This policy is for the parent or legal guardian who creates a Qissah account. Children do not create accounts themselves and do not interact with Qissah directly. Any information you enter about a child is provided by you, on their behalf, under your supervision.

Account details (about you): your display name, email address, and a hashed password (we never store the plaintext). If you sign in with Google, we receive a stable Google account identifier and your email, not your password. If you sign in with Apple, we receive a stable Apple identifier and an email address (which may be Apple's private-relay forwarding address if you choose to hide your real one), and again never your password.

Avatar photos (optional): if you choose to create an avatar, of yourself or of your child, you upload a photo. We use it once to generate a stylized, cartoon-style avatar (not a realistic likeness), then delete the original photo. We keep only the generated avatar, which you can remove at any time. Uploading a photo is entirely optional and parent-initiated, and the act of uploading is your consent to this processing. See section 7 for how this applies to a child's photo.

Child profile details (about your child): first name (or a chosen nickname), age, gender, the story language you choose for them and their fluency in it, optional interests, and any free-text notes you choose to add. You decide what to share; no field other than name + age is required.

Stories you generate: the prompt you submit (theme, length, tone, story language, parent notes), the generated narrative, its cover and in-story illustrations, any narrated audio files, and the linked verse/hadith references. If you choose to share a story or Kitab, we create an unlisted link; anyone who has that link can view it until you turn sharing off.

Billing information: if you subscribe to a paid plan on the web, your payment details are handled by Stripe; if you subscribe inside our mobile app, the purchase is processed by Apple's App Store or Google Play (in-app purchase) and managed through RevenueCat. In every case we never see or store your full card number; we store only the opaque customer and subscription identifiers needed to keep your plan in sync.

Technical data: a session cookie (HTTP-only, SameSite=Lax) so you stay signed in; your IP address (used for per-IP rate limiting and abuse prevention); and basic server logs (request path, timestamp, status code) for operational debugging. If you enable notifications in the mobile app, we also store the device push token needed to deliver them, which is removed when you turn notifications off or delete your account.

Usage activity: a lightweight behavioural log of how the Service is used: pages visited, key actions taken (e.g. a story generated, a checkout started), and a random per-browser visitor id used to group activity before you sign in. This log is structural only: it records event types, page paths, and small identifiers such as a topic or story id. It never includes your child's name, the story text, scripture, your email, or your password. We use it for product analytics and abuse prevention, and it is automatically deleted after 90 days.

We use the information above only to:

We do not sell your data to advertisers. We do not build advertising profiles. Your child's profile data is never used to target anyone with ads, yours or anyone else's.

To run the Service we use a small number of trusted sub-processors. Each sees only the minimum data needed for their part of the job:

We do not share your data with anyone else for any purpose other than the ones listed in this policy.

Qissah's database and storage are hosted on Render. Generated stories, including the narrative, the illustrations, and any narrated audio, are stored against your account for as long as your account exists.

Session cookies expire after 7 days of inactivity. Server logs are retained for up to 30 days. Stripe retains billing records as required by financial regulation in the jurisdiction where Stripe processes the payment (typically 7 years).

If you cancel your subscription, your account stays active on the Free tier and your stories remain accessible. If you delete your account (see section 6), all of your stories, Kitabs, narrated audio, child profiles, avatars, and account details are removed from our systems within 30 days, except where retention is required by law (e.g. Stripe's invoice records).

You can, at any time:

Depending on where you live, you may also have additional rights under data-protection law (for example, GDPR in the EU/UK, or CCPA in California). To exercise any of those rights, email us at support@qissah.io and we'll respond within 30 days.

Qissah is designed to be used by parents on behalf of their children. We do not knowingly collect personal information directly from children. The child profile fields are filled in by you, in your role as parent or guardian.

If you are based in the United States, this puts the collection of child information under the parental-consent model contemplated by COPPA: your creation of the account and the child profile is the consent. If you are based in the EU/UK, our lawful basis for processing your child's data is your consent as the parent or guardian, which you may withdraw at any time by deleting the child profile or your account.

We deliberately do not ask for surnames, addresses, phone numbers, school names, or any other detail that could identify a child off-platform.

Child avatar photo (optional). You may, if you choose, upload a photo of your child to create a stylized, cartoon-style avatar (not a realistic likeness). This is entirely optional and parent-initiated. We use the photo once to generate the avatar and then delete the original immediately. We never store a child's photograph; only the generated cartoon avatar is kept, and you can delete it at any time. As with all child information, your upload is the parental consent for this processing, and you may withdraw it by deleting the avatar, the child profile, or your account.

All traffic to and from Qissah is encrypted in transit (HTTPS). Passwords are stored only as bcrypt hashes; session tokens are stored hashed in the database, with the raw value living only in your browser cookie. Card details are handled exclusively by Stripe; we never see or store them.

No system is perfect. If you believe your account has been compromised or if you discover a vulnerability, please email us at support@qissah.io so we can investigate.

Some of our sub-processors operate servers outside the United Kingdom. Where data is transferred internationally, we rely on the standard contractual clauses or equivalent legal mechanisms offered by each sub-processor to protect that transfer.

If we change this policy materially, for example by adding a new sub-processor or a new category of data, we'll update the "Last updated" date at the top of this page and, where the change is significant, notify you in the app or by email. Continued use of the Service after a change means you accept the updated policy.

Questions, concerns, or requests about your data? Email us at support@qissah.io, or use the "Contact us" link in the footer of any page. We read every message.