Privacy Policy

Tabayyun is source-grounded Islamic research and learning software operated under the business name Tabayyun Technologies, currently an unincorporated business. This Privacy Policy applies to the service available at app.tabayyun.net and tabayyun.net. Tabayyun Technologies is responsible for deciding how personal information is used for the Service.

Privacy and legal inquiries: contact@tabayyun.net.

We collect account information and the content you submit to provide Q&A, Source Explorer, Research, and Khutbah Builder. We share necessary portions with service providers, including our AI provider, OpenAI, and keep saved content until you delete it or close the account, subject to the exceptions described in this policy. We do not sell personal information, and we do not use advertising or analytics cookies.

Religious questions and settings may reveal sensitive religious beliefs. OpenAI does not use content we send through its API to train its models by default, and keeps it for up to 30 days in abuse-monitoring logs before deleting it. We do not use identifiable user content to train our own AI models. Human access for product improvement requires separate optional permission. We may use future content for training our own models only after legally and technically verified anonymization; no such training takes place today. You can request access or deletion through Settings or contact@tabayyun.net. Certain linked billing, audit and security records may remain after deletion, as described in section 9.

3.1 Your account

When you sign up we collect:

• your email address and a password (required). Your password is handled by our authentication provider, Supabase. We do not receive or store your password in plain text;
• your first name and last name (required by the sign-up form);
• your phone number, if you choose to give one. It is optional, is held in your account, is used only to contact you about your account, and you can change or delete it in Settings at any time;
• technical account records kept by Supabase, such as your account ID, when the account was created and when you last signed in;
• a record of your acceptance: when you sign up you must tick a box to agree to the Terms of Service and acknowledge this Privacy Policy, and confirm that you are 13 or older. We record the date you accepted, the versions of the Terms of Service and Privacy Policy you accepted, your 13-or-older confirmation, and whether you accepted at sign-up or later.

Why: to create and secure your account, sign you in, let you manage it, and keep a record that you accepted our Terms.

3.2 Questions and answers (Q&A, Standard Mode and Scholar Mode)

When you use Q&A we store, in your account:

• your questions and the answers we generate, organised into conversations, with technical details of each answer (for example which sources were cited);
• bookmarks you save;
• missing-source reports you send us, which contain the question, the answer you were given, the sources that were retrieved and your comment;
• your Scholar Mode acknowledgement: the version of the Scholar Mode notice you agreed to, a fingerprint of its exact text, and the time you agreed.

Why: to answer your questions, show you your history, and let you report gaps in our sources.

3.3 Khutbah Builder and "My Khutbah Style"

When you use Khutbah Builder we store your khutbah drafts and saved khutbahs, including topic, occasion, audience, any madhhab preference you choose, your form inputs, the document text, earlier saved versions, and the results of our source checks.

If you use My Khutbah Style, you can upload your own previous khutbahs (text, Markdown, PDF or Word files). We store:

• the original file in private file storage;
• the extracted text, split into passages;
• a numerical representation of each passage (an "embedding"), created by sending the passage text to OpenAI;
• a style profile that describes your writing style, and your style settings.

We use these only to make drafts sound like you. Passages from your uploads may be included in the instructions we send to OpenAI when we generate a khutbah for you.

Why: to provide Khutbah Builder and its style feature.

3.4 Research

When you use Research we store your research projects: the question and options you entered, the reports we produce, earlier versions, follow-up questions and the status of each run.

Why: to run and save your research.

3.5 Prayer times

Prayer-time settings are optional.

• Your calculation method, Asr setting and high-latitude rule are saved to your account.
• A location is used to calculate prayer times. You can type a city name, or let your browser share your device's location.
• If you type a city, the text you type is sent to Open-Meteo to find matching places.
• If you use your device's location, the coordinates stay in your browser and are not sent to Open-Meteo.
• Your location is stored in your browser. It is saved to your account only if you turn on location sync. When saved to your account, the coordinates are rounded to 0.1 degree (about 11 km, roughly city level), together with the place label and time zone.
• For older saved city locations that have no time zone, the App sends that location's coordinates to Open-Meteo once to look up the time zone.

Why: to show prayer times for where you are.

3.6 Plans, payments and usage

If you buy a paid plan:

• Stripe handles payment. You enter your card or other payment details on Stripe's checkout page. We do not receive or store your full card number.
• Stripe collects your email, name and billing address on the checkout page. We create a Stripe customer record linked to your Tabayyun account ID.
• We store your Stripe customer ID, your subscription status, the plan you are on, which features it unlocks, and when your current billing period ends.
• We record billing events from Stripe that affect your account, such as a failed payment, a refund or a payment dispute, so we can adjust access and contact you if needed.

For every plan, including Free, we keep a usage ledger: a record of each counted use of a feature (for example one question, one research run or one khutbah generation), with a request ID and time, so we can apply monthly allowances. For some Scholar Mode runs that end without an answer, the ledger also holds a one-way hash derived from the question text. It is used only to stop the same request being counted twice.

Why: to take payment, give you the features you paid for, apply allowances, and handle refunds and disputes.

3.7 Website contact form and waitlist

Contact form. The website collects the name, email, role, optional organization and message you submit. It sends the submission through Resend to our inbox, which is hosted by Namecheap Private Email. Ordinary contact submissions are not saved in the application database.

Waitlist. Waitlist registration opens only after this policy is published. When you register interest, we collect your name, email, optional role and organization, your message about intended use, and whether you asked to receive product-update emails, together with the wording of that request and when you gave or withdrew it. We hold waitlist registrations in our database and may send an operational notification to our inbox.

Product-update emails are optional. You can join the waitlist without agreeing to them, and the box to agree is not ticked in advance. If you tick it, we send you a confirmation email with a link that works for 7 days, and we send product-update emails only after you confirm. Every product-update email includes a one-click unsubscribe link, and you can also withdraw by emailing contact@tabayyun.net.

To delete a waitlist registration, email contact@tabayyun.net. Waitlist registrations are separate from accounts, so deleting an account does not delete a waitlist registration.

3.8 Technical, security and log data

When you use the Service, our servers and providers process:

• your IP address and request details. Our web server uses IP addresses to limit the rate of requests and records them in its access logs. The website contact form also uses your IP address to limit repeated submissions; this is held in memory only and not written to the database;
• application logs, which can include your account ID and Stripe IDs alongside events such as an account deletion, a billing event or an error. Our application logs do not record the text of your questions or answers;
• usage and timing records: for each Q&A request, a line with timings, counts and a pseudonymous identifier derived from your account ID with a secret key. It does not contain your question or answer. The App also sends one numbers-only timing report per answer (for example how long the answer took), without question text or IDs;
• gradual feature roll-outs: we may turn a new feature on for a share of accounts first. Which group you are in is worked out from a pseudonymous identifier.

Why: to keep the Service running, secure and fast, to stop abuse, and to fix problems.

To deliver answers, research and khutbahs, we transmit your question, relevant earlier conversation messages, source passages, and selected options to OpenAI, our AI service provider. For My Khutbah Style, relevant parts of your uploaded khutbahs may also be sent for embeddings and generation. We do not intentionally attach your account name or email as identifying fields, but your own submissions may contain identifying details. For some advanced research requests, a search query derived from your question is sent to Tavily, restricted to approved sites.

OpenAI's use and retention. Content we send to OpenAI (your questions, conversation context, source passages and khutbah style passages) is sent through OpenAI's API. Under OpenAI's API data policy, it is not used to train OpenAI's models by default, and it is stored for up to 30 days in secure abuse-monitoring logs, after which it is deleted. Tavily processes the search queries we send it under its own terms.

Separate permission for human quality review. Staff review of your content for quality evaluation, feature improvement or prompt assessment requires your separate, optional permission. We do not currently ask for this permission, so no such review takes place. If we introduce it, you will be able to withdraw it for future access. Staff may access your content where needed for support you request, for security, or to meet legal obligations.

Own-model training. We will not use identifiable customer content to train our own models. Only future content that has been made genuinely anonymous following technical review and legal approval may be eligible for training. Mere pseudonymization or removal of names is insufficient; until this capability is verified, no such training will occur.

We do not intend to make solely automated decisions with legal or similarly significant effects about users.

We do not sell your personal data. We share it only with the service providers below, who process it for us under contract, and where the law requires.

• Supabase: sign-in, database and private file storage. Data: account details, everything you save in the App, uploaded khutbah files, waitlist records. Location: Supabase-hosted infrastructure.
• Supabase (built-in email): sending account emails, such as sign-up confirmation and password reset. Data: your email address. Location: Supabase-hosted infrastructure.
• OpenAI: AI model processing. Data: questions, conversation context, source passages, khutbah style passages. Location: United States.
• Tavily: web search on approved websites. Data: search queries built from your question. Location: United States.
• Stripe: payments and subscriptions. Data: payment details, email, name, billing address, Tabayyun account ID, subscription records. Location: United States.
• Resend: sending contact-form, waitlist notification and waitlist confirmation emails. Data: name, email, role, organisation, message, consent details. Location: United States.
• Open-Meteo: place search and time-zone lookup for prayer times. Data: the city name you type; for older saved cities, that city's coordinates. Your IP address is visible to Open-Meteo because your browser contacts it directly. Location: European Union / Switzerland.
• DigitalOcean: hosting the servers that run the App, the Website and our application. Data: all data passing through our servers, and server logs. Location: United States.
• Namecheap Private Email: hosting our email inbox, contact@tabayyun.net. Data: messages and waitlist notifications sent to us. Location: Namecheap-hosted infrastructure.

We may also disclose data if the law requires it, to protect the rights and safety of users or others, or as part of a merger, acquisition or sale of assets, in which case we will tell you.

Questions, khutbahs, research topics and prayer-related settings can reveal religious beliefs and practices. Where such information qualifies as sensitive or special-category data, we will rely on a lawful basis and, where required, an additional lawful condition under the GDPR/UK GDPR or relevant local law.

We use this information to deliver the features the user requests and do not sell it or use it for personalized advertising. Improvement review is separately optional, and identifiable user content is not eligible for our own model training. We do not claim a confidential relationship between users and scholars, imams or muftis.

We do not use advertising or analytics cookies, and we do not use third-party tracking tools.

Cookies. The App sets cookies only to keep you signed in (Supabase sign-in cookies). These are strictly necessary for the App to work. The Website does not set cookies. When you pay, Stripe's checkout page sets its own cookies under Stripe's policy.

Browser storage. The App stores some data in your browser's local storage and session storage, on your device. This data stays on your device and is not sent to us unless a feature saves it to your account:

• theme, source and reading preferences, to remember your display choices;
• Source Explorer bookmarks, notes, reading progress and recently viewed sources, for library features;
• khutbah drafts, recovery copies and Delivery Mode font size, to avoid losing unsaved work;
• research recovery copies and run options, to avoid losing unsaved work;
• prayer location and settings, for prayer times;
• Scholar Mode on/off state, a question handed between pages, and answers waiting to be saved, to keep the App working between pages;
• which account last used this browser, and accounts deleted in this browser, to keep different accounts' data apart on a shared device.

You can clear this data in your browser settings. In Settings you can clear reading history. When you delete your account in this browser, the App removes that account's browser data.

8.1 In the App

In Settings you can:

• download your data as a file (up to 3 times an hour). It includes your profile, conversations, messages, bookmarks, missing-source reports, research projects and versions, khutbahs and versions, khutbah style documents and passages, style profile, Scholar Mode acknowledgement, your Terms and Privacy Policy acceptance records, prayer settings, your current plan and subscription details, a total of your usage per feature, and the preferences stored in your browser. It does not include your original uploaded files, row-by-row usage records, your Stripe customer ID, or internal billing flags;
• clear your Q&A chat history and clear reading history;
• delete individual conversations, khutbahs, research projects and uploaded style files;
• delete your account, after entering your password again;
• change your name, phone number and password, and remove your phone number;
• manage or cancel your subscription through Stripe's billing portal.

8.2 By email

You can also contact us at contact@tabayyun.net to exercise any of your rights. We may need to confirm your identity first. We will reply within the period required by applicable privacy law (for example, generally one month under GDPR, subject to lawful extensions).

8.3 Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent, without affecting earlier processing;
• complain to a data protection authority, such as the authority in the country where you live.

We keep personal data for as long as necessary for the purposes described in this policy, unless a longer period is required by law. Account data and saved content are kept while your account remains open or until you delete them.

When you delete a khutbah, its text and all of its saved versions are permanently deleted, together with the source-check results and bookmarks that belong only to it. We keep a record with no khutbah content (its ID, status and dates) so that a deleted khutbah cannot be restored by an old autosave; that record is deleted with your account.

After you delete your account, some records linked to your former account ID are kept: the usage ledger (including the limited question-derived hashes described in section 3.6), a deletion record containing identifiers, Stripe's customer and payment records, billing event IDs, server and application logs, and backup copies. These records are not anonymous. We keep them only for purposes such as tax and accounting, resolving payment disputes, fraud prevention, system security and proving deletion, for as long as necessary for those purposes, unless a longer period is required by law.

• Account information, Q&A and research: until you delete them or close your account.
• Khutbahs and versions: until you delete the khutbah or close your account; a record with no content stays until you close your account.
• Uploaded khutbah-style files: until you delete the file or close your account.
• Terms and Privacy Policy acceptance records: until you close your account.
• Usage ledger and question-derived hashes: for as long as necessary for the purposes described in this policy, unless a longer period is required by law.
• Deletion records: for as long as necessary for the purposes described in this policy, unless a longer period is required by law.
• Stripe customer, payment and billing event records: for as long as necessary for the purposes described in this policy, unless a longer period is required by law. Stripe also keeps its own records under its own policies.
• Waitlist registrations: for as long as necessary for the purposes described in this policy, unless a longer period is required by law, or until you ask us to delete them.
• Contact emails and inbox messages: for as long as necessary for the purposes described in this policy, unless a longer period is required by law.
• Server access, application and security logs: for as long as necessary for the purposes described in this policy, unless a longer period is required by law.
• Database backups: 30 days.
• Device-local browser storage: until you clear it, or until the account-deletion flow removes it on that browser.

Deleted data may remain in backups until those backups expire after 30 days. Requests are reviewed under applicable privacy laws. We do not describe linked retained records as anonymized merely because an account has been deleted.

Your data is processed in the countries where our providers operate, including the United States and Canada, and, for prayer-time place search, the European Union and Switzerland. This may be outside the country where you live.

We protect your data with measures including:

• encrypted connections (HTTPS) to the App and Website;
• database rules that let each account read only its own rows, and server-only access to billing and waitlist tables;
• passwords handled by our authentication provider, and a fresh password check before account deletion;
• request rate limits to reduce abuse.

No system is perfectly secure. Please use a strong password that you do not use elsewhere. If we become aware of a breach that affects you, we will notify you and the authorities as the law requires.

The intended minimum age is 13. Users must confirm at sign-up that they are 13 or older. The Service is not directed to children under 13 and will take appropriate steps if an account is found to belong to a child under that age. Different jurisdictions may set a higher age of digital consent or require parent/guardian consent and additional safeguards for teenagers.

Answers and research may link to or quote other websites and publications. Their own privacy policies apply when you visit them.

We may revise this Privacy Policy and post a new version. For material changes, our intended default is at least 30 days' advance notice, or longer where applicable law requires. Where processing requires additional consent, we will obtain it before beginning that processing.

Canada. Canadian federal and applicable provincial privacy laws may apply. You may request access to and correction of your personal information, and you may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

European Union / United Kingdom. You have the rights described in section 8.3, and you may complain to the data protection authority in the country where you live.

United States. Depending on the state where you live, state privacy laws may give you additional rights. You can exercise them by contacting contact@tabayyun.net.

Other countries. Availability worldwide does not mean that Ontario law supersedes local mandatory data protection law.