Privacy Policy

This policy applies to Sheykak services available through the web and mobile apps, including accounts, questions and conversations, the feed, public profiles, notifications, support, reports, and calling features where available.

Sheykak determines why personal data is processed within its services. Websites or external services you choose to visit are governed by their own policies.

The data depends on how you sign in, your account type, and the features you use. It may include:

• Account and profile: name, username, email, account identifier, language, account type, and permissions. Depending on your role and registration method, this may also include a phone number, date of birth, religion, country or city, profile image, biography, specialties, education, experience, and scholarly works.
• Authentication: verification and session data and sign-in-provider identifiers. If you choose Google or Apple, we receive the information the provider makes available according to your choices and account permissions, such as your name, email, and profile image. The authentication service handles passwords; they are not available to the Sheykak team as readable text.
• Questions and conversations: the question title, details and status; text and voice messages; images and files; and sending, reading, assignment, reporting, and moderation data.
• Feed and community: posts, photos, videos and links; comments, likes, reposts, follows, mutes, reports, and applications for publishing access.
• Support and safety: support tickets, feedback, reports, messages with the support team, and actions needed to resolve an issue or protect the platform.
• Calls and notifications: device notification tokens and preferences. Where calls are available, we may process technical connection data, participants, call state, timing, and call-log information.
• Device and usage: network address, device, browser and operating system type, language, session identifiers, usage timestamps, approximate online presence, and diagnostic or analytics events generated by your device or our infrastructure providers.

Sensitive data: religion and some question or conversation content may be sensitive personal data. Do not include sensitive information that a scholar does not need to answer your question.

• Directly from you: when you create an account, complete a profile, ask a question, publish or interact, or contact support.
• Automatically: from your browser or app and operational tools when you open the service or use a feature.
• From sign-in providers: such as Google or Apple when you choose to sign in through them.
• From other users: when they message you, interact with your content, or submit a report involving your account or content.

The interface identifies required and optional fields. If you do not provide required data, we may be unable to create your account or provide the related feature.

We process data for the purpose for which it was collected and only to the extent needed. These purposes include:

We rely on consent where applicable law requires it and on other bases permitted by law depending on the context, such as providing a service you requested, meeting legal duties, and pursuing legitimate interests without overriding your rights. Where consent is the basis, you may withdraw it; doing so may affect the related feature.

• Creating accounts, authenticating access, saving preferences, and operating profiles and permissions.
• Submitting a question, allowing an activated scholar account to accept it, and operating the conversation, follow-up, and question history.
• Displaying public content and interactions and enabling publishing, following, and notifications.
• Providing support, reviewing reports, preventing fraud or misuse, and protecting users and the platform.
• Measuring performance, understanding feature use, fixing errors, and improving the service.
• With your agreement, improving our AI models (including training and fine-tuning them) and showing questions publicly in a rewritten form without names or personal details, as explained in “Sharing questions to help others”.
• Sending operational messages about your account, questions, or security and meeting legal obligations and binding requests.

• Public content: visitors and users can see information you make public, such as parts of your profile, posts, comments, and interactions, depending on the feature.
• Questions and conversations: we do not publish a question or its thread as you wrote it. While a question awaits acceptance, eligible activated scholar accounts may view it so that one can accept it. After acceptance, the asker and assigned scholar can access the conversation. Authorized staff or moderators may also access it when necessary for support, service operations, safety, report review, abuse prevention, or legal compliance. Your sharing choice does not change who can see a question inside Sheykak.
• Support and reports: authorized team members handling the matter can access them and may connect them with relevant account or content records to understand the issue.
• Notifications: a message preview may appear on your device's lock screen if you allow notification previews. You can change this in device settings.

We do not describe conversations as end-to-end encrypted. Use the service on that basis and avoid sharing personal data that is not needed to provide the service.

Every question asked on Sheykak can help someone else find their answer. That is why we ask your permission before using your questions beyond your conversation:

Every question stays stored as it is, whatever you choose, and scholars and authorized staff see it exactly as before. This processing is based on your consent, which you can withdraw at any time.

• What “yes” means: we may use your questions to improve our AI models and the answers they give, including training and fine-tuning them, and we may show them publicly after rewriting them so they never show your name or personal details.
• New accounts: accounts created after this feature is introduced have sharing on by default, as part of accepting the Terms at sign-up, and can turn it off at any time. Earlier account holders are asked once, and we do not use their questions until they agree.
• A choice for every question: you can make any question private while writing it or after sending it. A private question is never used for training or shown publicly.
• What we never use: private questions, support chats, and direct messages between users, whatever your settings say.
• Changing your mind: you can turn sharing on or off at any time in Settings, under “Privacy and data”. Turning it off stops any future use of your questions, but it cannot undo models that were already trained.
• Who processes them: we plan to use shared questions to build and improve AI features in Sheykak, using models we run on infrastructure we control. If we ever use an outside AI service for this, it will be bound by data-processing terms, and we'll update this policy before it starts.

We do not sell personal data for money. We use technical services that process data on our behalf to operate Sheykak. Our current stack includes:

We may disclose data to an appropriate party when needed to comply with a law or binding order, protect rights or safety, or investigate suspected misuse. We limit disclosure to what we consider necessary for the purpose and what the law permits.

Infrastructure may process data inside or outside Saudi Arabia depending on service configuration and provider locations. Where cross-border transfer requirements apply, we take the steps required by applicable law.

• Supabase: authentication, databases, storage, realtime updates, and server functions.
• Vercel: website hosting, performance measurement, and traffic analytics.
• Google and Apple: optional sign-in, according to the method you choose and the provider's policies.
• Expo: mobile push-notification delivery when you enable notifications.
• AI models: we don't use any outside AI provider today. When our models run, they process only the text of shared questions; private questions, support chats, and direct messages never reach them. If we add an outside provider, we'll list it here before it starts.
• Connectivity services: STUN/TURN servers and technical infrastructure needed to connect calls where the feature is available.

• The website uses cookies and local-storage technologies needed for authentication, session continuity, saving certain preferences or drafts, and protecting the service.
• We use Vercel Analytics to understand general website traffic and performance and improve pages. Hosting services may also generate technical logs needed for security and operations.
• The mobile app may store session data, cached content, language choices, and notification preferences on your device so the app can work efficiently.

We do not use your data to sell targeted behavioral advertising. You can control some storage and notification settings through your browser or device, but disabling essential technologies may prevent features from working.

To rank the home feed, and only where this is switched on for you, we record how you use posts on Sheykak:

How to switch it off: account holders can turn off “Personalised feed” in Settings at any time; this stops the recording and deletes the activity history stored for the account. Visitors who are not signed in can decline from the notice shown on the home feed. In regions whose law requires consent first (including the European Economic Area, the United Kingdom, and Switzerland), nothing is recorded and no identifier is set until you choose “Personalise my feed”.

• What we record: which posts you view and for how long (reading time), how much of a video you watch, and when you share a post, copy its link, open its media or links, expand its text, or tap through to its author's profile. Likes, comments, reposts, follows, mutes, and hides are used as well.
• The sheykak_vid cookie: a random identifier stored in a first-party cookie set by the Sheykak website itself. Its only purpose is to keep this activity together for one browser, so the feed does not repeat what you have already seen, including before you sign in. It lasts up to 13 months, is readable only by Sheykak, is never shared with anyone, and is not used for advertising or to follow you on other sites.
• In the mobile app: a random installation identifier stored inside the app serves the same purpose. It is not an advertising identifier or a hardware identifier, and it is never shared with anyone.
• When you sign in: if you create an account or sign in, the activity recorded for that browser is attached to your account so your feed does not start from nothing.
• Retention: individual usage events are deleted after 180 days. The summaries built from them keep no per-event detail.
• A local list for visitors: the browser of a visitor who is not signed in keeps a local list of the posts it has shown, so new ones come first. That list stays on the device.

This data is used only to order and improve the feed. We do not use it for advertising and do not share it with anyone.

We retain data for as long as needed to operate your account and the feature you used, fulfill the purposes in this policy, meet legal duties, resolve disputes, prevent fraud or abuse, and protect the platform. The period varies by data type and context.

When data is no longer needed, we delete or destroy it or separate it from your identity where appropriate. Limited copies may remain longer in restricted backups or security or legal records until they are replaced through operational cycles, or where retention is required by law or needed to protect rights.

You can use in-app account deletion where available or contact us. Deletion may not immediately cover information that must be retained by law or data that has been de-identified.

We use technical and organizational controls appropriate to the service, such as protection in transit, access controls, authentication, database policies, and operational monitoring. Credentials and passwords are managed by the authentication provider; we do not store passwords as plain text available to the Sheykak team.

No storage or transmission method is completely secure. We cannot guarantee that every incident will be prevented. Use a strong password, protect your device, and tell us promptly if you suspect unauthorized access.

Under Saudi Arabia's Personal Data Protection Law and other applicable law, your rights may include:

To exercise a right, contact us from the email linked to your account and describe the request. We may ask for reasonable information to verify your identity and protect your account. We will handle requests according to the deadlines and exceptions set by applicable law.

• Information: knowing why your data is collected, the basis for processing, and the parties to whom it may be disclosed.
• Access and a copy: asking to see your personal data and receive it in a clear form where the right applies.
• Correction: asking us to correct, complete, or update inaccurate data.
• Destruction: asking us to destroy data whose purpose has ended or where law grants that right, subject to legal exceptions.
• Withdrawal of consent: where consent is the processing basis, without affecting processing that was lawful before withdrawal.
• Complaint: contacting us about a concern and then escalating it to the competent authority if the concern is not resolved to your satisfaction.

If you do not have the legal capacity to agree to the service or the processing of your data, you must use Sheykak with a parent or guardian's authorization and supervision as required by applicable law. A parent or guardian who believes a minor provided data without the necessary authorization should contact us so we can review the matter.

We may update this policy when Sheykak features, data practices, or legal requirements change. We will publish the revised policy here, update the date above, and provide additional notice of a material change where required.

For questions about this policy, to exercise a right, or to submit a privacy complaint, email us below. Include the account email and a clear description of the request. Never send your password or verification codes.