Privacy policy

• Controller NEURO LINE PERFORMANCE - FZCO, Dubai (United Arab Emirates), reachable at contact@neuroline-airblast.com.
• Without an account Everything stays on your phone. Nothing is sent, apart from downloading the voices and the Quran.
• With an account Your e-mail address and your progress are saved with Google (Firebase) so you can find them on another device.
• Friends and challenges Your friends see your e-mail address, your profile name and your emblem; the leaderboard shows the profile name, emblem and rank, never the address.
• Statistics and crashes Off by default. Enabled only if you say "Yes", and you can withdraw your consent in Settings.
• Payment Through Google Play or the App Store. We never see your card.
• Deletion From Settings or by e-mail: 30 days to change your mind, then everything is erased.
• Your data A complete file can be downloaded at any time from Settings, "My data".

1. Who is responsible

The data controller is the publisher of Rusukh:

Below, "we" means this company. It is subject to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and, because Rusukh is aimed at a French-speaking audience largely living in the European Union, to the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Where the two laws differ, we apply the one that protects you more.

2. What this policy covers

It covers the Rusukh mobile app (Android identifier com.valerian.rusukh, and its iOS version), the website apprusukh.com and our e-mail exchanges. It does not cover the app stores' services (Google Play, App Store), which have their own rules, nor the websites we link to (for example tanzil.net).

3. The data we process, one by one

Rusukh works fully without an account: your progress then lives in the phone's memory. Creating an account serves one purpose, finding your progress on another device and playing with friends. Here is what we process, category by category.

3.1 The account

• Account identifier (a string of characters assigned by Firebase), e-mail address, sign-in method (Google, Apple or e-mail with password), creation and last sign-in dates.
• With "Continue with Google" or "Continue with Apple", we receive the e-mail address (or Apple's relay address if you hide yours) and the display name provided by the provider. We access nothing else in your Google or Apple account.
• With e-mail sign-in, the password is handled by Firebase Authentication in hashed form: we never see it.
• For account security, Firebase Authentication records the IP address and device type at sign-in, and keeps them for a few weeks.

3.2 Learning progress

Always on the phone, and online if you have an account: the state of each review card (word, direction, due date, stability, number of recalls), the review log (date, card, answer), words ticked as known, passed checks, validated readings, rated dialogues, letters and signs learnt, hadiths and verses being memorised (including My hifz), the Quran page you are on, and your preferences (pace, theme, sounds, notifications, tutorial seen, milestones celebrated). This is learning data: it says what you know in Arabic, not who you are.

3.3 Profiles

An account can hold up to five profiles (for a family, for example). Each profile has a name you choose, a drawn emblem picked from a list, dates and counters (words started, words mastered). The name and emblem are visible to your friends and on the leaderboard: choose them accordingly.

3.4 Friends and the directory

• When you are signed in, a fingerprint of your e-mail address (a SHA-256 digest, from which the address cannot be recovered) is entered in a directory, linked to your account identifier. This lets someone who already knows your exact address find you. The directory cannot be browsed: only one fingerprint can be looked up at a time.
• A friend request passes your identifier, your e-mail address and your display name to the person you invite. Once accepted, each of you keeps the other's identifier, e-mail address, name and date in your friends list.
• Address book (optional). If you choose "Find my friends in my contacts", the app reads the e-mail addresses of your contacts on the phone, reduces them to fingerprints right there, and queries the directory one fingerprint at a time. No name and no address from your address book leaves the phone, and nothing from your address book is stored on our servers. The permission is only requested when you tap, after an explanation screen, and you can refuse it without losing anything else.

3.5 The leaderboard

One row per profile: the profile name, the emblem, the rank reached, the number of solid words and the update date, with your account identifier. Never the e-mail address. Any signed-in user can see the leaderboard of their own rank.

3.6 Challenges between friends

A challenge creates a temporary room in a real-time database: the host's identifier, each player's profile name, emblem and level, the answers and scores during the game, and an invitation (identifier, name, date) for the invited friend. The room is deleted when the game ends; the result (score, date) is kept in your account.

3.7 Notification tokens

To let you know about a friend request, an acceptance or a challenge while the app is closed, a notification token (a technical identifier for your device provided by Firebase Cloud Messaging) is stored in your account. It is removed when you sign out and when the system reports it as expired. Review reminders, on the other hand, are scheduled on the phone itself and go through no server.

3.8 The subscription

Payment goes through Google Play or the App Store. We receive no banking data. The app only keeps the subscription state (active or not, and the date of the store's last confirmation) on the device, to open the course. Google and Apple process your payment data under their own policies.

3.9 Gifted access

The publisher may grant full access to certain people free of charge. A list of e-mail addresses (with the date) is then kept on our side; only the publisher can write to it, and each user can only look up the entry matching the fingerprint of their own address.

3.10 Usage statistics (only with your consent)

On first launch, the app asks whether you agree to help us improve it. Until you say "Yes", measurement is disabled at system level (nothing leaves, not even at start-up). The few steps that come before your answer (sign-in, end of the tutorial) are only kept in memory on your device, never written or sent: they leave if you accept and are erased if you refuse or close the app. If you accept, Firebase Analytics (Google) receives:

• named usage events: first steps (sign-in method, tutorial closed, answer to "Can you read?", lesson started), lessons finished or left, review sessions (number of answers, success rate, on-screen duration), checks passed or failed, readings, dialogues, placement test, My hifz, surahs read and number of words tapped, tabs opened, notifications opened, challenges started and finished, return after an absence, arrival of the voices, and the subscription offer (seen, "Later", purchase opened, subscription active); with a few numbers, never the content of your answers;
• a few profile characteristics: level band (for example 100 to 294 words), able to read or not, type of access (free, subscriber), use of My hifz, reminders on or off, theme;
• an encrypted fingerprint of your account (computed on the device, neither your address nor your identifier), so that one person on two devices counts as one; removed when you sign out;
• technical data provided by the system: an app instance identifier (specific to the installation, unrelated to your identity), device model, OS and app version, language, approximate country derived from the IP address by Google, app opens and session duration.

We removed the advertising identifier from the app's permissions and disabled personalisation signals: no advertising profile is built. You can withdraw your consent at any time in Settings, "Improve Rusukh": collection stops immediately.

3.11 Crash reports (only with your consent)

Under the same consent, Firebase Crashlytics (Google) receives, when the app crashes or hits a serious error: the technical trace of the error, device model, OS and app version, memory and screen state, an installation identifier. Not your e-mail address, not your answers.

3.12 Technical data seen by our hosting providers

Like any connected app, Rusukh sends requests to servers, which see your IP address, the time and technical headers (device type, app version). This happens:

• when downloading the voice bank (about 630 MB, served by Cloudflare from voix.apprusukh.com, with Google Cloud Storage as a fallback);
• for synchronisation and challenges (Google Firebase);
• for Quran recitations and the tafsir of Ibn Kathir, downloaded at your request from the Quran Foundation's servers (verses.quran.com, api.quran.com);
• for the website apprusukh.com (Cloudflare).

These technical logs serve security and proper operation, and are deleted by the hosting providers within short periods.

3.13 What stays on your device

The learning database, your preferences, the voice bank, the recitations and the tafsir you downloaded stay in the phone's memory, in the space reserved for the app. They disappear when you uninstall the app. Deleting your online account does not erase them: they belong to you.

3.14 When you write to us

If you contact us by e-mail, we keep your address and the content of the exchange for as long as needed to handle the request and keep proof of it.

4. What we do not do

• No advertising in the app, no advertising identifier, no profiling for commercial purposes.
• No data sold, rented or passed on to third parties for their own purposes.
• No banking data on our side.
• No reading of your location, photos, microphone or messages.
• What you type or recite in the exercises is sent to no one.
• No automated decision producing legal effects on you.

5. Why we process it, and on what basis

6. Who has access

We do, to run the service, within what is necessary. The databases' access rules ensure each account can only read and write its own space.

Our processors, who process data on our behalf and on our instructions:

Other users, to the extent you choose: your accepted friends see your e-mail address, profile name and emblem; participants in a challenge see the profile name, emblem, level and score; the leaderboard shows the profile name, emblem, rank and solid words.

Authorities, only where the law requires it.

7. Where the servers are, and transfers

Our Firebase services are configured, for the real-time database and the server functions, in the europe-west1 region (Belgium, European Union); the voice bank is hosted by Cloudflare in Eastern Europe. Some Google services (authentication, statistics, crashes, notifications) and Cloudflare services are delivered from global infrastructure, notably in the United States.

For people located in the European Union, these transfers to the United States rely on the adequacy decision for the EU-US Data Privacy Framework, to which Google LLC, Cloudflare, Inc. and Apple Inc. are certified, and otherwise on the European Commission's standard contractual clauses built into their data processing terms. We ourselves are established in the United Arab Emirates: your data is accessible to us from that country, under the protections described in this policy and equivalent contractual commitments.

For people located in the United Arab Emirates, transfers outside the country are governed by articles 22 and 23 of the PDPL (countries with an adequate level of protection, or appropriate contractual safeguards).

8. How long we keep it

9. Security

• All communications are encrypted in transit (TLS/HTTPS).
• The databases' access rules are written so that an account only reads and writes its own space; the directory cannot be listed; the leaderboard only accepts controlled fields.
• Passwords are hashed by Firebase Authentication; directory and contact addresses are reduced to fingerprints.
• Audience measurement is off by default, at system level.
• Account erasure follows a verified order (traces at friends, directory, leaderboard, invitations, then the whole account), and is also executed server-side, independently of the device.

No system is infallible. In the event of a data breach likely to harm you, we will inform you and notify the competent authority within the legal deadlines.

10. Your rights

You have the following rights, provided by the GDPR (articles 15 to 22) and by the PDPL (articles 13 to 18):

• Access: know which data we hold about you and obtain a copy.
• Rectification: correct inaccurate data (a profile name can be changed directly in the app).
• Erasure: have your data deleted (see section 11).
• Portability: receive your data in a machine-readable format. In the app: Settings, "My data", "Get my data" produces a complete JSON file of your progress and preferences, to save or share wherever you want.
• Restriction and objection: ask us to restrict a processing, or object to a processing based on our legitimate interest.
• Withdrawal of consent, at any time, for statistics and crashes (the "Improve Rusukh" switch in Settings) and for the address book (system permission). Withdrawal does not affect what was done before.
• Not to be subject to a fully automated decision: we make none.

To exercise a right that has no button in the app, write to contact@neuroline-airblast.com, preferably from your account's e-mail address, so that we can check the request really comes from you. We answer within one month, extendable by two months for complex requests, in which case we will tell you.

If you believe your rights are not respected, you may lodge a complaint with a supervisory authority: in France, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr); in another European Union country, the authority of your place of residence; in the United Arab Emirates, the UAE Data Office. We would rather you write to us first: most requests are settled within days.

11. Deleting your account

In the app: Settings (icon at the top right of the home screen), "Account" panel, "Delete my account". The dialog first offers to get your data. After confirmation, the account is put on hold for 30 days and the device is signed out. Signing in again before the end of that period cancels everything. After that period, a server process erases your friendships at your friends', your fingerprint in the directory, your leaderboard rows, your invitations, all your online progress, your profiles, then the account itself.

Without the app, or if you no longer have access to it: send an e-mail to contact@neuroline-airblast.com with the subject "Suppression de compte Rusukh" (or "Rusukh account deletion"). The page Delete my account details the procedure, what is erased and what is kept.

Deleting the account does not cancel an ongoing subscription: cancellation is done in Google Play or the App Store (see the terms of use).

12. Minors

Rusukh is intended for people aged 13 and over. The app is not directed at children under 13 and we do not knowingly collect data about them. If you are a parent or guardian and believe a child under 13 has created an account, write to us: we will delete it. In European Union countries where the age of digital consent is above 13 (up to 16 depending on the country), a parent's agreement is required for processing based on consent.

13. Notifications

Review reminders are computed by the spaced-repetition algorithm and scheduled on the phone: they go through no server. Friend and challenge notifications go through Firebase Cloud Messaging and our server functions (europe-west1 region), which read your account's notification token to reach you. You can turn both off in the app's Settings or the system settings.

14. The website apprusukh.com

The website is a set of static pages, with no account, no form and no tracker. We set no cookies on it. If you switch the theme (night or day), that choice is stored in your browser's local storage, on your device only. The hosting provider (Cloudflare) processes your IP address to serve the pages and protect them from attacks.

15. Changes

We may change this policy, for example when a new feature processes new data. The date and version number at the top of the page then change. For a significant change, we will inform you in the app or by e-mail and, if new consent is needed, we will ask for it.

16. Contact

For any question about your data: contact@neuroline-airblast.com, or by post at the address in section 1.