Privacy Policy

This Privacy Policy describes how Kitabi ("we", "us", or "the app") collects, uses, and protects your personal data when you use the Kitabi mobile application and related services. Kitabi is operated by Zani Dobruna, based in Belgium. We take your privacy seriously and comply with the EU General Data Protection Regulation (GDPR).

1. Data we collect

To provide the features of the Kitabi app, we collect the following categories of data:

Account information: your name, email address, and profile picture when you sign up using email, Google, or Sign in with Apple.
Learning progress: lessons completed, vocabulary saved, reading history, flashcard results, practice activity, and streaks. This is used to power your personal learning experience and statistics.
User-generated content: notes, saved words, imported content (e.g. YouTube URLs or article links you choose to save), and chat messages with the AI tutor.
Voice recordings: if you use speech practice or the voice-to-text features, short audio clips are processed to return transcriptions or feedback. These recordings are not stored long-term.
Subscription and purchase data: when you subscribe to Kitabi Premium, purchase receipts are validated through Apple's in-app purchase system and our subscription provider RevenueCat. We do not see your payment card details.
Device and usage data: device type, operating system version, app version, crash reports, and basic diagnostic information. This helps us fix bugs and improve performance.
Push notification token: a device identifier used to deliver notifications about practice reminders, challenges, and messages. You can disable notifications at any time in your device settings.

2. How we use your data

To create and manage your account
To provide the core learning features of the app (reading, vocabulary, practice, AI tutor)
To track your progress and show personalized statistics
To process subscription payments via Apple and RevenueCat
To improve the app, diagnose crashes, and fix bugs
To send optional push notifications and reminders
To comply with legal obligations (e.g. tax reporting)

We do not sell your personal data. We do not use your data for advertising and we do not share it with advertisers.

3. Third-party services

Kitabi uses the following third-party processors to provide its services. Each processor has its own privacy policy governing how they handle data:

Apple App Store & Apple Push Notification Service — account, subscription validation, push delivery. (policy)
RevenueCat — in-app subscription management and purchase validation. (policy)
Vercel — application hosting and serverless functions. (policy)
Neon — PostgreSQL database hosting. (policy)
Cloudflare R2 — object storage for audio files and media. (policy)
OpenAI — AI tutor conversations. Your prompts and the lesson context are sent to OpenAI to generate responses. OpenAI does not train models on Kitabi API data. (policy)
Anthropic — alternate AI tutor provider (policy)
ElevenLabs — Arabic text-to-speech synthesis for pronunciation. Only the words or phrases being spoken are sent. (policy)
Google Cloud Speech / TTS — alternate speech processing. (policy)
LiveKit — real-time voice calls between learners for peer practice. Audio is streamed peer-to-peer and not recorded by Kitabi. (policy)
Supadata / Jina — used only when you import a YouTube video or web article for learning. Only the URL you provide is sent. (Supadata, Jina)
Stripe — payment processing for optional one-on-one lessons with language teachers. (policy)
Expo / EAS — build and update delivery infrastructure. (policy)

4. International data transfers

Some of the services listed above are based outside the European Union (primarily in the United States). When your data is transferred outside the EU, we rely on Standard Contractual Clauses approved by the European Commission and on the providers' own compliance with the EU-US Data Privacy Framework where applicable.

5. Data retention

We keep your account and learning data for as long as your account is active. When you delete your account from the app settings, all personal data associated with your account is permanently removed from our database and from RevenueCat within 30 days, except where we are legally required to retain records (for example, tax invoices for paid subscriptions, which are kept for 7 years under Belgian law).

6. Your rights under GDPR

If you are located in the European Economic Area, you have the following rights regarding your personal data:

Access — request a copy of the data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your data ("right to be forgotten"). The app also lets you delete your account directly from Settings.
Portability — receive your data in a machine-readable format.
Objection — object to certain types of processing.
Withdraw consent — where processing is based on your consent, you can withdraw it at any time.
Lodge a complaint — with the Belgian Data Protection Authority (dataprotectionauthority.be) or your local supervisory authority.

To exercise any of these rights, email us at kitabidev@gmail.com. We will respond within 30 days.

7. Children's privacy

Kitabi is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13, please contact us and we will delete it.

8. Security

We use industry-standard security practices, including HTTPS for all network traffic, encrypted database connections, and secure credential handling. No system is 100% secure, but we work to protect your data against unauthorized access, loss, or misuse.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date at the top of this page. Significant changes will be communicated to you through the app.

10. Contact

For any privacy-related questions or to exercise your rights, contact us at:

Kitabi
Zani Dobruna
Avenue de la Liberté 7
1081 Koekelberg
Belgium
Email: kitabidev@gmail.com