Privacy Policy
Nahfaz — Telegram mini app and mobile app · Last updated: October 5, 2026
In short: the app does not ask for your name, phone number, or address. Your lesson progress, saved vocabulary, and conversations with the tutor are stored — until you delete them yourself. The tutor's "brain" is Google Gemini, meaning the text, images, and audio you send are transmitted to Google to generate a reply. You can erase everything from inside the app with a single tap.
1. Who collects the data
The app is operated by an individual — an independent developer. For contact: info@zyff.uz or the "Send feedback or suggestion" button in the app.
2. What data is stored
| What | Why | How long |
|---|---|---|
| Account identifier. If you sign in via Telegram — your Telegram user ID and your display name/username. In the mobile app — an anonymous identifier (not linked to any personal information). | To return your progress to you | Until you delete it |
| Name and phone number you enter when you create your account in the phone app, plus an optional avatar image | To open your account, address you by name and, if needed, contact you about your account. The phone number is not used to sign in and is never sent to the AI provider | Until you change or delete it |
| Learning progress: your current lesson, level, saved words, review schedule, and chosen dialect and situation | So you can continue where you left off | Until you delete it |
| Conversation history: the messages you send the tutor and its replies | So the tutor can remember the context of the conversation | Until you delete it (the last few messages in each section) |
| Images and audio: a textbook page photo you send, a voice message you record | To read the text or check pronunciation | Not stored — discarded as soon as a reply is produced |
| Feedback: what you write via "Send feedback" or "Report an error," and the last question and answer at that moment | To find and fix problems | Delivered to the admin; the last 300 messages are kept |
| Counters: daily request count and 👍/👎 ratings (the totals, not who tapped them) | So the free quota is shared fairly and quality can be monitored | Daily counter — 2 days |
| IP address trace. When a new account is created in the mobile app, the IP address is recorded as a keyed one-way hash (HMAC) — the actual address is not stored and cannot be recovered from the hash without a secret kept on the server. | To block thousands of fake accounts from a single network | 1 hour |
The app shows no ads, uses no tracking pixels, does not sell your data to anyone, and does not pass it to advertising networks. It does not access your location (GPS), contacts, or the files on your device.
3. Who the data is sent to
- Google (Gemini API) — this is what generates the tutor's replies. The text you write and the images and audio you send are transmitted to Google to produce a reply. Note: the app uses Gemini's free tier, in which Google may use requests to improve its own products, and its staff may review them. For that reason, do not enter personal or confidential information into the app (this warning also appears in the app's "Profile" section). See: Gemini API terms. In the mobile app you are asked for your explicit consent to this before you first use the tutor, and you can withdraw it at any time in the "Profile" section.
- Vercel — the app and API are hosted here (server logs are generated on Vercel's side).
- Upstash (Redis) — the data in the table above is kept in this store.
- Telegram — if you open the app inside Telegram, Telegram's own privacy policy also applies.
- Cloudflare R2 — the dictionary book's page images are kept in this private store. This is a server-side resource only; none of your data is written to it.
4. Artificial intelligence disclaimer
The explanations, translations, conjugations, and parsing (i'rab) answers in the app are generated by artificial intelligence (Google Gemini). It is reliable for basic rules, but it may make mistakes in the conjugation of weak (mu'tall) verbs, subtle points of i'rab, and quoting Qur'anic verses and hadith. Check answers against your textbook and reliable sources. The app is not a tool for issuing religious rulings (fatwa).
If you encounter an incorrect or inappropriate answer, use the 👎 button under each reply or the "Report an error" option — the report reaches us and we review it.
5. Deleting your data
Both are inside the app, in the "Profile" section:
- "Erase all my data" — your conversation history, lesson progress, words, and settings are deleted; your account remains and you can start over.
- "Delete my account permanently" (in the mobile app) — both the data and the account itself are deleted completely. This cannot be undone.
Your data is deleted immediately and nothing is kept in backups. A few things are outside the app's reach or are kept in an anonymised form: (1) the text of feedback you sent stays for the administrator, but your identity and the last question/answer attached to it are removed; (2) daily request counters (they expire on their own within 2 days); (3) copies already delivered to the administrator's Telegram chat and our hosting provider's server logs (kept about 1 hour) cannot be removed from inside the app — write to the address above and we will delete what we can.
6. Security
- All communication travels over an encrypted (HTTPS) channel.
- When signing in via Telegram, every request is verified with a Telegram signature (HMAC-SHA256).
- The mobile app's account key is stored on the device; the server keeps only a one-way hash (fingerprint) of it, not the key itself — so even if the store leaks, no one can sign in with it.
7. Age limit
The app is for users over 13 years old (in the European Union and the United Kingdom — 16, or with parental consent). The app does not knowingly collect data from children under 13 and is not directed at children. If a child's data has been entered, write to the address above — we will delete it.
8. If this policy changes
Changes are announced on this page, with an updated date. If a change is significant, we will also notify you inside the app.