Privacy Policy

In short

• You can use Nabras without an account. Your progress stays on your device.
• If you create an account, we keep as little about you as possible: how you sign in and your email, your first name if you enter it, and whether you are 18 or older.
• Your personal data is kept separate from your practice data. We store and protect your data in line with the Saudi Personal Data Protection Law.
• The AI never receives your name, email or phone number.
• Your teacher and your school's leadership see only your first name and results, and only after you join the class yourself. If you are under 18, they cannot see them until your parent or guardian approves.
• You can delete your account in one tap, and we erase your personal data within 24 hours.

1. Who we are and how to contact us

Nabras is a preparation platform for the General Aptitude Test (Qudrat) in the Kingdom of Saudi Arabia: a diagnosis of your level, a daily study plan, and a "Why did I get it wrong?" explanation after every mistake.

Nabras is the party responsible for the personal data described in this policy. For any question or request about your data: privacy@nabras.app

2. What we collect

A. Without an account

• Your answers, progress and plan are saved in your browser on your device (localStorage).
• If you ask for an AI explanation, or send your answers to your teacher through a class link, your answers are stored with us linked to a random number for your device, not to your name.

B. When you create an account (optional)

• How you sign in: Google, Telegram, or a link sent to your email. We store your account identifier with the provider, your email address if we receive it, and your Telegram username if you sign in with Telegram.
• Your first name: optional, and needed only if you want to appear to your teacher.
• If you sign in with Google or Telegram, we read your first name only as a suggestion: it becomes your name on Nabras only after you confirm it, and you can edit or reject it. We don't take your family name or photo from Google.
• Your answer to the question "Are you 18 or older?" (yes or no only; we do not ask for your date of birth).
• Your study settings: your target score, and the date and type of your test. This is practice data and does not carry your name.

C. Teachers and school principals

• The display name your students see (for example "Mr. Khalid"), your subject, and your city if you add it.

D. Parents and guardians

• When you approve your son's or daughter's account: the name and relationship you enter, the time of approval, and the purposes you approved. We do not ask for or store your mobile number.

E. The Nabras bot on Telegram (optional)

• Your chat ID, your display name and Telegram username, and your messages to the bot and its replies.

F. Interest list and alerts (optional)

• The email address or mobile number you leave with us, so we can contact you about Nabras only.

G. Usage analytics

• A random device identifier, the pages and buttons you use, and session length, through PostHog and Google Analytics. Some sessions are recorded technically, with everything you type into fields hidden. We do not send your name, email or phone number to analytics tools.

We never collect: national ID number, date of birth, address, or a parent's mobile number.

3. Why we collect it, and on what basis

Each purpose has its own separate consent. Giving your first name is optional; without it you can use all of Nabras except appearing to your teacher.

4. How your data is protected

• We store and protect your data in line with the Saudi Personal Data Protection Law.
• Your personal data is kept in a separate place, and your practice data is linked to a number that does not identify you.
• We use your data for one purpose only, providing the service you ask for, and only the minimum needed.
• The service providers that run the platform with us: Supabase (database), Vercel (website hosting), PostHog and Google Analytics (analytics without identity), Anthropic (AI, without your name, email or phone number), and Resend (sending email). We use the standard contractual clauses issued by SDAIA as the reference for what we require of them.

5. Who we share it with

• Your teacher: your first name and your results only, in the class you joined yourself, from the moment you join and consent (and your parent's or guardian's consent if you are under 18). They do not see your family name, your email, your number or your conversations. You can leave the class in one tap and disappear from their view.
• Your school's leadership: the same as your teacher (your first name and your results, under the same conditions), plus class counts and results, for your own school only. They do not see your family name, your email, your number or your conversations.
• Your family: only through the report link that you create and send yourself. It does not show your answers or your conversations, and you can stop it in one tap.
• The service providers listed in section 4, only to operate the platform.
• Official authorities if they request it under the laws in force in the Kingdom.

We do not sell your data to anyone, and we do not run ads.

6. If you are under 18

• When you sign up we ask you: "Are you 18 or older?".
• If you answer "No": you send your parent or guardian an approval link by WhatsApp from your phone. Your parent or guardian opens a page that explains exactly what we share, taps "I agree", and enters their name and relationship to you. We record the time of approval and the purposes they approved.
• Before approval: you practise normally, but we do not store your first name and you do not appear to any teacher.
• If your parent or guardian declines to approve, we erase the account and its data right away. You can keep practising without an account.
• If your parent or guardian's approval never arrives: we disable the account and hide its data after 30 days, then erase it permanently after another 30 days. Before the permanent erase, your parent or guardian can still approve from the same link and the account comes back as it was. You can keep practising without an account.
• Your parent or guardian can withdraw their approval in one tap from the same link; your name and results then disappear from your teacher's and your school leadership's view at once, and the report link stops working.
• When you turn 18 you can change your answer from "My account" and manage your consents yourself.

7. How long we keep your data

• Your personal account data: as long as your account exists. If you do not sign in to your account for 24 months, we send you a notice; if you still do not sign in, we disable the account and hide its data after 30 days, then erase it permanently after another 30 days.
• The consent record: as long as the account exists, and it is deleted with it.
• Your conversations with the Telegram bot: 12 months from the date of the message.
• Your email or number on the interest list: until you unsubscribe, or 12 months after the last message we sent you.
• Practice data (answers and progress): kept after the account is deleted, but without any link to your name or email, so it does not identify you.
• Backups are replaced periodically, and if we restore a backup we re-apply every deletion request.

8. Your rights

Under the Personal Data Protection Law, you have the right to:

• Be informed: know what we collect and why (this policy).
• Access: see the personal data we hold about you.
• Obtain a copy of it in a clear format.
• Correction: change your name or details from "My account" or by writing to us.
• Destruction: delete your account from "My account" → "Delete my account", or by writing to us.
• Withdraw your consent at any time, without affecting what was done before.
• Complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) within 90 days of the incident or of when you became aware of it.

To exercise any right, write to us at privacy@nabras.app. We reply within 30 days at most, and in exceptional cases we may extend this by another 30 days and tell you the reason in advance. We verify your identity before carrying out the request. If you are under 18, your parent or guardian can exercise these rights on your behalf.

9. Deleting your account

From "My account" → "Delete my account", then one confirmation. Within 24 hours we delete all your personal data (sign-in method, email, name, consents), remove you from any class, and stop the report link. Your previous answers remain, without any link to you.

10. How we protect your data

• Your personal data is in a separate section of the database that the website and the app cannot reach directly; only our server reads it.
• All connections are encrypted over HTTPS.
• Approval and report links are random, stored encrypted, and either expire or can be stopped.
• The AI and the analytics tools do not receive your name, email or phone number.
• We review the separation before every new release.
• If your data is leaked, we notify SDAIA within 72 hours of becoming aware of it, and we notify you without delay if it may harm you, together with what you need to do.

11. Cookies and local storage

We use local storage (localStorage) to save your progress on your device, and standard cookies for analytics tools. You can clear or block them from your browser settings at any time.

12. YouTube and YouTube API Services

Nabras publishes educational videos on its YouTube channel using YouTube API Services. In using this feature we comply with the YouTube Terms of Service, and Google's use of related information is governed by the Google Privacy Policy. This use does not involve access to your personal YouTube or Google account data, only publishing content to the Nabras channel.

13. Changes to this policy

If we change anything material, we publish it here and update the "Last updated" date, and if the change concerns a new purpose for your data we ask for your consent before applying it.

14. Contact us

privacy@nabras.app

See also: Terms of Use (English).