Privacy Policy
Deen Trail is made for children. It is a child-directed app run by a parent or guardian account. We collect as little as possible, we do not show ads, and we never sell or share your child's information. This policy explains, in plain language, exactly what we do and do not do with data.
1. Who we are
Deen Trail ("Deen Trail", "we", "us", or "our") is published by Noor Muslim Apps. If you have any questions about this policy or your child's data, contact us at [email protected].
2. Our privacy promises
- No advertising. There are no ads in Deen Trail, and no third-party advertising or ad-tracking software.
- No selling or sharing. We do not sell, rent, or share children's personal information for anyone else's marketing.
- No profiling. We do not build advertising profiles of your child and do not use their data to target them.
- Data minimisation. We ask for the least we can: a parent email to sign in, and a parent-chosen nickname and age band for the child profile.
- Parental control. Account, subscription, and privacy controls sit behind a parent PIN. A child in the app cannot reach them.
3. Parental consent comes first
Because Deen Trail is designed for children (ages 4–11), we treat every child profile as covered by children's privacy laws such as the U.S. Children's Online Privacy Protection Act (COPPA) and, where applicable, GDPR-K and other local rules.
Creating a parent account is not the same as consenting on your child's behalf. Before any child profile can be created or any child-linked progress is collected, the parent must complete a verifiable parental consent step. Today we use an email-based approval method: we send a single-use approval link to the parent account's email address, and after approval we send a confirmation email that explains how to withdraw consent at any time. The child experience stays unavailable until consent is verified.
You can withdraw consent at any time. In the app (Grown-ups → Settings → Delete Account & Data, behind your parent PIN), withdrawing consent immediately stops child mode, ends any active child session, halts new data collection, and begins deletion of your child's data (see §8). You can also email [email protected]; an emailed request takes effect after we verify you are the parent account holder and process it.
4. What we collect
Parent account
- Email address — to create and sign in to the account, verify parental consent, and send account/consent notices.
- Parent PIN — stored securely to protect grown-up areas of the app.
- Subscription status — whether the account has an active Premium subscription (see §6).
Child profile
- Nickname — a parent-chosen nickname shown to greet your child in the app. We ask you not to use their real name, and we do not require it.
- Age band — the journey you choose (Little Explorers 4–6, Steady Adventurers 7–9, or Trailblazers 10+). We use this only to pick age-appropriate content. We do not ask for or store your child's date of birth.
- Learning progress — completed activities and levels, Stars earned, rewards, collectibles, companion (Safar) growth, and in-app session time used against the daily limit.
Journal entries stay on the device
When your child writes a journal reflection, that free-text stays on the device only. It is not uploaded to our servers, is never used for analytics, and we cannot read it. You can clear the local journal from the parent settings on that device.
What we do not collect
- No date of birth, precise location, contacts, photos, microphone, or camera access for child data.
- No third-party advertising identifiers (such as IDFA).
- No behavioural tracking across other apps or websites.
5. How we use data
- To run the app: save progress, grow Safar, award Stars, and keep the daily journey in order.
- To keep child mode safe: enforce the parent PIN, the daily time limit, and access controls on our servers.
- To verify parental consent and manage subscriptions.
- To keep the service secure and working (for example, preventing abuse and diagnosing errors).
We do not use children's personal information for advertising, marketing, or any purpose beyond providing the app.
6. Service providers (sub-processors)
We use a small number of trusted providers to run the app. They may process data only to provide their service to us, under contract, and not for their own purposes:
- Supabase — secure account authentication, database, server functions, and media storage and delivery (story audio and images).
- RevenueCat — processing and validating subscription purchases and Premium status.
- Apple App Store / Google Play — handling the actual subscription payment. Payment card details go to the app store, not to us.
- Resend — delivering consent and account emails.
- Cloudflare — website hosting, the consent-approval page proxy, and inbound email forwarding.
See our full, current list of sub-processors for each provider's role. We do not use third-party advertising or marketing-analytics services in the app. If our list of providers changes in a way that affects your child's data, we will update this policy and, where required, ask you to consent again.
7. Where data is stored and how long we keep it
Account and progress data are stored on our providers' secured servers. We keep child-linked data only while your child is using Deen Trail. When you reset progress, delete a child, or delete the account, we remove or anonymise the associated data (see §8). Billing records connected to a purchase may be kept, with personal links removed, only as long as needed for financial and legal record-keeping.
8. Your choices and deletion rights
From the parent area (behind your PIN) you can:
- Review the information tied to your account and child profile.
- Reset Progress — a fresh start that clears completed activities, Stars, rewards, collectibles, and companion growth, and clears the local journal on that device. (Reset is a gameplay feature, separate from deletion.)
- Delete Account & Data — removes the parent account and the child profile under it, along with all associated progress, rewards, collectibles, and session data. (MVP has one child profile per account, so this is how a child's data is deleted.) A small deletion record (dates and ids only) is kept as proof the deletion happened. If any data is under a legal or support hold, it is no longer used by the app and is erased automatically once the hold ends.
- Clear journal on this device — clears the local journal reflections stored on that device.
Withdrawing consent is done by deleting the account or by emailing [email protected]. The in-app Delete Account & Data action requires your parent authentication and PIN, and takes effect immediately — child mode stops and deletion of your child's data begins. An emailed request instead takes effect after we verify you are the parent account holder and process it. Because journal text lives only on the device, a device that never reconnects to the internet cannot receive our clear signal — so the on-device "Clear journal on this device" control is also provided.
9. Security
Access to your child's data is enforced on our servers, not just in the app: progress, rewards, entitlements, and consent are checked server-side, and a child in the app cannot buy anything, change settings, message anyone, or open a web browser. We use industry-standard measures to protect data in transit and at rest. No system is perfectly secure, but we work to keep your family's information safe.
10. No third-party contact or content
Deen Trail has no chat, no social features, no user-to-user messaging, and no links that take a child out to the open web. Nobody can contact your child through the app.
11. Changes to this policy
If we make material changes, we will update the date above and, where the law requires, notify parents and ask for renewed consent before the change affects your child's data.
12. Contact us
Questions, requests, or concerns? Email [email protected] and we will respond promptly.