Privacy Policy

The controller responsible for your data is [COMPANY NAME], [REGISTERED ADDRESS].

For questions about privacy, and to request access to or deletion of your data, email support@nooron.app.

Data protection officer: [DATA PROTECTION OFFICER — contact details, or a statement that none is appointed]

Account data (from you, or from Google or Facebook if you sign in with them):

• name, email address, a username (handle) we create from your name, and your sign-up date;
• your password, stored only as a one-way bcrypt hash; we never store or see it in plain text;
• your profile picture: a built-in avatar, a photo you upload (resized in your browser and stored in our database), or the photo URL of your Google or Facebook account;
• if you sign in with Google or Facebook: your account ID with that provider and the sign-in tokens it issues.

Learning data (created as you use the app):

• XP, gems, hearts, streak, level, the day you were last active, your chosen topic and your language;
• which lessons you have completed and when, and your progress per topic;
• each answer you give: the question, the option you chose, whether it was correct and when;
• a history of XP and gem changes (for example lesson rewards, heart refills, referral rewards).

Friends and referrals:

• your personal invite code;
• who you are friends with and since when;
• if you joined through someone's invite link: who invited you, the code used and when. The person who invited you receives a gem reward.

Payment data: if you buy a subscription, we store your plan, its status, the billing period dates and the customer and subscription IDs Stripe gives us. Your card or other payment details are entered directly with Stripe; we never receive them.

Technical data: when you open NoorOn, our web server records your IP address, the requested page, date and time, and your browser's user agent in log files. We also set the cookies listed below.

What others can see: your display name, avatar, XP and level are shown to other learners on the leaderboard and in friends lists.

• Providing your account, lessons, progress, streaks, leaderboard and friends features: performance of our contract with you (Art. 6(1)(b) GDPR).
• Signing in with Google or Facebook: performance of the contract, at your request (Art. 6(1)(b) GDPR).
• Subscriptions and payments: performance of the contract (Art. 6(1)(b) GDPR); keeping invoices and accounting records: legal obligation (Art. 6(1)(c) GDPR).
• Referral rewards and preventing referral fraud, cheating and abuse: our legitimate interest in a fair game and in protecting the service (Art. 6(1)(f) GDPR).
• Security, server logs and fixing errors: our legitimate interest in running a secure, working service (Art. 6(1)(f) GDPR).
• Improving our learning content, for example spotting questions many learners get wrong: our legitimate interest in better content (Art. 6(1)(f) GDPR).

We do not sell your data, do not show advertising, do not use analytics or tracking tools, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use the following service providers. Where they act as processors, they process data only on our instructions under a data processing agreement (Art. 28 GDPR).

• MongoDB Atlas (MongoDB, Inc.): hosts our database, which contains all of the account, learning, friends and subscription data described above. Server region: [ATLAS REGION].
• Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA): processes subscription payments, the checkout page and the billing portal. We send Stripe your email address and user ID. Stripe also acts as an independent controller for some purposes, such as fraud prevention and meeting its financial regulatory duties.
• Google (Google Ireland Ltd. / Google LLC) and Facebook (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.): only if you choose to sign in with them. They tell us your name, email address, profile picture and account ID. Their own privacy policies apply to your accounts with them.
• Hosting: [CURRENT HOSTING PROVIDER].

Planned: we intend to move hosting to Cloudflare (Cloudflare, Inc., USA). Cloudflare would then host the app, store uploaded images (R2) and send service emails. We will update this policy before that happens.

Some of these providers are based in the USA or may process data there. Transfers take place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We only use cookies that are needed to provide the service you ask for, so we do not ask for cookie consent (Section 25(2) of the German TDDDG). We do not use advertising, analytics or tracking cookies.

• authjs.session-token: keeps you signed in (an encrypted session token). It expires 30 days after your last visit or when you sign out.
• Auth.js security cookies (authjs.csrf-token, authjs.callback-url and short-lived cookies used while signing in with Google or Facebook): protect sign-in against attacks. Deleted at the end of the session or after sign-in.
• NOORON_REFERRAL: remembers the invite link you arrived through, so the right friend gets the reward when you sign up. It is signed so it cannot be tampered with, and it is deleted after sign-up or after 30 days.
• NOORON_LOCALE: remembers the language you chose.
• NOORON_THEME: remembers whether you chose light, dark or system theme.

• Account, learning, friends and referral data: for as long as you have an account. When your account is deleted, this data is deleted too.
• Subscription and payment records: invoices and accounting records are kept as long as tax and commercial law requires; in Germany this is generally up to 10 years.
• Server logs: [SERVER LOG RETENTION PERIOD].
• Backups: deleted data may remain in database backups for up to [BACKUP RETENTION PERIOD] before being overwritten.
• Cookies: as listed in the cookies section.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy (Art. 15);
• have incorrect data corrected (Art. 16); you can change your name, email, password and picture yourself in Settings;
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive the data you gave us in a structured, machine-readable format, or have it sent to another provider (data portability, Art. 20);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21);
• lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU country where you live or work. The authority responsible for us is [SUPERVISORY AUTHORITY].

To use your rights, email support@nooron.app from the email address of your account. We will answer within one month. We may ask you to confirm your identity first.

To delete your account, email support@nooron.app from the email address of your account. We will delete your account, learner profile, progress, answers, friends and referral data, and any sign-in connections to Google or Facebook.

If you have a paid subscription, please cancel it in Settings → Subscription first so it does not renew. Records we must keep by law (such as invoices) are kept until their retention period ends, and then deleted.

NoorOn is not intended for children under [MINIMUM AGE]. Younger learners may only use NoorOn with the permission and under the supervision of a parent or guardian.

If you are a parent or guardian and believe your child has given us personal data without your permission, contact support@nooron.app and we will delete it.

We will update this policy when our app or our providers change, for example before moving to the planned Cloudflare hosting. The date at the top shows when it was last updated. We will tell you about significant changes in the app or by email.

[COMPANY NAME], [REGISTERED ADDRESS]

Privacy, data access and account deletion: support@nooron.app