◆ Privacy

Privacy Policy

Last updated 16 August 2026

This policy explains what personal information Dars collects, why we collect it, who we share it with, and the rights you have over it. We've tried to write it in plain English. If anything is unclear, email us at support@darsapp.com.

Who we are

Dars (“we”, “us”) is the operator of the Dars mobile app and the website at darsapp.com. We are the data controller for the personal information described below. You can reach us at support@darsapp.com.

What we collect

We collect only what we need to run the app. The categories below are exhaustive — we don't collect anything else.

Account and profile

Your email address and display name, supplied when you sign up.
If you sign in with Apple or Google, the identifier that provider returns to us (we don't see your Apple/Google password).
Your age band (under 13, 13–17, or 18+). We use this to apply the child-safety protections described under Children and young people below.
Optional profile fields you choose to provide: chosen username, avatar style or a profile photo you upload, study pathway, year level, madhab, syllabus preferences, daily-minutes goal, preferred study time, and language.
For students under 16, a parent or guardian email address may be collected at sign-up so we can comply with UK GDPR safeguarding requirements.

Study activity

Your progress through the curriculum: which books and chapters you've read, marked, or bookmarked; flashcard review state and ratings; study session length and outcomes; quiz, challenge and mock-exam results; streaks, levels and achievements.
Notes you write inside the app.
Custom flashcard decks and study materials you create or import.
Resources listings you publish, including the title, description, and content of any deck or PDF you upload.

Photos and documents you provide

The AI deck builder lets you photograph a page of your notes, pick an image from your photo library, or attach a PDF, and turns it into flashcards. The file is uploaded to our private storage, processed as described under AI features below, and kept against your deck until you delete it or your account. We only ever read the specific file you pick — we do not scan or index your photo library. A profile photo you upload is stored separately and is visible to other users on your public profile.

Lesson recordings and transcripts

The Lessons feature lets you record a live class so it can be transcribed and turned into revision material. This is entirely opt-in: nothing is recorded unless you start a recording, and the app shows a clear recording indicator throughout. Recording continues while your screen is locked or you are in another app, which is why Dars declares background audio use.

When you record a lesson we collect:

The audio captured from your device's microphone, uploaded in chunks to our private storage.
The resulting transcript, plus the title, summary, key points and flashcards generated from it.
Recording metadata: duration, timestamps, language, and which book or chapter you filed the lesson under.

Audio is sent to our transcription and AI providers (listed under Who we share it with) purely to produce the transcript and summary. You are responsible for having permission to record your class — please ask your teacher first.

AI features

Dars uses AI in three places: the “Abdullah” tutor, the AI deck builder, and lesson transcription and summarising. In each case your input — your message, your uploaded photo or PDF, or your lesson audio and transcript — is sent to the AI provider handling that feature, along with a small amount of relevant curriculum context, and the result is stored on our servers so it persists across your devices.

Our AI providers are contractually bound to process your content only to return a result to us. They do not use it to train their models. Our current providers, and what each one receives, are listed under Who we share it with.

Community features

Dars has optional social features: halaqahs (study circles), friends, duels, leaderboards, an activity feed, and public profiles. If you use them we collect and store the content and connections they involve — halaqah names and descriptions, your membership and role, messages and posts you write, challenge and duel results, and your friend list. What other users can see is set out under What other people can see below.

Safety reports and blocks

If you report a piece of content or a user, we store the report, the reason you gave, any note you added, what was reported, and your account identifier, so we can investigate and act on it. If you block someone, we store that block. Reports may be retained after the reported content is removed so we can enforce our rules against repeat behaviour.

Bug reports

If you send a bug report from inside the app, we store your description, the technical state of the app at the time, and — only if you choose to attach one — a screenshot of the screen you were on. Screenshots go to private storage and are only opened by us while investigating your report.

Subscriptions and purchases

If you subscribe to Dars Plus or buy an AI top-up, the actual payment is processed by Apple (App Store) or Google (Play Store). We do not receive your card details. We do receive, via our subscription provider RevenueCat, a record of your subscription status, product identifier, renewal date, and a customer identifier linked to your Dars account so we can grant or revoke paid features. We also keep a ledger of your AI credit usage.

Device, analytics and diagnostics

Product analytics via PostHog (hosted in the EU): which screens you open and which features you use. These events are linked to your user identifier, and to your email address if you are 13 or over, so we can understand real usage patterns and debug account-specific problems. Analytics are switched off entirely for accounts under 13.
Crash reports and error diagnostics via Sentry. These carry your user identifier and the technical context of the error, so we can reproduce the bug. Your email address is attached only if you are 13 or over.
Push-notification tokens (if you grant permission) so we can send study reminders and notify you about activity in your halaqahs.
Standard technical information any app or website receives: device model, operating system version, app version, IP address of the request, language, and timezone. Our over-the-air update service (Expo) receives this when your app checks for an update.

Dars does not track you across other companies' apps or websites, and does not use the advertising identifier.

Device permissions we ask for

Every permission below is requested in context, at the moment you first use the feature that needs it, and you can decline or later revoke any of them in your device settings. Declining only disables that one feature — the rest of Dars works normally.

Microphone — to record a lesson when you tap record in the Lessons tab. Used for nothing else. Recording continues in the background so it survives the screen locking.
Camera — to photograph a page of your notes for the AI deck builder, or to take a profile photo.
Photo library — to let you pick an existing image of your notes, or a profile photo. We receive only the images you select.
Notifications — to send study reminders and halaqah activity alerts. Entirely optional.
Files — to let you attach a PDF you choose to the AI deck builder or to a Resources listing.

How we use it, and our legal basis

To run the app — sync your progress across devices, generate revision material, transcribe the lessons you record, and operate the community features you opt into. Legal basis: performance of our contract with you.
To grant features matched to your subscription tier. Legal basis: performance of our contract with you.
To keep Dars safe — moderate content, act on reports, enforce blocks, and prevent abuse. Legal basis: our legitimate interest in a safe service, and our safeguarding obligations to younger users.
To improve the app — fix bugs (Sentry), understand which features people use (PostHog), and respond to support requests. Legal basis: our legitimate interest in improving Dars.
To send study reminders and notifications you have opted into. Legal basis: your consent.
To meet legal obligations — tax, accounting, and responding to lawful requests. Legal basis: compliance with a legal obligation.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not run third-party advertising in the app.

Who we share it with

We use a small number of vendors (“processors”) to run Dars. Each only gets the data it needs to do its job, and is bound by a written data-processing agreement.

Supabase — authentication (sign-up, sign-in, password and OAuth handling), primary database, and file storage for your account, study state, notes, decks, uploads, lesson audio, and resources.
RevenueCat — subscription management and receipt validation.
Anthropic — generates AI tutor replies, and reads the photo or PDF you submit to the AI deck builder in order to produce flashcards.
Soniox — transcribes lesson audio. Your recording is streamed to Soniox as you record, so the live transcript appears word by word, and the completed audio is sent for a final pass.
Google (Gemini API) — turns a finished lesson transcript into a title, summary, key points and flashcards. Receives the transcript text, not your identity.
OpenAI — generates the search embeddings that let the AI tutor find relevant passages in your syllabus, and acts as our fallback transcription provider if Soniox is unavailable.
PostHog — product analytics, hosted in the EU.
Sentry — crash reporting.
Expo — delivers over-the-air app updates.
Apple, Google, Resend — for in-app purchases, push notifications, and transactional email respectively.

We may also disclose information where we are legally required to, or where it is necessary to protect the safety of a user — for example a credible safeguarding concern about a young person.

What other people can see

Most of what Dars stores is private to you. The exceptions are the things you deliberately publish:

Your public profile — username, display name, avatar or profile photo, level, streak and achievements are visible to other users who find your profile, and on leaderboards you appear in.
Halaqahs — other members see your name, avatar and study activity within that circle, and anything you post there.
Resources listings — public once reviewed and approved by us, shown alongside your name.
Lessons and decks you share — visible to whoever you share them with: a halaqah, a book or chapter, or the public Resources area if you choose that.

Your notes, private decks, AI tutor conversations, unshared lesson recordings and transcripts, and your account details are never shown to other users. Social features are hidden by default for users under 16.

Stored on your device

Dars keeps a local copy of your library, flashcards and progress on your device so it works offline, and stores your sign-in token in the device's secure keystore (iOS Keychain / Android Keystore). Lesson audio is held on the device until it has uploaded. Deleting the app removes all of this local data.

International transfers

Some of the providers above are based in the United States. Where personal information is transferred outside the UK or EU, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, depending on the recipient.

How long we keep it

Account, study activity, notes, and decks: kept while your account exists. Deleted when you delete your account.
AI tutor conversations, AI deck builder uploads, lesson recordings and their transcripts: kept while your account exists, or until you delete the individual item. Deleted when you delete your account.
Bug-report screenshots: deleted once the report is resolved, and in any case when you delete your account.
Safety reports and block records: kept for up to 2 years after the report is closed, so we can act on repeat behaviour.
Crash reports: 90 days, then automatically purged by Sentry.
Analytics events: 12 months, then anonymised or purged by PostHog.
Subscription and payment records: kept for 7 years where required for tax and accounting law.

Your rights

Under the UK GDPR you have the right to access, correct, port, and erase your personal information, to object to or restrict its processing, and to withdraw consent where we rely on it. You can exercise most of these from inside the app:

Delete your account — in the app, go to Profile → Delete account, or do it on the web at darsapp.com/delete-account. This permanently erases your profile, study history, notes, decks, AI conversations, lesson recordings and transcripts, uploads, and any resources listings you've published.
Get a copy of your data — email us at support@darsapp.com and we'll send an export within 30 days.
Correct or restrict — most profile fields can be edited inside the app. For anything you can't edit there, email us.
Withdraw consent — turn off notifications, or revoke the microphone, camera or photo permissions, in your device settings at any time.

If you believe we've handled your data unlawfully, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We'd appreciate the chance to put it right first — email support@darsapp.com.

Children and young people

Dars is intended for Alimiyyah students aged 11 and older. Children under 13 should only use Dars with the involvement of a parent, guardian, or madrasah. For users under 16 in the UK or EU, we may ask for a parent or guardian email address at sign-up.

Accounts we know to be under 13 are treated differently:

Third-party product analytics are switched off completely — no events are sent at all.
No email address is attached to crash reports; only an anonymous account identifier is.
Social features — friends, duels, leaderboards and public profiles — are hidden. This applies to all users under 16.

Until an account's age is known, we apply these protections by default. Parents who want to review, correct or delete their child's account can email support@darsapp.com and we will respond within 30 days.

Content moderation

Anything you publish where other users can see it passes an automatic filter before it is stored, and Resources listings are reviewed by a person before they go public. Every shared surface carries a report action, every profile carries report and block, and AI answers carry a flag. Reports are reviewed within 24 hours. Blocking is reversible at Profile → Blocked accounts.

Security

All traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Your account is protected by your sign-in method (Apple, Google, email + 6-digit code, or email + password, handled by Supabase), and your session token is held in your device's secure keystore. Database access is row-level-restricted so other users cannot read your private data, and lesson audio, deck uploads and bug screenshots live in private storage that is not publicly readable. No system is perfectly secure — if you spot a vulnerability, please email support@darsapp.com.

Changes to this policy

If we make material changes we'll update the “Last updated” date at the top of this page and, where the change is significant, notify you in-app or by email before the change takes effect.

Contact

Questions, requests, or complaints: support@darsapp.com.