Privacy Policy

Last updated: 31 May 2026

1. Introduction

Welcome to Learn Farsi. This Privacy Policy describes how we collect, use, store, and share your personal data when you use the Learn Farsi service, including our website at learnfarsi.app and the Learn Farsi iOS application (collectively, the “Service”).

The data controller is Welsenes Brothers V.O.F., registered with the Dutch Chamber of Commerce under number 94395706, at Tweede Jan van der Heijdenstraat 85-3, 1074XS Amsterdam, The Netherlands.

2. Information We Collect

We collect the following categories of information:

  • Account information: When you create an account we collect your email address and, depending on your sign-in method, your name. If you sign in with Apple we receive a stable Apple user identifier. If you sign in with Google we receive your verified email and profile name. If you use the email magic link, only your email address is collected.
  • Learning progress: Your vocabulary review history (spaced-repetition counts, accuracy, next review date), lesson and grammar completion status, quiz scores, daily streaks, XP totals, badges, milestones, friend connections, community posts and comments you create, and your current learning level.
  • Subscription & payment data: If you purchase a Learn Farsi Pro subscription through the iOS app, Apple processes the payment via the App Store and sends us, via RevenueCat, a record of your active subscription status, plan, renewal date, and a RevenueCat customer identifier. We do NOT receive your full card or bank details. If you purchase a digital product on the web (Quickguide, 30-Day Challenge, donations), Stripe processes the payment and we receive only the transaction id, amount, and last 4 digits / brand of the card.
  • Device & technical data (iOS app): The iOS app stores your encrypted authentication tokens in Apple Keychain via Expo SecureStore so you stay signed in between launches. We do not collect your IDFA (advertising identifier) or perform any cross-app tracking.
  • Device & technical data (web): Our hosting provider Vercel logs standard web request data (IP address, user agent, timestamps) for up to 30 days for security and abuse-prevention purposes. We use Vercel Web Analytics on the website, which collects aggregate page view counts and approximate geographic location without cookies and without persistent identifiers.
  • Temporary session data: While completing a lesson or practice session, we temporarily store session score and progress in your browser's local storage (web) or in app memory (iOS). This data is cleared when the session ends or completes successfully.

3. How We Use Your Information

We process your data to:

  • Authenticate you and keep you signed in across web and iOS
  • Power your spaced-repetition reviews and adapt lesson difficulty to your progress
  • Display your progress on your dashboard, leaderboard, and community profile
  • Provide and manage your Learn Farsi Pro subscription (validation, renewal status, restore purchases)
  • Send transactional emails (magic links, purchase confirmations, account-related notifications). We never send marketing emails without your explicit consent.
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with our legal obligations

We do not use your data for advertising, ad personalisation, or sale to third parties. We do not perform any cross-app or cross-site tracking inside the iOS app.

4. Legal Basis for Processing (EEA / UK users)

Where you are located in the European Economic Area or the United Kingdom, we rely on the following lawful bases under the GDPR:

  • Contract (Art. 6(1)(b)): processing necessary to provide the Service you signed up for, including authentication, lesson delivery, and progress tracking
  • Legitimate interests (Art. 6(1)(f)):security, abuse prevention, basic aggregate analytics, and product improvement, balanced against your interests
  • Legal obligation (Art. 6(1)(c)):tax-record retention and responses to lawful requests
  • Consent (Art. 6(1)(a)): any optional marketing communications, withdrawable at any time

5. Third-Party Services (Sub-Processors)

We rely on the following service providers to deliver Learn Farsi. Each acts as a data processor on our behalf and has its own privacy policy:

  • Supabase (supabase.com), hosts our PostgreSQL database on Amazon Web Services in the US-East region. Stores account and learning-progress data.
  • Vercel (vercel.com), hosts the web application and serverless API. Processes server logs and Vercel Web Analytics aggregate stats.
  • Resend (resend.com), delivers transactional emails (magic links, purchase confirmations, account notifications).
  • RevenueCat (revenuecat.com), brokers iOS in-app subscriptions between Apple's StoreKit and our backend. Stores a RevenueCat customer id linked to your Learn Farsi user id.
  • Apple App Store, processes iOS subscription payments. Apple shares with us only the subscription status, plan, and an opaque transaction id, never your payment method details.
  • Stripe (stripe.com), processes web-based one-time purchases and donations. Stripe receives your payment details directly, we only see the transaction id, amount, and card brand / last 4 digits.
  • Google Identity Services, used only if you choose to sign in with Google. Google shares with us your verified email and profile name.
  • Sign in with Apple, used only if you choose to sign in with Apple. Apple shares with us a stable user identifier and, optionally, your name and email at first sign-in.
  • Auth.js (NextAuth), open-source authentication framework we host ourselves. Session data lives in our own database.

We do not use advertising, ad-personalisation, or cross-application tracking services. The iOS app does not perform any tracking (as defined by Apple's App Tracking Transparency framework).

6. International Transfers

Our database and several sub-processors operate in the United States. Where personal data leaves the EEA / UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) with each sub-processor and have assessed their security practices to maintain a level of protection essentially equivalent to that guaranteed in the EEA.

7. Data Retention

We retain your account data and learning progress for as long as your account remains active. If you delete your account (see Section 8), we permanently delete your data from our production database immediately, and from encrypted backups within 30 days.

Transactional records required for tax or legal compliance (e.g. Stripe receipts, Apple subscription transaction identifiers) may be retained for up to 7 years to satisfy Dutch fiscal record-keeping rules. These records are pseudonymised and do not contain learning-progress data.

8. Your Rights and How to Exercise Them

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you
  • Correct or update inaccurate personal data
  • Delete your account and associated personal data (“right to erasure”)
  • Restrict or object to processing based on legitimate interests
  • Receive a copy of your data in a portable format
  • Withdraw consent at any time where processing is based on consent
  • Lodge a complaint with your local data-protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Self-service account deletion. You can permanently delete your account at any time:

  • iOS app: open the avatar menu in the top navigation bar and tap “Delete account”.
  • Web: open your account settings and follow the “Delete account” flow, or email us at the address below.

For all other requests, email support@learnfarsi.app from the email address associated with your account.

9. Security

We protect your data with TLS encryption in transit, at-rest encryption on our database (managed by Supabase / AWS), Apple Keychain storage for iOS authentication tokens (Expo SecureStore), and least-privilege access controls on our infrastructure. No system is perfectly secure, but we will notify affected users and the relevant authorities within 72 hours of becoming aware of a personal-data breach that creates risk to your rights and freedoms, as required by Article 33 GDPR.

10. Cookies, Local Storage, and On-Device Storage

Web cookies: we use a single session cookie managed by Auth.js to keep you signed in. This is a strictly-necessary cookie and is not used for tracking or advertising.

Browser local storage: stores your theme preference, alphabet practice progress, and temporary lesson scores. Clearing your browser storage will not affect your saved learning progress, which lives in our database.

iOS on-device storage: the iOS app stores encrypted authentication tokens in Apple Keychain via Expo SecureStore. No advertising identifier, IDFA, or cross-application data is collected or stored.

11. Children's Privacy

Learn Farsi is intended for users aged 13 and above. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us at support@learnfarsi.app and we will promptly delete it.

12. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we collect, to delete it, to opt out of the “sale” or “sharing” of it, and not to be discriminated against for exercising those rights. We do not sell or share your personal information for cross-context behavioural advertising. To exercise these rights, email support@learnfarsi.app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Material changes will be announced by email or an in-app notice before they take effect.

14. Contact Us

For any privacy-related question or to exercise any of the rights described above, contact us at:

support@learnfarsi.app

Welsenes Brothers V.O.F.
Tweede Jan van der Heijdenstraat 85-3
1074XS Amsterdam, The Netherlands
KVK 94395706

Back to Dashboard