Privacy Policy

This is a courtesy translation. The German version of this document is legally binding.

1. Controller

The controller within the meaning of the GDPR is: Medina Camps, Jabir Bin Subh Al-Rasibi 3489, 42314 Madinah, Saudi-Arabien, e-mail: info@medina-camps.com.

2. Overview and principles

We process personal data only to the extent necessary to operate the community (data minimisation). We do not sell data, use no advertising trackers and build no advertising profiles.

Two principles up front: object recognition in Explore mode runs entirely on your device by default – camera images do not leave your phone (section 9). AI features that transmit data to a third party are only active with your prior, explicit consent (section 10).

3. Hosting (Vercel)

This website is hosted by Vercel Inc. (USA). When pages are accessed, Vercel processes technically necessary server logs (IP address, time, requested page, user agent) to deliver the site and ensure security. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement (Art. 28 GDPR) is in place; transfers to the USA are safeguarded by the EU-US Data Privacy Framework and standard contractual clauses.

4. Account, database and sign-in (Supabase)

Accounts, sign-in and learning progress are handled via Supabase, stored in the Frankfurt region (eu-central-1); a data processing agreement (Art. 28 GDPR) is in place. On registration we process: e-mail address, password (stored only as a cryptographic hash), display name, gender, chosen translation language and, optionally, a referral code.

Gender is collected solely to provide gender-separated areas of the community (e.g. game and future chat areas). During use we also store learning progress (e.g. mastery per word), experience points (XP), streaks, quiz and game results, and the vocabulary you create.

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

5. System e-mails (Resend)

System e-mails (e.g. confirmation link, password reset) are sent via Resend, Inc. (USA), processing your e-mail address. Legal basis: Art. 6(1)(b) GDPR; transfers are safeguarded by standard contractual clauses. No marketing e-mails are sent without separate consent.

6. Weekly learning digest by e-mail

Active members receive a weekly e-mail with their personal learning recap (e.g. XP earned, streak, next learning suggestion). This processes your e-mail address and your learning statistics; delivery is via Resend (section 5).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in informing you, as a member, about your own progress and motivating you to keep learning). You can unsubscribe at any time via the link contained in every digest e-mail; after unsubscribing you will receive no further digest e-mails.

7. Bot protection (Cloudflare Turnstile)

To protect registration against automated abuse we use Cloudflare Turnstile (Cloudflare, Inc., USA). Turnstile processes technical browser signals (including the IP address) to detect bots – without puzzles and without cross-site tracking. Legal basis: Art. 6(1)(f) GDPR. Transfers to the USA are safeguarded by the EU-US Data Privacy Framework.

8. Cookies and local storage

We only use technically necessary cookies (session cookies for sign-in) and browser storage for features such as language selection, installability as an app (PWA) and caching the recognition model for Explore mode (section 9). There are no marketing or analytics cookies, so no cookie banner is required.

9. Camera and Explore mode (on-device processing)

Explore mode uses your device's camera to recognize objects around you and show you their Arabic names. The camera is only activated after you explicitly allow it via your browser's or operating system's permission prompt; you can withdraw this permission there at any time.

Object recognition in the standard mode runs entirely locally on your device: the recognition model is downloaded once from our website and cached in your browser; camera images are analysed exclusively on your device, are not transmitted to us or to third parties, and are not stored anywhere.

The pronunciation feature (reading words aloud) also uses your browser's speech output and runs locally on your device.

Only if you additionally activate the AI features with your consent (section 10) are individual captures transmitted to the service named there.

10. AI features (only with your consent)

The community offers optional AI-powered features. They are disabled by default and are only used after you have explicitly consented in the app (Art. 6(1)(a) GDPR). Without this consent, all core features of the community remain fully usable.

In detail: (a) "What is that?" – a single photo from Explore mode is transmitted for object identification; (b) live mode – during an active live session, individual camera frames (about every three seconds, only while the camera is steady) are transmitted for object identification; (c) harakat assistant – an Arabic word you entered and its translation are transmitted for vocalization; (d) example sentences – a word and its translation are transmitted to generate an example sentence.

Recipient: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (service: Gemini API). Transfers to the USA are safeguarded by the EU-US Data Privacy Framework, under which Google is certified. The content is processed to generate the respective response; we ourselves do not store the transmitted photos or camera frames.

In connection with the AI features we only store: the time of your consent, monthly usage counters (to enforce the free quotas) and the vocabulary you yourself choose to save from the results.

You can revoke your consent at any time with effect for the future – with one click in your profile area ("My area") or by e-mail to the address above. After revocation the AI features are disabled until you consent again; the lawfulness of processing carried out before the revocation remains unaffected.

11. Referral programme

If you register via an invitation link, we store the link between inviter and invitee to credit the bonus XP to both. Legal basis: Art. 6(1)(b) GDPR.

12. Feedback feature

Via the feedback button you can send us suggestions and problem reports. We store your message, the page it was sent from and the link to your account, to allow follow-up questions and improve the community. Legal basis: Art. 6(1)(f) GDPR. Feedback entries are deleted once handled and no longer needed, at the latest when your account is deleted.

13. Retention and account deletion

We store your data for as long as your account exists. You can request deletion of your account at any time (by e-mail to the address above or via the feedback button); your personal data will then be deleted unless statutory retention obligations apply.

14. Your rights

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18)
• Data portability (Art. 20) and objection (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Complaint to a data protection supervisory authority (Art. 77 GDPR)

15. Minimum age

Use of the community requires a minimum age of 16. Younger persons may only register with the consent of a parent or guardian. For minors, the AI features (section 10) additionally require the consent of a parent or guardian.

16. Changes

We update this privacy policy when processing or the legal situation changes. The version published here applies.