Privacy Policy

What this policy covers

This policy covers two separate things. The Akademia Tenzil app ("the App") is the private iOS app used by the school's teachers and their students. The akademiatenzil.com website ("the Site") is the public website, which presents the academy, publishes articles, and carries an application form. The App is described first. The sections about the Site follow, and each of them says so in its heading.

Who the App is for

The App is used only by a Qur'an school and the students enrolled in it. Accounts are created by the school's teacher or administrator, and there is no public sign-up. Students receive a username and password from their teacher.

Information we handle

The App stores only what is needed to run the school. This information is entered by the teacher or school, not collected automatically:

• Student records: name, optional age, a username, class (Hifz or Përforcim), and the student's Qur'an memorization position (surah, page, juz).
• Academic records: attendance, mistakes and notes recorded by the teacher, test grades, and teacher messages to the student.
• Teacher account: name, email address, optional bio and profile photo.
• Authentication data: the login credentials needed to sign in.
• Notification token: if notifications are allowed, a device token so the school can send lesson reminders.

We do not collect location, contacts, advertising identifiers, browsing activity, or any data from your device beyond what you enter in the App. The App contains no advertising and no third-party trackers.

Children's data

Some students are minors. Their information is entered and managed only by their own teacher or school, is used solely for the student's Qur'an education, and is never sold, shared for advertising, or disclosed to third parties. A student can see only their own records, and a teacher can see only their own students.

How the information is used

Only to operate the school: tracking memorization progress, attendance, grades and mistakes, sending lesson reminders, and letting each student see their own progress. We do not use the information for any other purpose.

How it is stored and protected

• Data is stored on Supabase (a hosted PostgreSQL database) and transmitted over encrypted HTTPS connections.
• Access is enforced by database Row-Level Security: each teacher can reach only their own students' data, and each student only their own.
• On the device, cached data is protected by iOS file protection and excluded from device backups. Optional Face ID or Touch ID sign-in keeps saved credentials in the device's secure Keychain.

Sharing

We do not sell, rent, or share personal information with any third party for marketing or any other purpose. Data is processed only by our hosting provider (Supabase) strictly to store and serve it for the App, and by Apple's push notification service strictly to deliver notifications.

Data retention and deletion

Records are kept for as long as the student is enrolled with the school. The teacher or administrator can edit, remove, or archive a student's records at any time from within the App. To have an account or its data deleted, contact the school or us at the address below and we will remove it.

Data location

Data is hosted in the European Union (Supabase, Frankfurt region).

The Site: what it collects

Reading the Site collects nothing about you. There are no visitor accounts, no comments, and no tracking. The only personal information the Site receives is what you choose to type into the application form. When you send one, we receive:

• Contact details: your full name, email address and phone number.
• Application details: your age, your gender, the programme you are applying for, any previous experience you describe, and your message.

Nothing is added beyond that. To stop the form being flooded, we keep a count of submissions per IP address for one hour. The address itself is never stored: only a one-way hash of it is, it is deleted once the hour has passed, and it is never attached to your application. We also accept at most five applications from the same email address. Our hosting provider keeps ordinary server logs for security and reliability, as any website does.

The Site: children and parental consent

The academy teaches children, so an application will often be about a child; the form accepts an age as young as four. If the applicant is under 18, the form should be filled in by a parent or legal guardian, or with their knowledge and permission.

We ask for nothing about a child beyond the fields listed above. We do not profile children, and we use their details only to answer the application and, if they enrol, to register them with the school. A parent or guardian can ask us at any time to show, correct or delete what we hold, at the contact address at the end of this policy.

The Site: how applications are used and shared

An application is used to reply to you about it and to arrange enrolment. It is not used for marketing, and we send no newsletters. Applications are stored in the academy's own database and read by academy staff in a password-protected admin area, where a status and internal notes are added as the application is handled. They are never sold, rented, or shared for advertising.

Beyond the providers that run the Site, applications are not shared with anyone. Those providers are:

• Vercel: hosts the Site and serves its pages.
• Supabase: stores applications, articles and uploaded images.
• Resend: delivers the email telling the academy that an application has arrived.

There is no advertising network, analytics service or social media tracker on the Site. Fonts are served from our own domain, so reading a page makes no request to a third party.

The Site: cookies

The Site sets no analytics or advertising cookies, which is why it shows no cookie banner. Reading the Site sets no cookie at all. The only one that exists is an admin session cookie, set for academy staff who sign in to the admin area, to keep them signed in.

The Site: where data is stored and for how long

Applications and uploaded images are stored by Supabase in its London region, in the United Kingdom, and travel over encrypted HTTPS connections. The database is reachable only with the academy's own credentials, and the admin area is limited to accounts the academy creates by hand: there is no public sign-up.

We keep an application while it is being considered. If it leads to enrolment, the details become part of the student's school record and are then covered by the App sections above. If it does not, we delete it within 12 months. You can ask us to delete it sooner at any time.

The Site: your rights

You can ask us to show you what we hold about you, to correct it, or to delete it, and you can withdraw an application whenever you like. Write to the address at the end of this policy and we will act on it. Sending an application is entirely voluntary, and the only consequence of not sending one is that we cannot contact you about enrolling.

Changes to this policy

If this policy changes, we will update the date at the top and post the revised version at the same link.

Contact