Privacy Policy — Sanabel
In short: Sanabel is a learning app for children. It shows no ads, and all of it works without an account: the child buys from the app's market with coins earned by learning, never with money. Nothing the child types or says leaves the device. Their progress leaves it only with Sanabel+, in the daily save of each child's journey to the parent's account (section 7), without their name or recordings. Sanabel+ is an optional subscription that only a parent buys, through Google Play, from the passcode-locked parent area; it needs the parent to sign in with a Google account, and then our server keeps the parent's account, phones and purchases, and for each child a random number and their last two daily saves (section 7). Otherwise, what leaves the device is: technical data sent to Google's Firebase Crashlytics to find faults, requests to download recitation audio, and Sanabel+'s voices for its subscribers. A letter or maths sheet to print leaves it only when it is printed or shared, to the printer or app chosen, and holds nothing about the child.
1. Who we are
This app is published by Amigos-lab, publisher of the Rafiqi and Sanabel apps. Privacy contact: sanabel.amigoslab@gmail.com.
2. What we do not collect
The app does not collect or transmit any of the following:
- Anything that says who a child is: not their name or voice. Each child's name, if a parent enters it, stays on the device, encrypted (section 3), and their picture is one of the app's animal drawings, never a photo. Their age and progress leave the device only in Sanabel+'s daily save, under a random number (section 7)
- Phone numbers, or the parent's email address: only the phone reads it, when the parent signs in with Google, to show who is signed in, and our server does not keep it (section 7)
- Payment card details: Google Play takes the payment, and we never see them
- Location
- Contacts, messages, or calendar
- Photos or files
- Camera — the app never requests camera permission
- Advertising identifiers (AAID) or similar — the app does not request that permission
- Fingerprint or face — the app's permissions include "use biometric hardware", which comes with the library that encrypts the children's names. The app never asks for or reads a fingerprint or a face
The microphone is used for one feature that the child starts themselves — see section 4.
3. Stored on your device
The app stores the following on the device and sends none of it to a server, except that Sanabel+'s daily save carries the first two, and the child's settings and picture (section 7). With more than one child (four at most), each child's are kept apart:
- Each child's progress and answers: Qur'an, Arabic letters, maths, Muslim life, the animal lessons and the games
- Their coins, tickets and badges, their garden and its animals, and what they bought in the market
- Each child's settings: their age, which subjects are on for them, and their maths level
- Each child's name (optional): encrypted with a key held in the Android Keystore, and never leaves the device; and their picture, one of the app's animal drawings
- Recordings of each child's own recitation (section 4)
- The family's settings: sound and motion, play-time rules, "Sleep time", and "Lock mode", which pins the app to the screen. The parent passcode is stored as a salted hash, never its digits; the phone counts wrong tries in a row, locks the keypad for five minutes after five, and sends that count nowhere
- A technical error log in the parent area, which a parent can read, copy and clear. The app sends it nowhere
If a parent signs in for Sanabel+, the app also keeps on the device: the Google account's email, shown in the parent area; the pass our server signs, which opens Sanabel+; Sanabel+'s downloaded voices (section 5); and the sign-in session token and a random installation identifier the app makes. Those last two are encrypted with a key in the Android Keystore and sent to our server with each request (section 7).
Backup: Android may include the progress and settings in the family's own Google account backup. That is Android's own feature, under Google's terms; the app sends nothing to it itself. The children's names, the recitation recordings, downloaded recitation audio and voices, the session token and the installation identifier are kept out of that backup and out of transfers to a new phone, so a phone restored from a backup signs in again. The passcode is in it only as its hash. The parent's email and the pass may be in it with the settings.
All of it is erased from the device when the app is uninstalled or its data is cleared in system settings.
4. Microphone, recordings and speech
On the "My recordings" screen a child records their own recitation and listens back to it. Microphone permission is requested for this feature alone, and only when the child starts a recording.
Recordings stay on the device and are never uploaded to any server. Each child has their own. They are excluded from Android's cloud backup and from device-to-device transfer. Any recording can be deleted from inside the app, and all of them are deleted when the app is uninstalled.
A parent listens to these recordings in the parent area to approve a surah as memorised, on the same device.
Much of what the app says aloud is ready-made audio: some inside the app, some downloaded by Sanabel+ subscribers (section 5). A line with no audio file is read by the phone's own text-to-speech engine; the app sends no text anywhere itself. The animal sounds are files inside the app.
5. Downloads
Five surahs are included in the app and work with no internet connection: Al-Fatiha, Al-Kawthar,
Al-Ikhlas, Al-Falaq and An-Nas. When another surah is chosen, the app downloads its audio once from
rafiqi-quran.amigoslab.net, Amigos-lab's server that Rafiqi Quran also uses. The audio
then stays on the device and works offline.
These requests carry no identifier of any kind — no account, no device ID, no cookies, and no data about the child. Just a fixed file path. Our hosting provider (Cloudflare) sees the connection's IP address and the requested path in its ordinary logs, as for any download. We do not collect or keep those logs.
Sanabel+ voices: when Sanabel+ is open and a parent is signed in, the app
downloads the voice files from Sanabel's server, api.sanabel.amigoslab.net. These
requests carry the parent's session and the installation identifier (section 7), so the server can
check the subscription; the server keeps no record of who downloads them. The voices then stay on
the device and work offline.
Every file is checked against a digital signature before it is used, so a child cannot be played audio other than the intended one.
6. Crash reporting (Firebase)
We use Firebase Crashlytics (Google) to find and fix technical faults, in the published version of the app only.
When the app opens, Firebase's libraries create an installation identifier for this app and record the start of a session: the device maker and model, the OS and app versions, the network connection type, and the time the app was opened. Google uses this to count how many devices a fault affects.
When a crash or technical error happens, it sends:
- The cause of the crash and where it occurred in the code
- Technical details of the error, such as which surah's audio failed to download and why
- Device state at the time (memory, storage)
- The installation identifier
None of this contains the child's name, the passcode, the child's voice or anything they type, and we link it to no account or identity. It is sent encrypted over HTTPS. Crashlytics keeps crash data, and its copy of the identifiers, for 90 days before deleting it. Firebase may keep the installation identifier itself until it is deleted; it names one installation of the app, not a person, and clearing the app's data or reinstalling it gives the app a new one. Google's privacy policy: policies.google.com/privacy; Firebase privacy: firebase.google.com/support/privacy.
7. Sanabel+ and the parent's Google account
Sanabel+ is an optional subscription that opens the rest of the lessons and games; all of the app works without it. Only a parent buys it, from the passcode-locked parent area or the first-launch setup, through Google Play, which takes the payment.
Signing in: Sanabel+ needs the parent to sign in with a Google account, through
Android's sign-in sheet, so the subscription follows them to any phone. The phone sends the sign-in
token Google issues to our server, api.sanabel.amigoslab.net, which checks it with
Google and keeps only a one-way hash of the Google account's identifier, not the email address or
the name the token also carries.
What our server keeps:
- A random account number, never derived from Google's data, with that hash
- For each signed-in phone, four at most: its model, to show in the list of phones; the random installation identifier (not a device identifier); when it signed in and was last used; and its session token, hashed
- Purchases as Google Play confirms them: the plan, Google's order number and purchase token, the subscription's state and its end date
- For each child in the family, four at most: a random number the phone made for them, and when they were added
- Each child's daily save, the latest and the one before: their progress and answers (Qur'an, Arabic letters, maths, Muslim life, the animal lessons and the games), their coins, tickets and badges, their garden and its animals, their picture (one of the app's animal drawings), age, maths level and subjects, with when each was saved, its size and its checksum (SHA-256). Each save is compressed, sent over HTTPS and stored encrypted by Cloudflare
The server never keeps the child's name, voice or recordings, the passcode or the family's settings.
The daily save: with Sanabel+, the phone sends the journey of each child who played since their last save, at most once a day, as the app goes to the background, so the parent can bring them back on a new phone after signing in. The parent can set it to manual (parent area → App → Daily save), and then nothing is sent until they tap "Save now".
When the app contacts our server: after a parent signs in: to sign in and out, to buy or restore a purchase, to check the subscription once a day, to download Sanabel+'s voices, and for the children's daily saves and bringing them back on a new phone. Each request carries the session token, the installation identifier and the app's version. When signing in and buying, the app asks Google Play to confirm the app and phone are genuine (Play Integrity); the server reads the answer from Google and does not keep it.
Before the app opens Google's screens, or when the subscription's prices cannot be shown, it asks our server whether it can be reached, even before a parent signs in, so it can tell the parent when the phone has no internet connection. That request carries nothing from the app: no session token, no installation identifier and no app version.
How long: a phone's session ends when it signs out, or after 180 days unused, and is then deleted. The account and its purchases stay until the parent deletes the account (section 11). A child's save stays until a newer one replaces it, the child is removed from the phone (their saves then go from our server when that phone next reaches Sanabel+ with the parent signed in), the parent removes them from the account on the daily save's card, or the account is deleted. A save that won't open when a child is brought back is deleted. When Sanabel+ ends, the last two stay 3 months, then are deleted.
Hosting and logs: Cloudflare hosts our server, its database and the children's daily saves. The server's log lines carry an error code and a request number, never a token, an email or an account number, and Cloudflare keeps them for at most 7 days. Like any host, Cloudflare sees the connection's IP address and uses it to limit how often the server can be called; we do not keep it.
8. Ads, purchases and links
The app shows no ads, contains no advertising SDK, and has no analytics beyond the crash and app-start reports in section 6. Its only purchase is the Sanabel+ subscription (section 7), which a child cannot reach behind the passcode; that is why the app's permissions include Google Play billing. It has no chat and no contact with other users. It leaves the app in these places only: the phone's settings, to turn the microphone on if that permission was refused; Android's print screen or share menu, when a sheet is printed or shared (section 10); and, from the parent area and the first-launch setup only, Google's sign-in sheet and Google Play's purchase sheet, Google Play's subscriptions page to manage the subscription, this page in the browser, Sanabel's page on Google Play to rate it, and the parent's own mail app, with a message to us already addressed. Sanabel sends nothing itself: a message leaves only if the parent sends it from their mail app, and we use what a parent writes only to answer them and to improve Sanabel, and keep it no longer than that needs. Once, in the parent area, Google Play may show its own rating sheet over the app; Google handles the rating, and the app is not told whether or how the parent rated.
9. Children
This app is directed to children. We comply with Google Play's Families policies, COPPA, and GDPR including its provisions for children. We collect no personal data from children beyond the installation identifier in section 6, used only to find and fix faults, and Sanabel+'s daily save (section 7): a parent turns it on by subscribing and can set it to manual, and it carries the child's progress and garden under a random number, never their name or voice, used only to bring their journey back on another phone. A Sanabel+ account is always the parent's, never the child's, and what our server keeps about it is in section 7. We do not serve personalised advertising, and do not share data with third parties for marketing.
10. Data sharing
We do not sell or share any data. We use two service providers only: Google, for crash reporting (Firebase Crashlytics) and for Sanabel+'s sign-in, payment and app check (Google account, Google Play, Play Integrity); and Cloudflare, to deliver the recitation audio and the voices and to host Sanabel's server, its database and the children's daily saves.
Sheets to print: in the letters and maths sections, a sheet can be printed, or saved as an image and shared. A sheet holds nothing about the child: a letter and words, or numbers and sums, drawings, and empty lines for a name and a date. The app hands it to Android's print screen or share menu and sends it nowhere itself, so it goes only to the printer or app chosen there, never to us. The image is written to the app's own temporary storage first.
11. Deleting data
To delete everything the app stores on the device, uninstall it or clear its data in system settings. A copy in the family's own Google account backup is deleted from that account's backup settings. Crash reports are tied to no name or account, so we cannot pick out one family's reports; Crashlytics deletes them after 90 days. Firebase may keep the installation identifier for longer; it too is tied to no name or account.
A Sanabel+ account is deleted by the parent in the app (parent area → App → Sanabel+ → Delete account), or without the app at api.sanabel.amigoslab.net/account/delete, by signing in with the same Google account. Deleting first stops the subscription's renewals, then deletes the account, its phones' sessions, its purchase records and every child's saves at once. We keep only the hash of the Google account's identifier for 30 days, so that restoring our database from its history cannot bring a deleted account back; Cloudflare's restore history keeps deleted data for at most 30 days, after which it is gone. Google keeps its own record of the purchase under its policy. Signing out deletes that phone's session, and removing a child, from the phone or from the account on the daily save's card, deletes their saves from our server. For any question about your data, contact sanabel.amigoslab@gmail.com.
12. Changes to this policy
If our practices change we will update this page and the effective date below.