Privacy Policy

1. Who we are & how to contact us

Kurdishgo is the developer of the app as listed on Google Play and the Apple App Store, and is the data controller for personal information processed through the Service.

Privacy questions, data requests, and support: officialkurdishgo@gmail.com

Website: https://kurdishgo.web.app

2. Information we collect

Information you provide

• Account: name, username, email address, password (stored only as a secure hash by Firebase Authentication — we never see it), and the sign-in method you use (email, Google, or Apple).
• Profile (optional): profile photo and bio.
• Direct messages: messages you send to other users.
• Reports & feedback (optional): lesson error reports (including any comment you type), reports about other users, and the reason you select if you cancel a subscription.
• Support emails: anything you send to our support address.

Information created when you use the Service

• Learning activity: selected courses, lesson progress, scores, XP, streaks, energy, gems, achievements, quests, league standing, and app preferences (such as language and theme).
• Social activity: who you follow and who follows you, follow requests, users you block, activity posts shown in the friends feed, and your privacy settings.
• Purchases: subscription status, product IDs, purchase dates, and transaction identifiers from Google Play or the App Store, processed through RevenueCat. We never receive your card or bank details.
• Identifiers: your account ID (Firebase user ID), app-instance identifiers used by Firebase and RevenueCat, and — for ads — your device’s advertising ID (see section 6).
• Technical data: IP address, device model, operating system, app version, and language. Our servers process IP addresses for security and rate limiting.
• App usage (Firebase Analytics): the screens you open and key actions in the app — signing up or signing in, finishing the placement test, starting and finishing lessons and units (including your score on a finished lesson), extending your streak, opening the subscription screen, purchasing or restoring a subscription (plan type only), opening a daily reminder, and being asked to rate the app — together with an app-instance ID, device model, operating system, app version, language, and approximate region (country or city derived from your IP address; the IP address itself is not stored by Google Analytics).
• Crash reports & diagnostics (Firebase Crashlytics): when the app crashes or hits a serious error — the error and where in the app it happened, a short log of the app’s state just before it, device model, operating system, app version, available memory and storage, and a Crashlytics installation ID. Email addresses and account IDs are removed from error messages before a report is sent.

Information from sign-in providers

• If you sign in with Google or Apple, we receive your name, email address (or Apple’s private relay address), and an authentication token from that provider. We never receive your Google or Apple password.

We do not collect precise location, health data, financial account details, browsing history, or a list of apps on your device.

App usage data and crash reports are not linked to your name, email address, username, or account ID, are not collected with your advertising ID, and are never used for advertising or shared for advertising purposes.

3. Device permissions & on-device processing

The app asks for a permission only when you use the feature that needs it, after explaining why. Every permission is optional — if you decline, the rest of the app keeps working. You can change permissions at any time in your device settings.

• Microphone & speech recognition (speaking exercises): when you tap the microphone button, your speech is converted to text by your device’s speech recognition service — Google on Android and Apple on iOS. That provider may process the audio on its servers under its own privacy policy. The app only receives the resulting text, compares it with the expected answer on your device, and does not store or upload your voice or the transcript.
• Microphone (alphabet pronunciation practice): a short recording is made to check that you spoke loudly and long enough. It is analyzed on your device, kept only in the app’s temporary cache, and never uploaded.
• Contacts (find & invite friends): if you allow access, names and phone numbers from your address book are read and matched on your device only, to show friends already on Kurdishgo and to let you send an invitation from your own SMS app. Contact data is never uploaded to our servers.
• Photos (profile picture): you choose a photo with the system photo picker (on Android without granting access to your whole library). Only the photo you pick is uploaded and stored in Firebase Storage as your profile picture.
• Save to photo library (share card): used only when you choose to save your profile share card to your gallery.
• Notifications: used for reminders scheduled locally on your device — a reminder before your free trial ends and, if notifications are allowed, a daily practice reminder at the time you usually study (at most one a day, never on a day you have already practiced). You can turn the daily reminder off at any time: side menu → Notifications → Reminders. We do not collect a push-notification token.

4. How we use information

• Provide the Service: create and secure your account, save and sync your progress, run lessons, leagues, quests, and rewards.
• Social features: show your public profile, let you follow others and exchange messages, and apply your privacy and block settings.
• Purchases: process subscriptions and in-app purchases, restore purchases, and unlock Premium features.
• Advertising: show ads through Google AdMob in the free version (see section 6).
• Safety & security: prevent fraud, spam, and abuse; review reports; enforce our Terms of Service; and rate-limit our servers.
• Improve content: fix bugs and correct lessons using error reports and cancellation feedback.
• Analytics & app stability: understand in aggregate which features and lessons are used and where learners stop, and detect, diagnose, and fix crashes and errors (Firebase Analytics and Firebase Crashlytics).
• Communicate: answer support requests and send essential service or account emails (such as password reset). We do not send marketing emails.
• Legal: comply with legal obligations.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. Who can see your information

• Other signed-in users can see your public profile: name, username, profile photo, bio, XP, streak, league, and follower/following counts, plus feed activity if activity sharing is on. Your email address is never shown to other users.
• Message recipients can see the messages you send them. Messages are encrypted in transit but are not end-to-end encrypted.
• New conversations arrive as message requests that you can accept, decline, or block. You can turn off “Share activity with everyone” in the app’s privacy settings, and you can block or report any user.

6. Advertising (Google AdMob)

The free version shows ads served by Google AdMob. The Google Mobile Ads SDK collects your advertising ID, IP address (which may be used to estimate your approximate location), ad interactions, and diagnostic data, and Google uses them to show and measure ads and to prevent fraud, as described in How Google uses information from sites or apps that use its services.

• EEA, UK, and Switzerland: we ask for your consent through Google’s consent message before ads load. You can change your choice at any time: side menu → Privacy → Ad privacy.
• All regions: you can turn off personalized ads in the app: side menu → Privacy → Data collection → Personalized ads. When it is off, only non-personalized ads are requested.
• Android: you can reset or delete your advertising ID in Settings → Google → Ads (or Settings → Privacy → Ads).
• iOS: the advertising identifier (IDFA) is available to ads only if you allow tracking in Apple’s App Tracking Transparency prompt. If you do not allow it, ads are shown without the IDFA. You can change this in Settings → Privacy & Security → Tracking.
• Premium subscribers do not see ads.

7. Service providers & sharing

We do not sell your personal information for money. We share data only as follows:

• Service providers (processors) that operate the Service on our behalf:
  • Google Firebase — Authentication, Realtime Database, Cloud Firestore, Cloud Storage (account, profile, social, and learning data; profile photos; lesson audio delivery).
  • Firebase Analytics (app usage statistics; advertising ID collection and ad-related data use are turned off) and Firebase Crashlytics (crash reports and diagnostics), provided by Google under the Firebase data processing terms.
  • RevenueCat — subscription and purchase management.
  • Render and our database hosting provider — hosting for our API server and its database (subscription status and learning records).
  • Expo (EAS) — app build and delivery.
• Platform providers: Google Play and the Apple App Store (payments), Google and Apple (sign-in and speech recognition), under their own privacy policies.
• Google AdMob for advertising, as described in section 6.
• Other users, as described in section 5, at your direction.
• Legal & safety: when required by law or valid legal process, or to protect the rights, safety, and security of our users, the public, or us.
• Business transfers: in a merger, acquisition, or asset sale, with notice where required by law.

Every third party we share personal data with is required, by contract or by its own binding terms, to protect that data with the same or equal level of protection described in this Policy and to use it only for the purposes we specify.

8. Sign in with Google

Kurdishgo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use your Google name, email address, and profile identifier only to create and secure your account and display your profile. We do not sell this data, use it for advertising, or transfer it to anyone except service providers (such as Firebase) needed to run the Service. You can revoke access at Google Account permissions.

9. Sign in with Apple

Apple may share your name, email address (or private relay address), and an authentication token. We use them only for account creation, authentication, and profile display. You can manage this connection in your Apple ID settings (Sign in with Apple).

10. How long we keep data

• Account, profile, learning, and social data: until you delete your account, then deleted as described in section 13.
• Profile photo and bio: until you remove them or delete your account.
• Direct messages: your copy is deleted with your account; the recipient’s copy stays in their conversation history until they delete their account.
• Lesson error reports and cancellation feedback: until your account is deleted.
• Reports about abusive behavior filed by others: may be kept for up to 12 months for safety and legal purposes.
• Server security logs (including IP addresses): kept for a short period (typically no more than 30 days) unless needed to investigate abuse.
• App usage data (Firebase Analytics): event-level data is deleted automatically after no more than 14 months; only aggregated, non-identifying reports are kept after that.
• Crash reports (Firebase Crashlytics): deleted automatically after 90 days.
• Purchase records: Google Play, Apple, and RevenueCat keep their own records as required by their policies and tax/accounting laws.
• Data on your device: stays on your device until you delete your account, sign out, clear the app’s data, or uninstall the app.

11. Security

All data is encrypted in transit (HTTPS/TLS). Access is protected by Firebase Authentication, database security rules that limit each user to their own private data, server-side token verification, and rate limiting. No system is perfectly secure — please use a strong password and keep your device and sign-in credentials safe.

12. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, restrict, or receive a copy of your personal data, to object to processing, and to withdraw consent at any time (without affecting earlier processing).

• In the app: edit your profile details; remove your profile photo or bio without deleting your account; change activity-sharing and ad settings; block users; and delete your account.
• On your device: turn off microphone, speech recognition, contacts, photos, or notification permissions at any time.
• By email: write to officialkurdishgo@gmail.com to request a copy of your data, a correction, or deletion of specific data without deleting your account. We may verify your identity and will respond within 30 days.

EEA / UK (GDPR): our legal bases are performance of our contract with you (account, lessons, purchases, social features), legitimate interests (security, fraud prevention, improving lessons, keeping the app stable through crash reporting, and understanding app usage through analytics that are not linked to your identity), consent (personalized ads in the EEA/UK/Switzerland and optional device permissions), and legal obligations. You may lodge a complaint with your local data protection authority.

California (CCPA/CPRA): you have the right to know, delete, and correct personal information and not to be discriminated against for using these rights. We do not sell personal information for money. Showing personalized ads through AdMob may count as “sharing” for cross-context behavioral advertising; you can opt out by turning off personalized ads in the app (section 6) or in your device settings. We do not use or disclose sensitive personal information for purposes that require a right to limit.

13. Account & data deletion

In the app: open the side menu → Profile → Delete account and confirm. This permanently deletes:

• your sign-in account, profile, and profile photo;
• learning progress, settings, and rewards;
• follow lists (including your entries in other users’ lists), follow requests, activity posts, and blocks;
• your copy of your conversations;
• lesson error reports and subscription cancellation feedback you submitted;
• our subscription status records;
• data stored by the app on your device.

Without the app: use our account deletion request page, or email officialkurdishgo@gmail.com from the address linked to your account with the subject “Account Deletion Request”. We will confirm and complete the deletion within 30 days.

What is kept: messages you already sent remain in the recipients’ conversation history; reports other users filed about abusive behavior may be kept as described in section 10; and Apple, Google, and RevenueCat keep their own purchase records.

Important: uninstalling the app does not delete your account, and deleting your account does not cancel an active subscription. Cancel subscriptions in Google Play (Payments & subscriptions) or on iOS (Settings → your name → Subscriptions).

14. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under the minimum age for consent to data processing in your country, such as 16 in some EEA countries, without parental consent). If you believe a child has given us personal information, contact us and we will delete it.

15. International data transfers

Our service providers (including Google, RevenueCat, and Render) may store and process data in the United States and other countries outside your own. Where required, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

16. Data safety summary

• Collected for app functionality and account management: name, email, user IDs, optional bio and profile photo, in-app messages, learning activity, optional reports and feedback, and purchase history.
• Collected and shared with Google through the AdMob SDK: advertising ID and device identifiers, approximate location derived from IP address, ad interactions, and diagnostics — for advertising, analytics, and fraud prevention.
• Collected for analytics and app stability through Firebase Analytics and Firebase Crashlytics (Google acts as our service provider): app interactions, crash logs, diagnostics, app-instance and installation IDs, and approximate region — not linked to your identity and not used for advertising.
• Not collected (processed on your device only): contacts, voice recordings, and speech transcripts.
• All data is encrypted in transit. You can delete your account in the app or by email (section 13). We do not sell your data.

17. Changes to this Policy

We may update this Policy from time to time. We will change the “Last updated” date above and, for material changes, notify you in the app or by email before the changes take effect.