Privacy Policy

This policy applies to Sheykak services available through the web and mobile apps, including accounts, questions and conversations, the feed, public profiles, notifications, support, reports, and calling features where available.

Sheykak determines why personal data is processed within its services. Websites or external services you choose to visit are governed by their own policies.

The data depends on how you sign in, your account type, and the features you use. It may include:

• Account and profile: name, username, email, account identifier, language, account type, and permissions. Depending on your role and registration method, this may also include a phone number, date of birth, religion, country or city, profile image, biography, specialties, education, experience, and scholarly works.
• Authentication: verification and session data and sign-in-provider identifiers. If you choose Google or Apple, we receive the information the provider makes available according to your choices and account permissions, such as your name, email, and profile image. The authentication service handles passwords; they are not available to the Sheykak team as readable text.
• Questions and conversations: the question title, details and status; text and voice messages; images and files; and sending, reading, assignment, reporting, and moderation data.
• Feed and community: posts, photos, videos and links; comments, likes, reposts, follows, mutes, reports, and applications for publishing access.
• Support and safety: support tickets, feedback, reports, messages with the support team, and actions needed to resolve an issue or protect the platform.
• Calls and notifications: device notification tokens and preferences. Where calls are available, we may process technical connection data, participants, call state, timing, and call-log information.
• Device and usage: network address, device, browser and operating system type, language, session identifiers, usage timestamps, approximate online presence, and diagnostic or analytics events generated by your device or our infrastructure providers.

Sensitive data: religion and some question or conversation content may be sensitive personal data. Do not include sensitive information that a scholar does not need to answer your question.

• Directly from you: when you create an account, complete a profile, ask a question, publish or interact, or contact support.
• Automatically: from your browser or app and operational tools when you open the service or use a feature.
• From sign-in providers: such as Google or Apple when you choose to sign in through them.
• From other users: when they message you, interact with your content, or submit a report involving your account or content.

The interface identifies required and optional fields. If you do not provide required data, we may be unable to create your account or provide the related feature.

We process data for the purpose for which it was collected and only to the extent needed. These purposes include:

We rely on consent where applicable law requires it and on other bases permitted by law depending on the context, such as providing a service you requested, meeting legal duties, and pursuing legitimate interests without overriding your rights. Where consent is the basis, you may withdraw it; doing so may affect the related feature.

• Creating accounts, authenticating access, saving preferences, and operating profiles and permissions.
• Submitting a question, allowing an activated scholar account to accept it, and operating the conversation, follow-up, and question history.
• Displaying public content and interactions and enabling publishing, following, and notifications.
• Providing support, reviewing reports, preventing fraud or misuse, and protecting users and the platform.
• Measuring performance, understanding feature use, fixing errors, and improving the service.
• Sending operational messages about your account, questions, or security and meeting legal obligations and binding requests.

• Public content: visitors and users can see information you make public, such as parts of your profile, posts, comments, and interactions, depending on the feature.
• Questions and conversations: we do not publish a question or its thread to the feed. While a question awaits acceptance, eligible activated scholar accounts may view it so that one can accept it. After acceptance, the asker and assigned scholar can access the conversation. Authorized staff or moderators may also access it when necessary for support, service operations, safety, report review, abuse prevention, or legal compliance.
• Support and reports: authorized team members handling the matter can access them and may connect them with relevant account or content records to understand the issue.
• Notifications: a message preview may appear on your device's lock screen if you allow notification previews. You can change this in device settings.

We do not describe conversations as end-to-end encrypted. Use the service on that basis and avoid sharing personal data that is not needed to provide the service.

We do not sell personal data for money. We use technical services that process data on our behalf to operate Sheykak. Our current stack includes:

We may disclose data to an appropriate party when needed to comply with a law or binding order, protect rights or safety, or investigate suspected misuse. We limit disclosure to what we consider necessary for the purpose and what the law permits.

Infrastructure may process data inside or outside Saudi Arabia depending on service configuration and provider locations. Where cross-border transfer requirements apply, we take the steps required by applicable law.

• Supabase: authentication, databases, storage, realtime updates, and server functions.
• Vercel: website hosting, performance measurement, and traffic analytics.
• Google and Apple: optional sign-in, according to the method you choose and the provider's policies.
• Expo: mobile push-notification delivery when you enable notifications.
• Connectivity services: STUN/TURN servers and technical infrastructure needed to connect calls where the feature is available.

• The website uses cookies and local-storage technologies needed for authentication, session continuity, saving certain preferences or drafts, and protecting the service.
• We use Vercel Analytics to understand general website traffic and performance and improve pages. Hosting services may also generate technical logs needed for security and operations.
• The mobile app may store session data, cached content, language choices, and notification preferences on your device so the app can work efficiently.

We do not use your data to sell targeted behavioral advertising. You can control some storage and notification settings through your browser or device, but disabling essential technologies may prevent features from working.

We retain data for as long as needed to operate your account and the feature you used, fulfill the purposes in this policy, meet legal duties, resolve disputes, prevent fraud or abuse, and protect the platform. The period varies by data type and context.

When data is no longer needed, we delete or destroy it or separate it from your identity where appropriate. Limited copies may remain longer in restricted backups or security or legal records until they are replaced through operational cycles, or where retention is required by law or needed to protect rights.

You can use in-app account deletion where available or contact us. Deletion may not immediately cover information that must be retained by law or data that has been de-identified.

We use technical and organizational controls appropriate to the service, such as protection in transit, access controls, authentication, database policies, and operational monitoring. Credentials and passwords are managed by the authentication provider; we do not store passwords as plain text available to the Sheykak team.

No storage or transmission method is completely secure. We cannot guarantee that every incident will be prevented. Use a strong password, protect your device, and tell us promptly if you suspect unauthorized access.

Under Saudi Arabia's Personal Data Protection Law and other applicable law, your rights may include:

To exercise a right, contact us from the email linked to your account and describe the request. We may ask for reasonable information to verify your identity and protect your account. We will handle requests according to the deadlines and exceptions set by applicable law.

• Information: knowing why your data is collected, the basis for processing, and the parties to whom it may be disclosed.
• Access and a copy: asking to see your personal data and receive it in a clear form where the right applies.
• Correction: asking us to correct, complete, or update inaccurate data.
• Destruction: asking us to destroy data whose purpose has ended or where law grants that right, subject to legal exceptions.
• Withdrawal of consent: where consent is the processing basis, without affecting processing that was lawful before withdrawal.
• Complaint: contacting us about a concern and then escalating it to the competent authority if the concern is not resolved to your satisfaction.

If you do not have the legal capacity to agree to the service or the processing of your data, you must use Sheykak with a parent or guardian's authorization and supervision as required by applicable law. A parent or guardian who believes a minor provided data without the necessary authorization should contact us so we can review the matter.

We may update this policy when Sheykak features, data practices, or legal requirements change. We will publish the revised policy here, update the date above, and provide additional notice of a material change where required.

For questions about this policy, to exercise a right, or to submit a privacy complaint, email us below. Include the account email and a clear description of the request. Never send your password or verification codes.