This Privacy Policy explains how reesheh.app ("Reesheh," "we," "us," or "our") collects, uses, discloses, and protects information when you use our website, web app, and mobile app (collectively, the "Services").
Reesheh is operated from Jordan. For privacy purposes, Reesheh LLC is the controller of personal information processed through the Services unless a separate written agreement says otherwise.
Important: This is a product-specific draft based on our current codebase and infrastructure. It is not legal advice.
1) Information We Collect
Information you provide directly
- Account and profile details: email address, password (handled by Supabase Auth), and optional profile fields like full name.
- Learning content: audio, video, documents, topic names, notes, flashcards, quizzes, imported links (such as YouTube URLs), and related metadata you create, upload, or import. By importing such media, you confirm you own the rights to the content, as we are not responsible for any imported videos.
- Feedback and support details: messages and, in the iOS app, optional diagnostic fields such as app version, device model, locale, network status, free disk space, and battery level when you submit feedback.
- Copyright and legal request details: information you provide in DMCA notices, counter-notices, copyright complaints, legal requests, or related support communications, such as your name, contact details, signature, claim details, and the material involved.
- Billing-related details: transaction and subscription metadata from our payment providers (for example, plan and hourly quotas). We do not store full payment card numbers.
Information collected automatically
- Authentication / session data: session cookies and tokens used to keep you signed in and secure your account.
- Device / app events (iOS): usage analytics, diagnostic, and crash data collected through integrated mobile SDKs such as Firebase Analytics and Crashlytics.
- Advertising data (iOS): ad request/load events and related identifiers used by mobile ad services where enabled.
- Server and security logs: technical logs needed to operate, secure, and troubleshoot the Services.
Information from third parties
- Authentication providers: if you sign in with Google, we receive profile/account details necessary for login.
- Infrastructure and payments providers: we receive service metadata from hosting, storage, and payment systems used to deliver the Services.
2) How We Use Information
- Provide and maintain the Services.
- Authenticate users and secure accounts.
- Process uploads and generate outputs such as transcripts, notes, flashcards, and quizzes.
- Manage hourly quotas, subscriptions, and billing workflows.
- Improve reliability, performance, and product quality.
- Detect abuse, fraud, and security incidents.
- Comply with legal obligations and enforce our Terms and policies.
- Review, process, and respond to copyright complaints, DMCA notices, counter-notices, legal requests, and related disputes.
3) AI Processing
Some features process user content through third-party AI providers to generate educational outputs (for example, speech-to-text, notes, flashcards, and quizzes). This may include uploaded files and text content you submit through the Services.
Our current backend integrations include providers such as OpenAI and Groq. We may update providers over time; this Policy will be updated if material changes occur.
4) Legal Bases (EEA / UK users)
Where EEA or UK data protection law applies, we process personal data only where we have a legal basis, including:
- Performance of a contract: to create and manage your account, provide the Services, process uploads, generate outputs, manage subscriptions and hourly quotas, and provide support.
- Legitimate interests: to secure the Services, prevent abuse and fraud, debug and improve product reliability, understand aggregate product usage, enforce our Terms, and protect legal rights, where those interests are not overridden by your rights.
- Consent: where legally required, including for non-essential cookies, certain analytics or advertising technologies, marketing communications, or other optional processing.
- Compliance with legal obligations: to respond to valid legal requests, tax/accounting obligations, copyright notices, law enforcement requests, or other binding legal duties.
5) Sharing and Disclosure
We may disclose personal information to:
- Service providers / processors that support authentication, storage, AI processing, analytics, payments, ads, and infrastructure.
- Professional advisors and auditors under confidentiality obligations.
- Authorities where required by law or to protect rights, users, and systems.
- Business transferees in connection with mergers, financing, asset sales, or acquisitions.
We do not sell personal information for money. If we ever engage in sharing that constitutes a "sale" or "targeted advertising" under applicable law, we will provide required notices and controls.
6) Data Retention
We retain different categories of information for different periods, based on the purpose for which it was collected:
- Account and profile data (email, name, education details): retained for as long as your account is active.
- User-generated content (uploads, notes, flashcards, quizzes): retained for as long as your account is active.
- Billing and subscription records: retained for 7 years after the relevant transaction, to comply with applicable tax and accounting recordkeeping laws.
- Server and security logs: retained for up to 90 days for security monitoring and troubleshooting, then deleted or anonymized.
- Analytics and diagnostic data (app usage events, crash reports): retained according to our analytics providers' default retention windows, currently up to 14 months, after which it is automatically deleted or aggregated.
If you delete your account, account and profile data and user-generated content are permanently deleted from our live systems. A residual copy may persist in encrypted backups for up to 30 days before being purged. Billing records and security logs are retained for the separate periods described above, as required by law.
7) Security
We use reasonable technical and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8) International Transfers
Reesheh is operated from Jordan, and our service providers may process information in Jordan, the United States, the United Kingdom, the EEA, and other countries where they operate. These countries may have privacy laws different from those in your location.
Where EEA or UK law requires a transfer mechanism, we rely on appropriate safeguards such as standard contractual clauses, adequacy decisions, processor data-processing terms, or another lawful transfer basis available under applicable law.
9) Children's Privacy
The Services are not intended for, and may not be used by, anyone under the age of 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a user under 16, we will delete that information and terminate the associated account. If you believe a child under 16 has provided us with personal data, contact us so we can investigate and take appropriate action.
10) Your Privacy Rights
Depending on your location, you may have rights to access, correct, delete, port, or object to certain processing of your personal information, and to withdraw consent where processing relies on consent.
If EEA or UK data protection law applies to your use of the Services, you may also have the right to restrict processing, object to processing based on legitimate interests, object to direct marketing, and lodge a complaint with a supervisory authority in your country of residence, place of work, or where you believe an infringement occurred.
To exercise rights, contact us using the details below. We may need to verify your identity before responding. We may deny or limit a request where allowed by law, including where we cannot verify you, the request is unfounded or excessive, or we must retain information for security, fraud prevention, legal compliance, dispute handling, or backup integrity.
11) EEA / UK Representative Status
Reesheh is established in Jordan and does not currently maintain an office, branch, or appointed data protection representative in the EEA or UK. Until we designate a representative, EEA and UK users should direct privacy requests, complaints, and notices to Reesheh directly using the contact details below.
Nothing in this Policy limits any non-waivable privacy rights you may have under applicable law. If applicable law requires a different process or additional disclosures for your location, that law controls to the extent it cannot be waived.
12) State / Region-Specific Disclosures
If you are in a region with specific privacy laws, additional disclosures and rights may apply. We will provide required notices and controls where applicable and will update this Policy when those disclosures materially change how we process personal information.
13) Community and University Spaces
If you use the optional community features, some information is shared with other users by design:
- Posts, comments, resources, past papers, votes, and similar contributions you make in a university or course space are visible to other eligible members of that space and may be attributed to your profile (such as your display name and avatar).
- Aggregate activity, such as accepted answers and contributions, may be used to rank you on university leaderboards visible to other members.
- Course representatives and administrators can view and moderate content within the spaces they manage, including who submitted it.
- Files and content you upload to community spaces are stored and served so that permitted members can view or download them. Do not share personal or sensitive information you do not want other members to see.
Community features are optional, and information you choose to share there is separate from your private study content, which is not published to other users. You can request removal of your community contributions through in-product controls or by contacting us, subject to Section 6 (Data Retention).
14) Changes to This Policy
We may update this Policy from time to time. If changes are material, we will provide notice through the Services or other appropriate channels.
15) Contact Us
Copyright complaints and DMCA notices should be sent to the designated copyright agent listed in our Terms of Service.
Email: [email protected] or [email protected]
Company: Reesheh LLC
Address: Al Rabyeh, Amman, Jordan