This service is operated by ArabApp Trading Establishment (Arabic: مؤسسة تطبيق العرب للتجارة) — a Saudi commercial establishment registered under Commercial Registration No. 7005856187 — the publisher of Tashkeel.app and other Arabic-language apps including Kitaba and Kaaf. References in this policy to "we", "us", "our" and "ArabApp" mean ArabApp Trading Establishment.
Tashkeel.app is a mobile and web application that helps users add Arabic diacritics (tashkeel) to text, generate Arabic text with AI, look up the authoritative diacritization of Qur'anic passages, and listen to text read aloud.
If you have any question about this policy, contact us at support@tshkeel.app.
This policy describes how we handle personal information when you use the Tashkeel.app iOS, iPadOS, or macOS app, the Tashkeel.app website at tshkeel.app, and our backend services (collectively, the "Service"). It does not cover the practices of third-party services we may link to, or the practices of Apple in connection with App Store distribution, Sign in with Apple, or in-app purchases.
You can use Tashkeel.app anonymously, but creating an account through Sign in with Apple lets your subscription and Library follow you across devices. When you sign in, we receive:
@privaterelay.appleid.com address. We treat the relayed address as your email and do not attempt to discover the underlying real address.Purpose: account authentication, pairing your device with your subscription and Library, customer support, and (if you choose) transactional emails such as welcome and receipt confirmations.
When you submit Arabic text — by typing, pasting, capturing through the camera (on-device OCR), or by using the keyboard or share-sheet extensions — that text is sent to our backend, processed (diacritized, generated, stripped, or matched against the Qur'an corpus), and returned to you.
When you subscribe through the App Store, Apple shares with us (directly and via our subscription-management partner RevenueCat) the fact of the purchase, the product identifier, the transaction date, and a token that lets us validate your entitlement. We do not receive your payment card details. Apple processes all payments.
We collect anonymous telemetry on every call: the endpoint used, source type (paste / camera / keyboard / share / etc.), input and output character counts, the model that processed the request, response latency, whether the request hit the cache, and the proportion of the input that matched the Qur'an corpus. We do not store the message content alongside these metrics. We use this data to improve the product, enforce rate limits, and detect abuse.
To enforce per-device rate limits on the anonymous tier and to block abusive traffic, we keep a one-way SHA-256 hash of your IP address with each request. The original IP is not stored. The hash cannot be reversed to identify you.
Tashkeel.app does not bundle any third-party crash-reporting or analytics SDK. Apple may share anonymized crash reports and performance data with us through App Store Connect if you have opted in to share with developers in your Apple device settings. That sharing is controlled entirely by Apple and by your device settings; we do not collect crash data through any other channel.
Tashkeel.app does not collect: precise or coarse location, contacts, photos, videos, microphone audio (except when you actively trigger voice input — see §3.8), health data, financial data beyond Apple's purchase token, browsing history, search history outside the app, or any data from other apps on your device.
If you trigger the voice-input feature, the audio is processed on-device by Apple's Speech framework. The recognized text — not the audio — is then sent to our backend for diacritization, like any other text input. We do not store the audio.
| Purpose | What we use |
|---|---|
| Provide the Service (process and return your Arabic text) | User content, account identifier (if signed in), cache |
| Authenticate you and sync your subscription + Library across devices | Sign in with Apple identifier, email |
| Take payment and validate your subscription | Purchase history (via Apple + RevenueCat) |
| Prevent abuse, enforce rate limits | Hashed IP, usage metrics |
| Improve the app, debug, measure quality | Anonymous usage metrics, diagnostic data |
| Send transactional emails (receipts, welcome, security) | Email address |
| Customer support | Email, account identifier, the specific item you ask about |
We do not use your information for advertising, for sale to third parties, or for cross-app or cross-website tracking.
| Sub-processor | What is shared | Purpose | Where |
|---|---|---|---|
| Apple Inc. | Sign in with Apple tokens, in-app purchase data, optional device diagnostics | Account authentication, payment processing, platform integration | United States |
| RevenueCat, Inc. | Subscription identifier, product ID, anonymized device install token, purchase events | Subscription state validation, receipt mediation | United States |
| Anthropic PBC | The Arabic text you submit to AI-augmented endpoints (smart diacritization, text generation, homograph resolution). No identity, account ID, or email is sent. | AI processing of your text | United States |
| Resend, Inc. | Email address, name (if you provided it), the body of the transactional email | Welcome, receipt, security, and support emails | United States |
We do not allow these sub-processors to use your data for their own purposes. Each is bound by their own data protection terms; click each name above to review their published policies.
The classical (non-AI) diacritization engine is Mishkal, an open-source Arabic diacritization library released under the GNU GPL-3.0 license (see §13. Open-source notices). Mishkal runs as a containerized service on ArabApp's own infrastructure; your text does not leave ArabApp's systems for Mishkal processing. Mishkal is not a separate legal entity and is not a sub-processor in the data protection sense.
| Data | Retention |
|---|---|
| Account identifier, email, name | Until you delete your account, then deleted within 30 days from production systems and within 90 days from encrypted backups. |
| Library items you saved | Until you delete the item, or your account. |
| Performance cache of processed text | 30 days, then automatically expired. Not linked to your account. |
| Anonymous usage metrics | Up to 24 months in detailed form, aggregated indefinitely. |
| Hashed IP for rate limiting | 30 days. |
| Purchase + entitlement records | For as long as required to support the subscription, plus the statutory retention period for tax and accounting records (typically 7 years). |
| Customer support correspondence | 3 years from the date of the last message. |
You have rights over your personal information. The exact wording differs by jurisdiction (see §9. Regional rights); the substance is the same:
To exercise any right, email support@tshkeel.app from the email address associated with your account, or use the in-app deletion flow. We will respond within 30 days.
Tashkeel.app is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with information, please email support@tshkeel.app and we will delete it.
For users in the European Economic Area, the minimum age for consent to data processing may be higher than 13 (typically 16, or as set by your member state). Where you are below that age, a parent or legal guardian must consent on your behalf.
If you are in the EEA or the UK, you have the rights described in §7. The lawful bases on which we rely are:
We transfer personal data outside the EEA / UK to the United States to the sub-processors listed in §5. We rely on the EU Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum) for those transfers. Apple, RevenueCat, and Anthropic each publish their SCC posture; we contract with each on those terms.
If you are a California resident, you have the right to know what personal information we collect, the categories of sources we collect it from, the purposes for collection, the categories of recipients, and the retention period — all of which are set out above. You also have the rights to delete, correct, opt out of sale or sharing, and not be discriminated against for exercising these rights. We do not sell or share your personal information (as those terms are defined under CCPA/CPRA).
Tashkeel.app is operated from the Kingdom of Saudi Arabia. We comply with the Personal Data Protection Law issued by Royal Decree M/19 of 9/2/1443H (as amended). The lawful basis for processing your personal data is your consent (which you provide by using the Service after reviewing this policy) and the necessity of the processing for the performance of the contract between you and us. You have the rights described in §7. Cross-border transfers to the United States (Apple, RevenueCat, Anthropic, Resend) are necessary for the performance of the Service and rely on the legal bases permitted under the PDPL implementing regulations. The Saudi Data & AI Authority (SDAIA) supervises personal data protection in KSA; you may file a complaint with SDAIA at any time.
We protect your information with:
No system is perfect. If we ever discover a breach affecting your personal information, we will notify you and the relevant supervisory authority in accordance with applicable law.
When you use the AI-augmented features (smart diacritization, text generation, homograph disambiguation), the text you submit is sent to Anthropic for processing by their Claude language model. Anthropic processes the text and returns a result; Anthropic does not (per their published policy) use API-submitted content to train models. We pass no identifier, account ID, or email to Anthropic with these requests.
The classical (non-AI) tashkeel engine and the Qur'an authoritative-lookup engine do not involve any external AI processor.
Please see our Terms of Service for the limits of accuracy of AI-generated output, particularly in religious or academic contexts.
Tashkeel.app uses the digital text of the Qur'an from Tanzil.net, licensed under the Creative Commons Attribution 3.0 Unported license (CC BY 3.0). We thank the Tanzil project for making this corpus available. The attribution and a link to the CC BY 3.0 license are reproduced in this policy and shown in the app beside detected Qur'anic text.
Tashkeel.app uses open-source software. A non-exhaustive list:
We may update this policy. When we do, we revise the "Last updated" date at the top. Material changes — particularly any change that expands the categories of data we collect, expands the sub-processors we share with, or changes how long we retain your data — will be notified to you in the app or by email at least 30 days before they take effect, except where the change is required by law.
ArabApp Trading Establishment (مؤسسة تطبيق العرب للتجارة)
Commercial Registration No. 7005856187
Registered office: RRFB3778, Riyadh 13335, Saudi Arabia
Email: support@tshkeel.app
Privacy-specific email: privacy@tshkeel.app
If you are in the EEA or UK and we are required to designate a data protection representative, we will publish their details here.