Privacy Policy

Version 2026-10-14

Nibras ("we", "us", "our") is an educational platform operated by Kunh Innovations Inc., a company based in Calgary, AB, Canada. This Privacy Policy covers the Nibras website at nibras.cc, the Nibras mobile application (published as cc.nibras.mobile on Google Play and the App Store), and the "Continue with Google" sign-in offered on both — together, the "Service". It explains what information we collect, how we use it, with whom we share it, and the rights you have over your information.

We are based in Canada and handle personal information in line with Canadian privacy law — the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Alberta, the Personal Information Protection Act (PIPA).

Our Privacy Officer is accountable for how we handle personal information and answers every privacy question, request, and complaint: [email protected].

1. Who this policy covers

This policy applies to:

  • Adult students who register for our programs
  • Parents and legal guardians who register their children
  • Children under 18 enrolled in our programs (their data is provided and managed by their parent or guardian)
  • Teachers, administrators, and program staff who use the platform
  • Staff of partner schools and organizations who apply to run programs with us
  • Visitors to our website

2. Information we collect

2.1 Account information

  • First and last name
  • Email address
  • Phone number (optional for some account types)
  • Address (optional)
  • Date of birth
  • Gender (optional)
  • Preferred language for the interface and for the emails we send you
  • Role on the platform (parent, student, teacher, administrator)
  • The link between a parent account and each child account, and the stated relationship you give (for example, Guardian)
  • Username and a securely hashed password

2.2 Health and safety information

When you register a child — or yourself — you may tell us about allergies and medical conditions. Both fields are optional, and you decide how much detail to give.

We ask because a teacher supervising a class needs to know if a child carries an EpiPen, cannot be given a certain snack, or has a condition that changes how an incident should be handled. That is the only reason we collect it. This information is never used for marketing, is never shared outside the program your child is enrolled in, and is visible only to you and to the administrators of that program and the staff they authorize.

Your child's class teacher sees it as a short alert next to your child's name. It is left out of the lists program administrators download unless they choose to include it, and every such download is recorded.

You may leave these fields blank, and you may clear or change them at any time from your profile in the portal or the mobile app.

2.3 Educational data

  • Halaqa (class) enrollment
  • Attendance records
  • Daily homework and progress logs
  • Teacher assessments and grades
  • Parent acknowledgments of homework
  • Quran memorization and recitation progress
  • Reading lesson progress
  • Notes between teachers, parents, and students

2.4 Enrollment forms and your consent record

When you enroll in a program we record:

  • Your answers to that program's own questions. A program may add its own enrollment questions — a preferred class time, a previous level of study, a note for the teacher. What is asked is set by the program; what you answer is stored with that enrollment and is visible to that program's staff.
  • Your consent record. When you accept our Registration, Terms & Conditions at sign-up we store the name you typed as a signature, which version of the terms you accepted, the date and time, and the IP address and browser your device reported at that moment. Your choice on photo and video consent is recorded separately for each program, with the date, who made it, and the version of the terms in force.

The IP address and browser in a consent record are kept for one narrow purpose: to be able to show, if it is ever questioned, that a consent was actually given and by whom. Unlike our ordinary server logs, this one record is deliberately linked to your account, because a consent that cannot be attributed is not evidence of anything.

2.5 Payment information

Some programs collect fees online. Payments are processed by Stripe, a certified payment provider. Your card number, CVC and banking details are typed into a secure form that Stripe itself serves inside our checkout page. They travel directly to Stripe — they do not pass through our servers, and we never see or store them.

What we do store about a payment:

  • Reference identifiers issued by Stripe that let us match a payment to your enrollment. They are meaningless to anyone else and cannot be used to charge you.
  • The type of payment method used — a card, or a pre-authorized debit from a bank account — but not its number.
  • The amount, currency, date, status, and any refund, along with the reason a payment failed if it did.
  • Whether you authorized us to charge that method automatically for future installments, and when you set that up or withdrew it.

If you set up automatic payments, that authorization is held by Stripe on our behalf. You can withdraw it at any time from the payments area of the portal, or by asking us. Stripe processes this information as an independent controller under its own privacy policy.

2.6 Communication data

  • Messages sent through the in-app messaging system
  • Email correspondence with our team
  • Contact form submissions on our website
  • Notifications we have sent you, and whether they were delivered and read — so we do not send the same reminder twice
  • Feedback and progress reports requested from teachers about a student

2.7 Applications to partner with us or to teach

If you apply on behalf of a school or organization that wants to run programs with Nibras, we collect the organization's details and the name, email address and phone number of the person applying, together with what you tell us about the program you have in mind.

If you apply to teach with us, we collect what a teaching application requires: your contact details and location, your teaching experience, your education and qualifications, any Quran ijazah and memorization you report, languages you teach in, your expected rate, and the name of anyone who recommended you. Our staff add their own notes and a score from any interview. All of that is used only to assess your application and is visible only to our staff.

If an application is accepted and you choose to have a public teaching profile, some of what you provided — your headline, city and country, languages, years of experience, qualifications and teaching mode — is published on our website, along with ratings and written reviews left by families you have taught. A public profile is the point of that feature, so treat everything on it as public. You can ask us to unpublish your profile at any time.

2.8 Device and technical information (mobile app)

  • A push notification token used to deliver notifications to your device. The token is registered with Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) and stored on our servers so we can deliver push notifications.
  • Device platform (Android or iOS) and app version, used to detect when an update is needed.

The mobile app does not use the Android Advertising ID and does not collect IDFA on iOS. We do not include third-party advertising or tracking SDKs in the app.

2.9 Website log data

Our web server logs basic technical information for security and debugging — IP address, browser type, pages requested, and timestamps. These logs are kept for a limited time and are not linked to your account beyond what is necessary for security investigations.

Our website is served through Cloudflare, which sits in front of our servers to block attacks and speed up delivery. Cloudflare necessarily sees the IP address and request details of everyone who visits, and processes them on our behalf for security.

Our public forms — sign-up, the contact form, and the school application — are protected by Cloudflare Turnstile, a check that distinguishes a person from an automated script without asking you to solve a puzzle. It looks at how the browser behaves, not at who you are, and it does not track you across other websites.

Our pages load their typefaces from Google Fonts. Your browser fetches them from Google's servers, which shows Google your IP address and the page's address, but nothing about your account.

When something goes wrong on the website or in the app, an error report — the error message, a technical trace, the page or screen, the app version and the type of device — is sent to Sentry, an error-monitoring service whose servers are in the United States. A report carries your account number so we can follow up, but not your name, email address, password, cookies, or what you typed into a form. We also keep our own copy of error reports for 30 days.

We do not use Google Analytics, advertising pixels, or any third-party analytics or tracking service on this website.

2.10 Google user data

This section describes how the Nibras website and the Nibras mobile application access, use, store, share, and delete Google user data. It covers the two places Nibras uses Google accounts: "Continue with Google" sign-in, open to everyone, and the optional Google Meet connection, open to teachers only. Both are optional.

What Google user data we access

Signing in with Google. If you choose it, we request only the "openid", "email" and "profile" scopes, and Google tells us only:

  • Your email address, and whether Google has verified it
  • Your first and last name
  • A Google account identifier — a number that identifies your Google Account to us and to no one else. We store it so we still recognise your account if you later change your Google email address.

Connecting Google Meet (teachers only). A teacher may connect a Google account so that Nibras can create the Google Meet room for each of their classes. For this we request the "openid" and "email" scopes and one Google Meet scope, "https://www.googleapis.com/auth/meetings.space.created", which lets us create Meet meeting spaces and manage only the spaces we created. From this connection we receive:

  • The email address of the Google account the teacher connected, so we can show them which account hosts their classes
  • An OAuth refresh token from Google, so we can create a class's room when the teacher is not signed in, and the list of permissions the teacher granted
  • For each room we create: the meeting link, the meeting code, and Google's identifier for that meeting space

We never receive your Google password. We do not request and cannot access your Gmail, Calendar, Contacts, Drive, photos, or any other Google service, or any meeting we did not create, and we do not read meeting recordings, transcripts, chat, or participant lists. We request no scopes beyond the ones named above.

How we use Google user data

  • Sign-in data is used only to sign you in, and to create or find your Nibras account. Your name and email address fill in your Nibras profile; the Google account identifier matches you to the right account on each later sign-in.
  • Google Meet data is used only to create a Google Meet room for each class the teacher teaches, and to put that room's link on the class. When we create a room we send Google no information about the class, its students, or its families — only the request to create a room.

We use Google user data only to provide these user-facing features, and for no other purpose.

How we share Google user data

We do not sell, rent, trade, or transfer Google user data to any third party. The only Google-derived data anyone else sees is the Google Meet link of a class, which is shown to the people in that class — its enrolled students and their families, its teachers, and the program's staff — so that they can join it. Your Google sign-in details are not passed to the schools or organizations running your programs, and no Google user data is sent to our payment, email, or notification providers. The only other disclosure we would ever make is one the law compels, and only to the minimum extent it compels.

How we store and protect Google user data

Google user data is sent only over encrypted HTTPS connections and stored on access-controlled servers operated by our hosting provider, readable only by the platform itself and by the administrators who already have access to your account. The Google Meet refresh token is additionally encrypted before it is stored. For sign-in we do not keep any Google access token or refresh token once the sign-in completes.

How long we keep Google user data, and how to delete it

  • Sign-in data — your name, email address and Google account identifier — is kept for as long as your Nibras account exists, and is deleted when your account is deleted. You can also ask us to remove only the Google link and keep your account; you then sign in with a password set from the "Forgot your password?" link on our login page.
  • When a teacher disconnects Google Meet in Nibras, we delete the refresh token immediately and can no longer create rooms on their behalf. The connected email address is kept only to show the teacher which account they used, and is deleted with the teacher's Nibras account. A class's meeting link belongs to that class's records and is kept and deleted with them, as described in "How long we keep your data" below.
  • You can revoke Nibras's access to your Google account at any time at myaccount.google.com/permissions. To have your data deleted, delete your account from your profile, or email us at the address in "Contact us" below.

What we never do with Google user data

We do not use Google user data for advertising of any kind, including targeted, personalized, or interest-based advertising. We do not sell it, or transfer it to data brokers or information resellers. We do not use it for credit assessment, lending, or any similar determination. We do not allow humans to read it, except with your consent, for security purposes, to comply with the law, or as part of the platform's internal operations when the data has been aggregated and anonymized.

We do not use Google user data to develop, train, or improve any artificial intelligence or machine learning model — personalized or generalized — and we do not transfer it to anyone else for that purpose.

Nibras's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.11 Signing in with Apple

Signing in with Apple is optional too. If you choose it, Apple tells us an Apple account identifier, the email address on your Apple ID — or, if you chose "Hide My Email", a private relay address that forwards to it — and, the first time only, your name. We use them only to sign you in and to create or find your Nibras account, keep them in your account record exactly as described for Google above, and never share them with anyone. Emails we send to a relay address pass through Apple's relay service on their way to you.

We never receive your Apple ID password. You can stop using Sign in with Apple for Nibras at any time in your Apple ID settings, under Sign in with Apple. That stops future sign-ins through Apple but does not by itself delete your Nibras account or your educational records. We keep one token Apple issues us when you sign in, encrypted, and use it for a single purpose: to tell Apple to revoke our access when your Nibras account is deleted.

2.12 Teachers who connect Zoom

A teacher may connect a Zoom account so that Nibras can create the video room for each class. This is optional and only for teachers; families and students never connect an account. Teachers who connect Google Meet instead are covered by "Google user data" above.

For Zoom we ask for permission to create and manage meetings on your Zoom account. So that rooms can be created when you are not signed in, we keep the long-lived token Zoom gives us (a "refresh token"), encrypted, on our servers, and use it only to create and look up class rooms. When you disconnect, or when your account is deleted, we delete the token and ask Zoom to cancel it. You can also remove our access yourself at any time from your Zoom account settings.

Zoom receives the class name as the meeting's title and runs the call itself under its own privacy policy. We do not record lessons, and we keep no recordings, transcripts, or lists of who joined — whether the class uses Zoom or Google Meet.

2.13 Qutrub, our reading app

If you sign in to Qutrub (qutrub.com) with your Nibras account, the reading progress of your learners is saved to Nibras and seen by the same people as their other progress. Qutrub checks a child's reading on the device and keeps no recordings; until it is ready, the browser's own speech recognition may be used, which some browsers send to their maker.

3. Cookies and what we store on your device

Our website uses a small number of cookies, all of them needed for the site to work or to keep it secure. We use no advertising or analytics cookies.

  • Session cookie — keeps you signed in as you move between pages. It is deleted when you sign out.
  • Security (CSRF) cookie — proves that a form you submit really came from our site, which is what stops another website from acting in your name.
  • Language cookie — remembers which language you are reading the site in.
  • App cookie — remembers for up to a year that you use our mobile app, so the website stops suggesting it.
  • Sign in with Apple cookie — lasts one minute and carries you back to our site after Apple confirms your sign-in.
  • Cloudflare security cookies — set by Cloudflare, which protects our website, to tell real visitors from automated attacks.

You can clear or block these in your browser, but signing in will not work without the session and security cookies.

The mobile app stores a few things in your device's secure storage, not on our servers: your sign-in token, a cached copy of your own profile so the app opens without a blank screen, your chosen language, and — if you asked it to — your username so you do not have to retype it. Signing out or uninstalling the app removes them.

4. How we use your information

  • To create and maintain your account
  • To deliver our educational programs (homework logs, assessments, attendance, progress reports)
  • To keep students safe during class, which is the only use we make of allergy and medical information
  • To enable communication between teachers, parents, students, and administrators
  • To take payment for a program, issue receipts, collect installments you have authorized, and keep the financial records a business is required to keep
  • To assess applications from prospective teachers and from schools that want to partner with us
  • To send you transactional notifications (homework reminders, class updates, payment receipts and reminders, password resets)
  • To send push notifications when relevant activity occurs in your account (you can disable these at the OS level)
  • To verify your identity and protect against unauthorized access
  • To comply with our legal obligations
  • To improve our Service through aggregated, non-identifying analytics

We do not use your information for advertising, profiling for marketing purposes, or to train AI models. We do not sell your information. No decision that affects you is made automatically without a person involved.

5. Photos and video

At registration you choose whether we may use photos or video of you or your child in our promotional material — our website, social media, and printed material. Your answer is recorded for each program, with the date and who gave it, and is respected until you change it.

Declining costs you nothing: it does not affect enrollment, participation, or anything else. Full names are never published beside a photo or video without separate, explicit written consent. You can change your choice at any time from the children page of the parent portal, or from your own profile, and you can ask us to remove an image already published by emailing us at the address below.

6. Children's privacy

Nibras serves children as part of our educational mission. A child's account is created by their parent or legal guardian, or by the school running their program, and the parent manages it on the child's behalf. Most children have no sign-in of their own. Where a school gives an older student a sign-in so they can follow their own classes and homework, the parent keeps full access to the account, and messages sent to the student are copied to the parent. Otherwise a child's information is seen only by authorized teachers and program administrators within their assigned program.

We collect only the information necessary to provide the educational service: name, date of birth (to determine age and program placement), gender (optional), any allergies or medical conditions the parent chooses to tell us about, the child's enrollment information and the answers given on that program's enrollment form, and the child's homework and progress data created by their teachers.

We do not ask children for payment details, we do not show them advertising, and we do not build marketing profiles of them. A child's account is not used to contact them for any purpose other than their own classes.

From the children page of the parent portal, parents can review and correct their child's information, read the messages their child has sent and received, download their child's data, and delete their child's account, or ask us by email. A child cannot delete their own account. Children's data is not shared with third parties for commercial purposes.

A student whose date of birth we do not have is treated as a child. Emails about a child's account, such as a sign-in link, go to their parent rather than to the child. Where a school gives a child under 13 their own sign-in, it works only after their parent allows it. Someone asking to be added as a guardian of a child who is already on Nibras is linked only after an existing guardian, or the child's program, confirms them.

When a child turns 18, their account and its records become theirs. We let their parent know, and the parent hands the account over by giving the student's own email address. From then on the student signs in themselves, and messages to them are no longer copied to the parent.

7. How we share information

We share information only when one of the following applies:

  • Within your program. Teachers, program administrators, and parents see the data of the students they are responsible for. A teacher sees their halaqa's students; a parent sees their own children; a program administrator sees their program's enrollment.
  • With the school or organization running your program, where a program is delivered in partnership with one. They see the enrollment and progress information for the students in their own program, and nothing else.
  • Leaderboards. In programs that turn on rewards, families in that program see a leaderboard with each student's first name, the initial of their last name, and their points. Nothing else about a student is shown to other families, and a parent can take their child off the leaderboards at any time.
  • Publicly, only where you chose it — a teacher's public profile and the reviews written about it. Nothing about a student is ever public.
  • Service providers we rely on:
    • Stripe — to process payments and hold any payment method you authorize. Stripe receives your name, email address and the amount; it does not receive your children's records.
    • Firebase Cloud Messaging (Google) and Apple Push Notification service (Apple) — to deliver push notifications. Only the push token and the notification payload are shared.
    • Google — only if you choose to sign in with Google. Signing in tells Google that you signed in to Nibras; we send Google no information about your children, your program, or your educational records. See "Google user data" above.
    • Apple — only if you choose to sign in with Apple. Signing in tells Apple that you signed in to Nibras; we send Apple no information about your children, your program, or your educational records. See "Signing in with Apple" above.
    • Resend, with Brevo as a backup — to send our emails.
    • Google Meet and Zoom — to run online classes. Each runs the call itself; Zoom also receives the class name. See "Google user data" and "Teachers who connect Zoom" above.
    • Sentry — to receive error reports from the website and the app, as described above.
    • Google Fonts — to serve the typefaces our pages use.
    • DigitalOcean — the hosting provider whose servers store your data.
    • Cloudflare — to protect and deliver our website.
    These providers process data on our behalf under their own privacy policies and may not use it for their own purposes.
  • Legal compliance. If we are required by law, court order, or to protect the safety of users, we may disclose the minimum necessary information.

We do not sell, rent, or trade your personal information.

8. Where your data is stored

Your account and educational data are stored on servers operated by our hosting provider, DigitalOcean, and reach you through Cloudflare. Payment processing is operated by Stripe, push notification infrastructure (FCM and APNs) by Google and Apple, email delivery by Resend and Brevo, online classes by Google Meet and Zoom, and error reporting by Sentry in the United States.

Each of these providers operates internationally, so your information may be processed on servers outside Canada and, while it is there, may be accessible to the authorities of that country under its laws. We choose providers that commit to protecting the information they hold for us, and we share with each one only what it needs to do its job.

To ask how our service providers outside Canada handle your information, write to our Privacy Officer at [email protected].

9. How long we keep your data

We retain account and educational data for as long as your account is active and for a reasonable period after deactivation to allow you to reactivate. If you request deletion, we delete your personal data within 30 days unless we are required to retain certain records for legal or financial reasons.

A few things outlive a deletion request, and only these: payment and invoicing records, which tax and accounting law requires a business to keep for six years after the year of the transaction; consent records, which are the evidence that a consent was given and are useless if they can be erased on request; a class's homework, attendance and progress records, which stay with the class with your name removed, so that nothing in them identifies you any more; messages you sent to other people, which stay in their inboxes under the name "Deleted user"; and our change history, a security record of who changed what on the platform and when, which only our platform administrators can read and which never records allergies or medical conditions. None of these is used for anything but its own purpose.

Messages sent to us through the contact form, and support requests once they are resolved, are deleted after two years. Error reports are deleted after 30 days.

Unsuccessful teaching and partnership applications are kept for up to two years in case a similar opportunity comes up, and are deleted sooner if you ask.

10. Your rights

You have the right to:

  • Access the personal information we hold about you (or your child)
  • Request correction of inaccurate information
  • Download a copy of your information from your profile, or ask us for it
  • Request deletion of your account and associated data
  • Withdraw consent for non-essential processing (you can disable push notifications in your device settings; you can change your photo and video consent; you can withdraw a payment authorization; you can opt out of optional communications)
  • Lodge a complaint with your local data protection authority — in Canada, the Office of the Privacy Commissioner of Canada, or your provincial commissioner

To exercise any of these rights, contact us at the email below. We will respond within a reasonable time, typically within 30 days. We will never charge you for making a request or treat you differently for having made one.

Account and data deletion request

You can delete your Nibras account yourself. In the mobile app, open Profile and choose Delete Account. On the website, sign in and go to Delete Account, which is also linked from your profile. Your account and personal data are deleted 30 days later, and signing in again before then cancels the request. A parent's deletion also deletes the accounts of their children who have no other guardian linked. If you cannot sign in, email [email protected] from the address on your account with the subject line "Account deletion request".

11. Security

We protect your information using HTTPS in transit, password hashing at rest, role-based access controls (so users see only the data they need), and regular security updates to our software and infrastructure. No system is perfectly secure, but we work to limit the impact of any incident and will notify affected users if a breach occurs that meets the threshold for notification under applicable law.

Our platform administrators, and any school administrator who turns it on, sign in with a second step: a code from an authenticator app on their phone. Every export of data from the platform is recorded in our change history.

To help with a support request, a small number of our platform administrators can open your account in a read-only view, so they see what you see. In that view they cannot change anything, send messages, or make or refund payments. Each such session is time-limited and logged.

12. Permissions the mobile app requests

  • Notifications — to deliver homework, message, and class notifications. You may decline this permission and still use the app; you simply will not receive push notifications.
  • Internet access — to communicate with Nibras servers.
  • Photos — only when you choose to attach a screenshot to a support request. The app opens your photo picker, and it receives only the image you pick.

The app does not access your contacts, microphone, camera, location, or other personal device data.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will change the version date at the top of this page and, if appropriate, notify you by email or through the Service.

14. If you live outside Canada

Nibras is run from Canada, and Canadian law is the baseline for everyone. Where the law where you live gives you more, you have that too. The main cases are below.

Quebec

Our Privacy Officer, named above, is the person in charge of the protection of personal information under Quebec's private-sector privacy law. Consent for a child under 14 is given by the parent or guardian, which is how children's accounts on Nibras already work. Before personal information about Quebec residents is handled outside Quebec, we assess whether it will be properly protected there. You may also complain to the Commission d'accès à l'information du Québec.

European Union and United Kingdom

Kunh Innovations Inc. is the controller of your information, except for a partner organization's program records, which that organization controls and we process on its behalf. We rely on: performing our contract with you (your account, your programs, and payments); your consent (photo and video use, optional notifications), which you can withdraw at any time; our legitimate interests (security, preventing abuse, and improving the service), which you can object to; and our legal obligations (tax and accounting records).

As well as the rights in section 10, you may object to processing based on our legitimate interests, ask us to restrict processing, and complain to your data protection authority. Your information is held in Canada, which the European Commission and the United Kingdom recognise as protecting personal information adequately; for our providers in the United States, we rely on their standard contractual clauses.

United States

A child under 13 can only be added by a parent, who gives consent for the child's information when adding them. A parent can review that information, have it deleted, or refuse further collection at any time by writing to our Privacy Officer. We never use children's information for advertising, we share it only with the service providers in section 7 to run the service, and we keep it only as long as section 9 describes.

15. Contact us

If you have any questions about this Privacy Policy or our handling of your information, please contact us at:

Kunh Innovations Inc.
Calgary, AB, Canada
Privacy Officer: [email protected]
Email: [email protected]
Website: https://nibras.cc