Privacy Policy

Riwayah · Last updated April 2026 · Contact: team@riwayah.ai

This Privacy Policy explains what personal data Riwayah ("we", "us", "our") collects when you use our mobile app and services, and how we use it.

Information We Collect

Account information — your name, email address, password (hashed), and optional profile photo.
Authentication identifiers — if you sign in with Apple or Google, we receive a unique user identifier and your email from those providers.
Profile data — country, time zone, learning goals, availability, and other preferences you provide during onboarding.
Audio recordings — short voice samples of your recitation that you submit for AI feedback or send to your teacher. Audio is stored only as long as necessary to deliver the feature.
Live session data — Riwayah uses Zoom Video SDK for live tutoring. Audio and video are streamed in real time and are not recorded by Riwayah unless you explicitly opt in.
Messages and homework — text messages, attachments, and homework you send within Riwayah.
Subscription information — your active plan, renewal date, and the original transaction ID from Apple. We do not receive your credit-card number; payments are processed by Apple.
Push notification token — to deliver session reminders and messages.
Diagnostic data — limited error logs needed to operate the service. We do not use third-party analytics for behavioral tracking.

How We Use Information

To provide the service: matching, scheduling, in-app messaging, recitation feedback, and live tutoring.
To process subscriptions and prevent abuse.
To communicate with you about your account and session reminders.
To improve recitation accuracy by retaining anonymized model feedback (you can opt out by contacting us).

How We Share Information

We do not sell personal data. We share data only with:

Your matched teacher — name, profile photo, schedule, messages, and homework you send to them.
Service providers we use to operate Riwayah: Google Cloud (hosting), Zoom Video SDK (live calls), Apple (payments, sign-in), Hugging Face (recitation transcription), Resend (transactional email), RevenueCat (subscription management).
Legal authorities if required by law.

Data Retention

We retain your account data while your account is active. You can delete your account in Settings → Delete Account, which permanently removes your profile, messages, recordings, and bookings within 30 days. Some records may be retained for legal or accounting requirements.

Children

Riwayah is intended for users aged 4 and older with parental supervision for those under 13. Parents who wish to remove a child's data should email team@riwayah.ai.

Your Rights

You can request access, correction, or deletion of your personal data by emailing team@riwayah.ai. Users in the EEA, UK, and California have additional rights under GDPR/CCPA, including the right to object to processing and to lodge a complaint with a supervisory authority.

Security

We use TLS in transit, encryption at rest for sensitive fields (e.g. payout details), hashed passwords, and least-privilege access controls. No system is perfectly secure, but we work to protect your data.

Changes

We may update this policy. Material changes will be announced in-app or by email.

Contact

Questions? Email team@riwayah.ai.