Section 17

Contact us

For any question or request about your privacy or your data:

• Email: alfaheem.2y@gmail.com
• In the app: Settings → Complaints & support.

Alfaheem — DoubleY