Privacy Policy

Account and sign-in information. When you create an account we store your email address, display name, and profile picture (if you sign in with Google or Apple), and, if you sign in with an email and password, a bcrypt hash of your password — never the password itself.

Learning progress. To make the app work — your streak, your review queue, your place on the lesson path — we store your dialect preference, daily XP goal, total XP, current and longest streak, streak freezes, your current lesson and unit, per-word and per-phrase mastery levels and review scheduling, completed lessons and their accuracy, unlocked achievements, and a day-by-day log of XP earned, lessons completed, and reviews done.

Product usage events. We log a small set of in-app events (for example, a lesson started or a quiz completed) tied to a session id and, if you're signed in, your account id — never directly to your name or email.

Feedback you send us. The message itself, and an email address only if you choose to leave one so we can reply. Signed-in feedback is tagged with your account id; you don't have to be signed in to send feedback at all.

Technical data for security. We read your IP address from incoming requests to enforce rate limits — for example, capping how many sign-in or password-reset attempts can come from one address in a short window, to slow down automated abuse. That IP is held only in short-lived server memory (it clears itself out automatically every few minutes) and may appear in our server logs when something is rejected for security reasons. It is not written to our database or attached to your profile.

We use this information to run the product — sign you in, save and sync your progress, schedule your spaced-repetition reviews, and show your dashboard — to keep it secure — rate-limiting and abuse prevention — to email you when you ask for a password reset, and to reply to feedback if you've left an address.

We do not run advertising on Khabara, we do not use your data to build an ad profile, and we do not sell or rent your personal data to anyone.

Khabara offers three ways to sign in, and each shares a different, limited amount of information with us:

• Google Sign-In shares your name, email address, and profile picture — what you'd expect from “Continue with Google.” We never see your Google password, and we deliberately do not keep the OAuth access or refresh tokens Google issues: they're stripped before anything reaches our database.
• Apple Sign-In shares your name and either your real email address or Apple's private relay email address, depending on what you choose when Apple asks. We never see your Apple password.
• Email and password — your password is hashed with bcrypt before it's stored, and we can't see or recover your original password, only verify a hash against it.

A short, complete list of the outside services Khabara's data passes through — we don't use anything beyond what's below, and in particular we don't run Google Analytics, Meta/Facebook Pixel, or any advertising or cross-site tracking network.

• Supabase hosts our PostgreSQL database. Every category of data above lives there.
• Vercel hosts the application and its API, and provides Vercel Web Analytics and Speed Insights — cookieless, aggregate traffic and performance metrics. We strip the query string from those events on the password-reset page specifically, so a live reset link can never end up in analytics or log storage.
• Google Sign-In and Apple Sign-In, described above.
• Resend is the email provider we use to send password-reset emails on our behalf.
• Google Cloud Text-to-Speech and Microsoft Azure Cognitive Services Speech are used by us, separately, to generate the pre-recorded pronunciation audio built into lessons. That's a one-time content-production step we run ourselves — it doesn't involve your personal data.

Your data is stored in our PostgreSQL database, hosted by Supabase, and reached only by our application's server-side code over authenticated, encrypted connections. Passwords are hashed with bcrypt and never logged or stored in plain text. As noted above, we don't retain the OAuth tokens Google or Apple issue, and IP addresses used for rate-limiting live only in server memory, never in the database.

The Khabara Android app stores its sign-in session on-device using the Android Keystore, encrypted with AES-256-GCM, rather than in plain storage.

We keep your account and learning data for as long as your account exists, so your streak, XP, and progress are there the next time you sign in.

Khabara does not currently have a self-serve “delete my account” option in the app. If you'd like your account and the data described above deleted, email khabara@gmail.com and we will delete it.

Khabara is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has created an account, we will delete it. If you believe your child has given us personal information, contact us at the address below and we'll remove it.

Wherever you are, you can ask us what data we hold about you, ask us to correct it, or ask us to delete your account and its data. Email khabara@gmail.com and we'll take care of it. If you're in the EU, UK, or EEA, these are the choices GDPR/UK GDPR gives you; if you're a California resident, the same choices reflect your rights under the CCPA.

If what we collect or how we use it changes, we'll update this page and move the date at the top.