Privacy Policy
Version 1.0.0 · effective 2026-08-26
We hold ourselves to GDPR-level practice, whether or not you live somewhere that requires it, and we follow Tunisia's data-protection regime as our home jurisdiction. This page explains exactly what we collect, why, who processes it, and how you get it back or delete it.
1. Who is responsible for your data
Yalla Nihongo, operated from Tunis, Tunisia, is the data controller for the personal data described here — meaning we decide what is collected and why.
For any privacy question, request or complaint, contact our privacy address below. A person reads it.
2. What we collect, and why
| What | Why we need it |
|---|---|
| Account data — email address, display name | To create your account, sign you in, and contact you about the service |
| Learning data — reviews, ratings, quiz scores, streaks, XP, lesson progress | This is the spaced-repetition engine itself: without your review history it cannot schedule anything, and your dashboard has nothing to show |
| Preferences — interface language, theme, daily goal, leaderboard opt-in | To give you the app the way you set it up |
| Community content you post — messages, group names, event photos | To display it inside the service, where you chose to post it |
| Event RSVPs and badges | To organise community events and record what you earned |
| Technical logs — IP address, browser type, timestamps of requests | Security, abuse prevention and debugging. Kept briefly and never used to profile you |
What we do not do
- We do not sell or rent your data. There is no version of this business where we do.
- We do not run advertising trackers or third-party ad cookies.
- We do not build advertising profiles, and we do not profile minors at all.
- Any analytics we run are first-party and privacy-respecting: aggregate counts, never personal identifiers in event data.
3. Our legal bases
- Performance of a contract — account data, learning data and preferences. Without them there is no service to deliver.
- Legitimate interest — technical logs used to keep the platform secure and to prevent abuse, balanced against your privacy by keeping them minimal and short-lived.
- Consent — optional features you switch on yourself: appearing on the weekly leaderboard, and any newsletter we may offer. You can withdraw consent at any time in Settings, and withdrawal does not affect what was lawful before it.
- Legal obligation — where a law requires us to keep or disclose specific records.
4. Who processes data for us
We keep the list of processors short on purpose. Each one is bound to process data only on our instructions.
Because these providers operate global infrastructure, your data may be processed on servers outside Tunisia and outside your own country, under the contractual and technical safeguards those providers publish.
When paid features launch, the payment provider (for example Flouci) will process payment data as an independent controller under its own terms. Card numbers never reach our servers and we never store them.
Supabase
Database hosting, authentication and file storage
Vercel
Application hosting and content delivery
5. Your rights over your data
Two rights are built into the product rather than a request form. In Settings you will find Export my data, which downloads a JSON file containing your profile, progress, reviews, games, XP and badges; and Delete my account, which removes your account immediately and cascades through every table that holds your rows. Where community content must remain for other people's conversations to make sense, it is anonymised rather than kept under your name.
For anything else, write to our privacy address. We answer within 30 days.
If you believe we have mishandled your data you may complain to the Instance Nationale de Protection des Données Personnelles (INPDP), Tunisia's supervisory authority. If you live in the European Union, you may instead contact the supervisory authority of your own country.
- Access — see what we hold about you.
- Rectification — correct anything wrong. Your display name, language, theme and goal are editable directly in Settings.
- Erasure — delete your account and the data attached to it.
- Portability — take your data with you in a structured, machine-readable file.
- Objection and restriction — object to processing based on legitimate interest, or ask us to limit it while a question is resolved.
- Withdraw consent — turn off the leaderboard or any optional feature at any time.
6. How long we keep things
- Active accounts — kept while the account exists, because your review history is what makes the app work.
- Deleted accounts — removed immediately from the live database and purged from backups within 30 days.
- Technical and security logs — kept briefly, then discarded, except where a specific security investigation or legal obligation requires otherwise.
- Aggregate, anonymous statistics that cannot identify you may be kept indefinitely.
7. Younger learners
Accounts require a minimum age of 13, and under-18s need a parent or guardian's permission.
We do not profile minors, do not target advertising at anyone, and do not ask for more personal data than the service needs.
The weekly leaderboard is opt-in for every user regardless of age, and shows only a display name and that week's XP. Choose a display name that is not your full name if you would rather not be identifiable.
9. Changes and contact
This policy carries a version number and effective date at the top of the page. Material changes are announced in the app at least 14 days before they take effect.
Questions, requests and complaints: write to our privacy address. If you are not satisfied with our answer, you can escalate to the INPDP in Tunisia or your local supervisory authority.
Questions?
Write to us and a human will answer.