Privacy policy
This page explains in plain words what we collect about you, why, where it is stored, who sees it, and how you ask for it to be deleted.
Last updated2026-09-14
The short version
- We collect only what the teaching needs: your name, your email, your progress.
- We do not sell your data, put ads in it, or use any third-party tracker.
- Your password is never stored as readable text — only as a hash that cannot be reversed.
- Your data sits on servers inside the European Union, in Frankfurt.
- Your teacher and the academy’s administrators can see it — nobody else.
- You can ask for a copy, a correction, or deletion of your account at any time.
What we collect, and why
We collect what the teaching needs and nothing beyond it. It falls into two halves: your account, and your learning.
- Your full name in Arabic (and in English if you enter it) — so your teacher knows you, and so it can be printed on your certificate.
- Your email address — it is how you log in, and how we write to you.
- Your password — never stored as readable text. We store an Argon2id hash of it, which cannot be turned back into the password; we cannot see it ourselves.
- Your phone number — entirely optional, and only if you choose to give it.
- Your chosen interface language, your role at the academy (student, teacher, administrator), and a record of who approved your account and when.
- If you turn on two-factor authentication: its secret, stored encrypted with AES-256-GCM rather than in the clear.
- Your progress through lessons: what you completed, your answers to exercises and quizzes, and your marks.
- Your review cards and their schedule, your XP, badges and level, and your optional consent to appear on the leaderboard.
- Your enrolments in courses and sections, your submitted assignments and your teacher’s feedback on them.
- Your attendance and participation in live classes.
- What you write in class discussions, and the evaluations you send about your teachers.
- Certificates issued to you and their verification code, and the notifications sent to you.
Why all of it? Because Rosy is real teaching rather than a standalone app: your teacher needs to see where you have got to in order to help you, a certificate needs your name on it, and spaced review needs to remember what you forgot.
Technical records we keep, for security only
- When you log in we keep a session record holding your IP address, your browser type and the time — so we can notice suspicious logins, and so you can end sessions if you think someone reached your account.
- We keep an audit log of sensitive actions (activating an account, changing a permission, resetting a password) with who did it, when, and from which IP — so the academy can see who did what.
These records exist for security and accountability alone. They are not used for marketing, they do not measure your behaviour, and they are not shared with anyone outside the academy.
What never leaves your browser
- Speaking practice uses the speech recognition built into your browser. Your voice does not reach our servers and we do not store it; we save only the result of the exercise. In fairness: some browsers — Chrome, for instance — send the audio to their own recognition service to process it. That is your browser’s doing, governed by its policy, not ours.
- Handwriting practice runs entirely inside the browser. We save that you completed it and your score, not your handwriting.
Cookies
Three, and all three are necessary for the site to work:
- rosy_at and rosy_rt — they hold your session so you are not asked for your password on every page. Page scripts cannot read them (httpOnly), and they are sent only to our own site.
- locale — remembers the interface language you picked.
No advertising cookies, no Google Analytics, no tracking pixels, no third-party analytics of any kind. None of that exists in Rosy.
Where your data lives
In a managed PostgreSQL database on Supabase in the eu-central-1 region — Frankfurt, Germany, inside the European Union. Traffic to the site is fully encrypted over HTTPS, and the app enforces that rather than merely offering it.
The platform serves more than one institute, and each institute’s data is isolated from the others — no other institute can see your account or your marks.
Who can see it
- You — everything that is yours.
- Your teacher, for the section you study in — your progress, attendance, assignments and marks.
- The academy’s administrators and its support staff — they can look your account up, see its summary in order to help you, and manage it.
- The infrastructure providers we run on (Supabase for storage, Vercel for hosting), as technical processors — not as users of your data.
And nobody else. We do not sell your data, we do not rent it, and we do not share it with advertisers. We would hand it to a third party only where an applicable law compels us to.
How long we keep it
- While your account exists we keep your data so your studies continue and your certificate stays verifiable.
- Session records expire automatically within 30 days at the most, and are revoked immediately when you log out or change your password.
- When you ask us to delete your account we deactivate it, end its sessions at once, and stop your access.
And honestly: not everything vanishes. Audit logs and issued certificates remain as an academic record and so a certificate can still be verified, and the academy may keep your marks and attendance as a study record. Write to us and we will tell you exactly what can be erased, what has to stay, and why.
Your rights, and how to use them
All of the following are yours; asking on the contact page is enough:
- Ask for a copy of your data.
- Correct anything in it that is wrong.
- Ask for your account to be deleted.
- Withdraw your consent to appear on the leaderboard.
- Simply ask: what do you know about me?
We will ask you to confirm that the account is yours before acting — not to be difficult, but to protect you from someone impersonating you.
How we protect your account
- Passwords are stored as Argon2id hashes, among the strongest options available today for the purpose.
- Two-factor authentication is available to you, and its secret is stored encrypted with AES-256-GCM.
- Your session token is replaced on every refresh, and if an old one is used a second time we treat that as a sign of theft and end every session in that chain.
- Every page is served over HTTPS under a strict content policy that stops the page loading anything from outside our own domain.
Even so, no system is perfectly secure. If you notice anything odd about your account, tell us straight away; we would far rather have a false alarm than a stolen account.
Younger students and parents
No Rosy account opens without the academy’s approval; signing up alone is not enough. If a student is a minor we ask their parent or guardian to read this page, and the guardian may exercise the rights above on the student’s behalf through the contact page. We do not ask any student for data beyond what their studies need.
If this policy changes
If we change something substantive we will update the “last updated” date at the top of this page, and tell students inside the app where it matters. We will not quietly widen the use of your data to a new purpose without saying so plainly.
To request or delete your data
If you can sign in, file a request and say exactly what you want. We will confirm the account is yours first, then act and tell you what was done. How to reach us is on the contact page.