Privacy Policy

When you use KurdishClass, we collect the following types of information:

Account Information

• Email address — used to create and identify your account.
• Display name — the name you choose to appear on your profile and leaderboard.
• Password — stored as a secure cryptographic hash; we never store plaintext passwords.

Learning Preferences

• Selected Kurdish dialect (Sorani or Kurmanji)
• Preferred app interface language
• Daily learning goal (minutes per day)
• Self-reported proficiency level

Usage & Progress Data

• Lessons started and completed
• Exercise scores and XP earned
• Daily learning streaks
• In-app coins and hearts
• Kurdish proficiency score over time

Device & Technical Information

• Browser type and version
• Operating system
• IP address (used for security and abuse prevention only)
• Session tokens (stored securely in your browser)

We use your information solely to provide, improve, and personalise your learning experience:

• Authentication — to securely log you in and protect your account.
• Personalisation — to serve lessons, vocabulary, and content in your chosen dialect and interface language.
• Progress tracking — to record streaks, XP, and proficiency scores so you can monitor improvement.
• Leaderboard — to display anonymised rankings based on XP (your display name is shown, not your email).
• Platform improvement — to understand which lessons are effective and where learners struggle, so we can create better content.
• Communications — if you opt in to notifications, to send daily practice reminders.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

KurdishClass is built on Supabase, a secure cloud database platform hosted on AWS infrastructure. Your data is stored in the EU (Frankfurt) region by default.

• All data is encrypted in transit using TLS 1.2+.
• All data is encrypted at rest using AES-256.
• Passwords are hashed using bcrypt and never stored in plaintext.
• Access to the database is restricted via Row-Level Security (RLS) — users can only read and write their own data.
• We enforce HTTPS across the entire platform; plain HTTP connections are not permitted.

While we take all reasonable steps to protect your data, no system is completely infallible. In the unlikely event of a data breach affecting your personal information, we will notify you within 72 hours.

We use minimal, essential browser storage technologies to operate the platform:

• Session cookies — required to keep you logged in during a browsing session.
• Local Storage — to remember your preferred app language between sessions.
• Refresh tokens — stored securely to allow persistent login across sessions without requiring you to re-enter your password each time.

We do not use third-party advertising cookies, tracking pixels, or behavioural analytics platforms (e.g., Google Analytics, Facebook Pixel).

To deliver KurdishClass, we rely on the following trusted third-party services:

Each service is selected for privacy compliance. Supabase is SOC 2 Type II certified and compliant with GDPR. No data is shared with any other third party without your explicit consent.

KurdishClass is designed to be family-friendly and is suitable for learners of all ages. However, users under the age of 13 (or the applicable age of digital consent in their country) should use the platform with parental supervision.

We do not knowingly collect personal data from children under 13 without verifiable parental consent. If you believe a child has created an account without parental permission, please contact us at privacy@kurdishclass.com and we will delete the account promptly.

Depending on your location, you have the following rights under applicable data protection law (including GDPR for EU residents):

• Access — request a copy of all personal data we hold about you.
• Rectification — correct inaccurate or incomplete data by updating your profile in-app.
• Erasure — request deletion of your account and all associated data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Restriction — request that we limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — if you have opted into notifications, you may withdraw consent at any time via Profile Settings.

To exercise any of these rights, email us at privacy@kurdishclass.com. We will respond within 30 days.

You may also delete your account directly from the Profile page inside the app. Account deletion removes all personal data within 30 days.

We retain your data for as long as your account is active:

• Active accounts — all data is retained to provide continuity of your learning progress.
• Inactive accounts — accounts with no activity for 2 years will be notified via email before deletion.
• Deleted accounts — personal data is purged within 30 days of account deletion. Anonymised, aggregate learning statistics may be retained for research purposes.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

When we make material changes, we will notify you via an in-app banner or email at least 14 days before the changes take effect. Continued use of KurdishClass after the effective date constitutes acceptance of the updated policy.

The "Last updated" date at the top of this page will always reflect the most recent version.

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please contact us:

This privacy policy was written in plain language to be clear and accessible. If anything is unclear, please reach out — we are happy to explain.