Privacy Policy

1. What We Collect, at a Glance

2. Information You Provide

• Email Address — collected when you create an account or sign in using email and password, Sign in with Apple, or Sign in with Google. Used to authenticate you, secure your account, and contact you about your account.
• Display Name — a name you choose. Shown publicly next to your contributions.
• User ID — a unique identifier (UUID) generated by our authentication provider, Supabase, linking your contributions, votes, and profile to your account.
• Contributions and Votes — words, meanings, translations, and examples you submit, and your votes on community submissions. This content is stored and displayed publicly as part of the dictionary.
• Correspondence — the content of support requests, corrections, and reports you send us.

3. Information Collected Automatically

• Usage Data — pages and dictionary entries viewed, and features used. This is measured by analytics on the website and in the Android app only. Search queries are processed in order to return results, but we do not store a per-user search history on our servers.
• Device and Connection Data — IP address, browser or device type, operating system, language, and referring page. IP address is used for security, abuse prevention, and coarse (country-level) analytics. We do not collect GPS or precise location.
• Crash and Diagnostic Data (apps only) — if the app crashes, we receive a crash report containing device model, OS version, and a stack trace, via Firebase Crashlytics.
• Push Token (apps only) — if you enable notifications, Firebase Cloud Messaging issues a device token so we can deliver daily word notifications. You can disable notifications at any time in your device settings.

4. Cookies and Similar Technologies

The website uses the following categories of cookies and local storage:

• Strictly necessary — authentication session, security, and your saved theme preference. These cannot be disabled without breaking the Service.
• Analytics — Google Analytics 4 sets cookies to measure traffic and understand which dictionary entries are useful. See Section 5.
• Advertising — Google and its partners set cookies to serve and measure advertising. See Section 6.

The mobile apps do not use advertising cookies or identifiers. The Android app has the AD_ID permission explicitly removed, and neither app contains an advertising SDK.

You can control cookies through your browser settings, and — if you are in the European Economic Area, the United Kingdom, or Switzerland — through the consent banner presented on your first visit. See Section 11.

5. Analytics

Website. We use Google Analytics 4 to understand aggregate traffic patterns. Google Analytics collects your IP address, device and browser information, and the pages you visit. We have not enabled Google Signals, cross-device tracking, or advertising personalisation features within Google Analytics.

Mobile apps. Both the iOS and Android apps include Firebase Analytics, which automatically records basic app lifecycle events such as app opens, screen views, and session duration, and assigns an app instance identifier. This is not used to build advertising profiles. On Android the advertising identifier is explicitly disabled, and neither app contains an advertising SDK.

You can opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on.

6. Advertising (Website Only)

The Afsoomali website is supported by advertising, which keeps the dictionary free to use. The mobile apps contain no advertising.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings.
• You may opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info/choices or youronlinechoices.com.

Where required by law, advertising and analytics cookies are set only after you provide consent through our consent banner. Declining does not prevent you from using the dictionary; you will simply see non-personalised advertising instead.

More information on how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites.

7. How We Use Your Information

• To authenticate you and maintain your session
• To display your contributions and profile in the dictionary
• To enable voting, contributing, and community features
• To send daily word notifications, if you have enabled them
• To diagnose crashes and improve reliability
• To measure traffic and understand which content is useful
• To serve and measure advertising on the website
• To prevent abuse, spam, and vote manipulation
• To respond to support requests and legal obligations

We do not sell your personal information, and we do not share it with third parties for their own independent marketing purposes.

8. Legal Bases (EEA, UK, and Switzerland)

• Contract — account creation, authentication, and delivering the Service.
• Consent — analytics cookies, advertising cookies, and push notifications. You may withdraw consent at any time.
• Legitimate interests — security, abuse prevention, and crash diagnostics, balanced against your rights.
• Legal obligation — where we must retain or disclose data by law.

9. Third Parties We Share Data With

• Supabase — authentication and database hosting.
• Google Firebase — crash reporting, push notifications, and Android analytics.
• Google Analytics and Google AdSense — website analytics and advertising.
• Vercel and Railway — website and API hosting.
• Apple and Google — where you use Sign in with Apple or Sign in with Google, those providers share only your email and name with us.

We may also disclose information where required by law or to protect the rights and safety of our users.

10. Data Storage, Security, and International Transfers

Account and dictionary data is stored in a PostgreSQL database hosted by Supabase in the Asia-Pacific (Tokyo) region, with encryption at rest and in transit (TLS). Our API is hosted on Railway and the website on Vercel, both of which operate globally distributed infrastructure.

If you access the Service from the EEA, the UK, or Switzerland, your data will be transferred outside your region. Where such transfers occur, they are made under the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the relevant provider.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Choices and Consent

• Cookies — manage or withdraw consent via the consent banner or your browser settings.
• Personalised ads — opt out via the links in Section 6.
• Notifications — disable in the app settings or your device settings.
• Analytics — opt out using the browser add-on linked in Section 5.

12. Data Retention

We retain account data for as long as your account is active. If you delete your account from the website or from within the app, your personal information — email, display name, and User ID — is deleted immediately and permanently. Requests made by email are completed within 30 days. Contributions you submitted are retained in anonymised form as part of the public dictionary corpus, since the dictionary is a collective work that other users rely on. Crash reports are retained by Firebase for up to 90 days. Analytics data is retained for up to 14 months.

13. Your Rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing, and to withdraw consent at any time.

• Access — request a copy of the personal data we hold about you
• Correct — update inaccurate information via your Profile settings
• Delete — on the Delete Your Account page, via Settings → Delete Account in the app, or by contacting us
• Export — request your data in a portable format
• Object or restrict — ask us to stop or limit certain processing

To exercise any of these rights, email support@afsoomali.com. We respond within 30 days. If you are in the EEA or UK and believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

14. United States Privacy Rights

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to request deletion, to request correction, and to not be discriminated against for exercising those rights.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising in the sense defined by the CCPA/CPRA. To exercise your rights, contact support@afsoomali.com.

15. Children's Privacy

The Service is suitable for general audiences. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction) without verifiable parental consent. Advertising served on the website is not directed to children, and we do not knowingly permit interest-based advertising to be served to children. If you believe a child has provided us personal information, contact support@afsoomali.com and we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate changes by updating the "Last Updated" date above, and for significant changes we will provide a more prominent notice. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

17. Contact Us

Yahya Qowle is the data controller for the Service. For any question about this policy or your data:
Email: support@afsoomali.com
Website: afsoomali.com/support