Skip to content
Tarbiya
Sign inSign up
About the product

Privacy policy

Last updated August 8, 2026

Tarbiya is an app for families (web and mobile clients). We store what you and your family enter so that the app can work. We do not sell data, we do not show advertising, and we do not use third-party advertising trackers. Each family's data is isolated from every other family. Children's profiles are created and controlled by a parent.

This document describes our current practice. If anything here is unclear, or does not match what you see in the app, write to us — that is a mistake on our side.

What data we collect

What you provide yourself:

  • Family member profiles, children included (created by a parent): name, date of birth or age band, role, colour, language, theme.
  • Account: an email address and a password. The password is stored hashed — we never see it.
  • Activity: tasks, habits, routines, goals, workouts, reading, faith practices and star rewards.
  • Household finance, if the section is switched on: transactions, the monthly plan, savings goals.
  • Household life: meals, shopping lists, calendar events, notes, photos for the tablet screen.
  • The city used for weather, which you type in by hand. We do not collect background location.
  • Your email and name, if you left an early-access request on this site.

What is collected automatically

The minimum needed to work: a session token in the device's secure storage, and basic server logs for security and fault diagnosis. We do not collect advertising identifiers, contacts, biometrics, or behavioural analytics for advertising.

How we use data

Only to: provide the app's features, sync data across the family's devices, authenticate sign-in, show weather and religious content on request, keep the service secure and answer support requests, and — in future — process a subscription. Not for advertising and not for profiling.

Legal basis

Performance of a contract — so the app works for you. Consent — optional features (weather, finance), children's profiles (a parent's consent) and the early-access request. Legitimate interest — security, abuse prevention and basic logs. Consent can be withdrawn at any time.

Children

Children's profiles are created and managed by a parent or guardian, which is how parental consent to the processing is given. What is private to a child is visible only to that child; what is shared is visible to the family, and the isolation is enforced in the database. We deliberately do not collect data directly from children without a parent involved. A parent can review a child's data, change it, or ask us to delete it. We aim to comply with COPPA and with GDPR requirements for minors' data; the app carries no advertising, no third-party analytics and no advertising identifiers.

Who we share with

We do not sell data and do not share it for advertising. We pass data only to the processors the service cannot run without:

  • Storage and authentication — account and family data, on our own server.
  • The weather service — only the coordinates of the city you entered, with no personal data.
  • Religious content sources — a request for text, with none of your personal data.
  • A payment provider, once a subscription exists — payment details are handled by them.
  • An AI provider, if such features appear — only the text of the request itself; the access key stays on the server.

We require these processors to protect your data to a standard no lower than the one described in this policy and required by applicable law, and we pass them only what a given task needs. We may also disclose data where the law properly requires it.

Retention and deletion

Data is kept while the family account is active. You can delete your account yourself, from inside the app — Settings → Account → Delete account, in both the mobile app and on the web. We ask for your password so that nobody who merely borrowed your phone can do it. Deletion is permanent and immediate: there is no waiting period, and it is not an account freeze.

  • Deleted: your sign-in record and everything personal — tasks and habits, check-ins and streaks, personal goals, personal wallet and spending, wishes, stars and exchange requests, memorisation progress, event attendance, your profile, and your email if it was left in the early-access list. You cannot sign in with that email afterwards.
  • Kept by the family, without your name: if other adults remain, shared shopping items and shared tasks become unassigned, while the household budget, shared goals and shared events pass to another parent. These records are not only about you — they are the household's bookkeeping and work other people are already doing. Stars already given to children are never taken back.
  • If you are the last adult, nobody would be left who can sign in and run the family. Deleting your account then deletes the whole family: every profile including children's, all family data, and the accounts of children and of the hallway tablet. The app warns you about this separately and asks for a deliberate confirmation — but it does not refuse you.
  • Timing: data disappears from the live database immediately. It disappears from backups as those rotate — no later than 30 days. We cannot restore a deleted account from a backup on request, and we will not.

Server logs are kept for a limited time for security and are not used to restore deleted data. Early-access requests are deleted once we stop using them, or earlier if you ask. You may also write to support to request deletion, but that is not required — deletion is available in the app.

Security

Family data is isolated row by row inside the database. Traffic is encrypted in transit. Passwords are hashed and never stored in the clear. Service keys live only on the server and never reach client apps. Absolute security does not exist — we take reasonable measures and say so plainly.

Your rights

Depending on your jurisdiction: access, correction, deletion, export, restriction of and objection to processing, withdrawal of consent, and opting out of the «sale» of data — which we do not do anyway. Some of these work directly in your profile and family settings; the rest by writing to support. We reply within the periods the law sets. You have the right to complain to a data protection authority.

Where data is stored

Data is hosted on our own server in Kazakhstan. There is no third-party cloud storage in the chain. If that changes, we will say so before anything moves.

Cookies and local storage

We use the minimum necessary: a session token for sign-in, and stored preferences — language, theme, time zone. There are no advertising or tracking cookies. The web version runs a service worker for offline mode.

Changes to this policy

We update this document when our practice changes, not on a schedule. We will tell you about material changes in the app or by email. The date at the top reflects the latest revision.

Questions and data requests

support@tarbiya.spaceSupport