Privacy Policy

Last updated: August 2026

1. Controller

Kadir Tokel, Haydnstraße 18 / Tür 6, 4311 Schwertberg, Austria — sole trader, GISA 39942883. See the Legal Notice for full details. Email: kadir.tokel@gmail.com

2. What data we process

Without an account (guest use): Word lookups are cached anonymously — only the word/sentence itself is stored, with no IP address or user identifier. Server access logs (IP address, timestamp, requested URL) are kept temporarily by the hosting provider for security and operation.

With an account: When you register, we store your email address and a hashed password (bcrypt — we never store your plaintext password), the account creation date and your email-verification status. Tied to your account we store the content you create in the app: your saved words and notes, your spaced-repetition state and review history, your reading log (which texts you completed), your search history, the content you create or keep in the app (imported and generated reading texts, generated courses, kept dialogs and your tutor-chat transcripts — the running conversation is stored under your account so you can pick it up on any device, and “Save chat” keeps a dated copy), your interface settings, and your weekly-recap preference.

Sign in with Google (optional): If you choose to sign in with Google instead of a password, we store your email address as provided by Google and your Google account ID (a numeric identifier) to link your account. In that case no password is stored with us. We receive only your email address and this identifier from Google — no contacts, no profile data beyond that.

3. Storage in your browser

After you log in, an authentication token (JWT) is stored in your browser so you stay signed in. We also store your interface preferences (dark mode, transliteration, diacritics, daily goal, audio settings) and a few device-only markers (such as which hints you have dismissed) in your browser's local storage. Content you keep in the app — saved words, kept dialogs and saved tutor chats (“My dialogs”) — is not device-only: it is stored in your account on our server (see section 2), so it is there on every device you sign in on, and it is included in the data export and in the deletion of your account. These browser entries are strictly functional — we use no advertising or tracking cookies.

4. Who else receives anything

These are all the outside services that receive anything when you use the app, what each one receives and what for. We describe them by category rather than by company name; where a transfer leaves the EU, it says so. If you need the specific companies — for example to exercise your rights — write to us and we will name them.

Hosting — netcup GmbH (Germany): operates the server; processes access logs. Your account, your saved words and your progress are stored here and nowhere else.
AI language services (outside the EU): to produce word and sentence analysis, example sentences, generated reading texts and word packs, and the dialogue trainer including the tutor chat, the relevant text is sent to an external AI provider. For lookups and generation that is the word or topic you enter; in the tutor chat it is the messages you write — please do not enter personal data there. No account data is transmitted. This involves a transfer outside the EU.
Accuracy check (outside the EU): when a word is looked up for the first time, the word together with the answer we produced is sent to a second, independent AI model, which judges whether our root and meaning are correct so that mistakes can be flagged and corrected. No account data is transmitted, and the verdict is stored per word — a word is checked once in total, not once per user. This involves a transfer outside the EU.
Speech synthesis: some of the spoken audio is produced on our own server in Germany and no text leaves our systems for it. The rest — the built-in library, the course and words you look up — is produced by an external provider outside the EU: the Arabic text to be spoken is sent there and the returned clip is stored on our server, so the same text is never sent twice. No account data is transmitted.
Speech recognition (outside the EU): in the speaking exercises, the short audio clip you record is sent to an external provider to transcribe what you said into text. The audio is used only for that transcription and is not stored by us. Where your device’s browser offers built-in speech recognition, that is used instead and no audio leaves your device.
Subtitle retrieval: if you paste a YouTube link, the video ID is sent to an external service to fetch the Arabic subtitle track. Only the video ID is sent, no account data.
Email delivery: for account-verification emails, password resets and the optional weekly recap, your email address is processed by our email provider.
YouTube (Google) — embedded player: a video you open plays inside YouTube’s own embedded player, so your browser contacts Google directly and Google may set cookies and see your IP address under its own terms. We send Google none of your in-app data. Google’s privacy policy applies to that part.
Sign in with Google (optional): if you use Google Sign-In, the login itself is handled by Google (Google Ireland Ltd. / Google LLC) as an independent controller — Google’s own privacy policy applies to that step. Google learns that you sign in to Badhra; we do not send Google any of your in-app data (saved words, history, progress).

No payment provider is involved at the moment: the app is free and there is no checkout. If paid plans are introduced, a payment provider will be added here before any payment can be made.

The pronunciation for the curated library (course, reader, phrases) was recorded in advance from our own text and is served as files from our server — playing it sends nothing anywhere.

5. Legal basis (GDPR Art. 6)

Account features and email delivery: Art. 6(1)(b) (performance of a contract). Anonymous caching and security/server logs: Art. 6(1)(f) (legitimate interest in providing and securing the service). The weekly recap email is optional and can be turned off at any time (Art. 6(1)(f); you may object at any time).

6. Data retention

Account data and your in-app content are kept until you delete your account. Individual items — saved words, kept dialogs and saved tutor chats — can be deleted in the app at any time. You can delete your account and all associated data yourself at any time in the account settings — this is immediate and permanent. Anonymous word caches are kept to reduce API cost and load. Server access logs are deleted by the host after a short period (typically ~30 days).

7. Your rights (GDPR Art. 15–21)

Access to your personal data
Rectification of inaccurate data
Erasure ("right to be forgotten") — self-service in account settings
Restriction of processing
Data portability — you can export all your data as JSON in the account settings
Objection to processing

To exercise any right, contact: kadir.tokel@gmail.com

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority — in Austria the Datenschutzbehörde (dsb.gv.at), or the authority of your habitual residence, place of work, or place of the alleged infringement.

9. Where the content comes from, and how far we check it

Not all of it is AI output, and saying so would misrepresent both directions. Three levels:

Curated material — the guided course, the reading library, the pattern glossary, the phrasebook and the grammar cards are written and checked by the operator. No model is asked at the time you read them.
Word lookups — the meaning comes from an AI model, but before it reaches you it is cross-checked against curated linguistic databases (Arramooz, AlKhalil), filtered by mechanical rules, and judged by a second, independent model. Where the checks disagree, the field is left empty rather than guessed. You can report any word with the flag icon and a confirmed correction is applied for everyone. This is not a guarantee: mistakes get through, which is exactly why the report button exists.
Content you generate yourself — texts you import or generate, dialogs you create and the tutor chat are produced by an AI model in the moment, are not checked by anyone, and are not shared with other users. This is the one place where raw model output is what you see, and it is labelled as such where you create it.

Across all three: use the app as a learning aid, not as an authoritative reference. We are not liable for incorrect linguistic information.

We keep this policy up to date with the service and revise it whenever processing changes materially — in particular before any payment provider or new AI provider is switched on. Last reviewed: 8 August 2026.