Privacy Policy
Plain English, and specific. If something isn’t listed below, we don’t collect it.
Last updated: · Applies to the Mashi app (iOS and Android) and this website.
1. Who we are
Mashi is operated by Momken Egyptian Arabic, which is the data controller for everything described here. For any privacy question or request, email support@mashiapp.pro. We answer within a few working days.
2. What we collect, and why
Everything Mashi holds about you falls into one of these groups.
| What | Why we need it |
|---|---|
| Account — email address, display name, the role you chose (learner, teacher or organization owner), your time zone, and the answers you gave at sign-up: age group, why you are learning, the level you chose to start at, whether you are in Egypt (only asked if you are travelling or living there), and how much time you have. Also which screens’ tips you have already seen. | To create your account, keep your progress across devices, build your plan and its time estimate, word the app and your reminders around your reason, and send reminders at a sensible local hour. |
| Learning activity — lessons and topics completed, quiz answers and scores, words you got wrong, XP, streak, badges, missions and quests, league position, your felucca design. | This is the product: it decides what you see next, runs the Felucca Race, and shows your teacher how you are doing if you joined a class. |
| Classes and teachers — the teacher you joined, the class you were placed in, assignments and whether you finished them, announcements and cheers your teacher sent. | Only if you entered a teacher’s code or opened their invite link and they approved you. Your teacher sees your progress and assignment completion. |
| Chats — the messages you write and receive in Mashi’s chats, when they were sent, whether the other person has seen them, which chats you muted or blocked, and any report you make. See section 3 for the details. | To deliver your messages, show “Seen”, honour mute and block, and deal with reports. |
| Organizations — the organization you joined or created, your role in it, its invoices, the payment instructions we give it, and its chat and requests with the Mashi team. | To give you Pro through your employer, school or club. The organization sees your profile (name, email, age group and why you learn) and your progress, including level, streak, lessons and quiz scores; you are shown this before you ask to join. It does not see your chats, your translations or your saved words. |
| Purchases — whether you have Pro, which plan, when it renews, and any referral code you used. | To unlock what you paid for and to give you the free time a teacher’s code promises. We never see your card number; Apple or Google does. |
| Teacher earnings (teachers only) — the referral code, which of your students subscribed, your commission, and the payout details you enter: bank, account name and number, or a mobile-wallet phone number. | To calculate and pay your 10% referral commission. Payout details are stored only when you request a payout. |
| Translations — the sentences you type or say into Speak & Translate, and the answers. | To show your history, count your daily allowance, and avoid re-translating a sentence someone already asked. Your history is deleted with your account. |
| Bug reports — when you shake the phone to report a problem: the screenshot of the screen you were on, your description, the screen’s name, the app version, your device model and OS version. | To fix the bug. Screenshots go to a private store that only we can open. Sending a report is always your choice. |
| Usage events — which screens and features you use, and app-level analytics events. | To see which parts of the app work and which don’t. Our own event log is deleted after 180 days. |
| Notification token — a device identifier from Apple/Google push services. | Only to deliver the notifications you turned on: assignment reminders, chat messages, announcements, streak and race updates. |
3. Messages and chats
Mashi has text chats, one conversation per pair of people. There are three kinds:
- Student and teacher. A student can chat with their own teacher, and the teacher with their own students, while the student is in one of that teacher’s classes or is their private student.
- Organization and the Mashi team. The owner of an organization talks to us about seats, renewals, invoices and support, and sends requests from the same chat.
- You and the Mashi team. Any user can write to us, and we can start a conversation with you, for example to answer a support email or a report.
Chats are text only, up to 500 characters a message (replies from the Mashi team can be longer). There are no photos, files, voice messages or link previews.
What we store
Each message (its text, who sent it and when), when each person last opened the conversation (this is what shows as “Seen” to the other person), whether you muted or blocked it, and the reports you make. A copy of your conversations is also kept in the app on your phone so they open without a connection; signing out clears it.
Who can read a chat
- Student and teacher chats can be read by the two people in them. Nobody else at the school, company or organization can read them: organization accounts never see chats.
- The Mashi team can open a student and teacher chat only after one of the two people reports it. A report saves a copy of the last 100 messages; the team member sees that copy and anything written since. Every time a team member opens a reported chat it is recorded in our administration log. Mashi staff cannot write into these chats.
- Chats with the Mashi team (organization and support chats) can be read by you and by every member of the Mashi team, so whoever is available can answer. For an organization, the current owner sees the organization’s whole conversation, including messages from before they became owner. Our replies are recorded in our administration log.
The safety filter
In student and teacher chats, every message passes through an automatic filter before it is saved. It hides phone numbers, email addresses and links (they appear as “[number hidden]”, “[email hidden]” or “[link hidden]”) and masks words from a short list of offensive words. Only the filtered text is stored; the original is not kept anywhere. The sender is told when something was hidden; the receiver only sees the filtered text. The filter is a set of fixed rules, not a person and not an AI model reading your messages.
Chats with the Mashi team are not filtered, so you can share an email address, a phone number or payment information with us there when you need to.
Reports, block and mute
- Report. In a student and teacher chat either person can report the conversation, with a reason and an optional note. The other person is not told. The Mashi team reviews it and may do nothing, warn someone, hide a message, close the chat, or suspend an account. We tell you when we have reviewed your report, without the details of what we did.
- Block. Either person can block the other. While a chat is blocked neither side can send messages and no chat notifications are sent. Only the person who blocked can unblock. Blocking does not change the class, assignments or announcements.
- Mute. Muting a chat stops its notifications on your phone. Messages still arrive and the other person is not told.
- Reporting and blocking are not available in chats with the Mashi team; write to us there or at support@mashiapp.pro if something is wrong.
Notifications show the message
When someone writes to you, the notification shows their name and the start of the message (up to about 80 characters, after the filter). Depending on your phone’s settings this can appear on the lock screen, where anyone holding your phone can read it. To keep previews private, turn off notification previews for Mashi in your phone’s settings, mute the chat, or turn Mashi’s notifications off. The notification text passes through Apple’s or Google’s push service to reach your phone (see section 5).
Payment details in organization chats
Our payment instructions for an organization’s invoices (for example bank transfer or InstaPay details and the reference to use) are shown in the organization’s portal and may also be sent in its chat with us. If you send us payment details or a proof of payment in that chat, the Mashi team can read it. Never send card numbers or passwords in any chat; we will never ask for them.
How long messages are kept
We have no automatic deletion period for chats yet. Messages are kept while either account in the conversation exists, and after that for as long as we need them for safety and legal reasons, for example a conversation that was reported. When a student leaves a teacher, or the teacher removes them, the chat becomes read-only but stays visible to both. If we set a fixed period we will update this page. You can ask us to delete messages you sent by emailing support@mashiapp.pro; we will do so unless we need to keep them for one of those reasons.
If you delete your account
Your account and the rest of your data are deleted as described in section 8. Messages you already sent stay in the other person’s conversation, shown as from a “Deleted account” without your name, and the conversation becomes read-only.
4. What we never collect
- Your location. The app has no location permission.
- Your contacts or your photo library, beyond a picture you yourself attach to a bug report.
- Advertising identifiers. There is no advertising, and no advertising or tracking SDK in the app.
- Your voice. Speaking practice (Parrot) records to a file on your phone, plays it back to you, and is never uploaded. When you dictate into Speak & Translate, your phone’s own speech recognition (Apple’s or Google’s) turns speech into text; only the text reaches us.
- Pronunciation check (“Say it back”). When you tap the microphone, Mashi uses your phone’s built-in speech recognition (Apple on iPhone, Google on Android) to turn what you say into text. Depending on your phone, the sound of your voice may be sent to Apple or Google to do this, under their own privacy terms. Mashi itself never records, uploads or stores your voice: only the recognized text is used, on your device, to show your result, and it is discarded when you move to the next word.
- Payment card details. Purchases are made through Apple or Google.
5. Who processes your data for us
We use a small number of providers, each for one job. They act on our instructions and receive only what that job needs.
| Provider | What it does for us |
|---|---|
| Supabase | Hosting, database (including chats), sign-in, file storage |
| Cloudflare (R2) | Stores the course recordings, and bug-report screenshots in a private bucket |
| RevenueCat | Keeps track of subscriptions and applies the referral bonus (a free month or week) |
| Apple (App Store, Sign in with Apple) | Sells the subscription on iPhone and iPad, delivers notifications to them (a chat notification carries the sender’s name and the start of the message) and, if you choose, signs you in |
| Google (Google Play, Sign-In, Firebase Cloud Messaging, Firebase Analytics) | Sells the subscription on Android; optional sign-in, push delivery (a chat notification carries the sender’s name and the start of the message), and app-usage analytics |
| OpenRouter → Google Gemini | Produces the translations in Speak & Translate. The text you translate is sent to it; your name and email are not. |
We do not sell personal data, and we do not share it with advertisers or data brokers. Data may be stored and processed outside your country by the providers above; each of them offers standard contractual protections for international transfers.
6. Our legal basis
For people in the UK, EU or other places that ask us to state one: we process your account, learning, class, organization and purchase data because it is necessary to provide the service you asked for. We process usage events, bug reports and translation caching under our legitimate interest in keeping the app working and improving it, which you can object to at any time. Delivering your chat messages is part of the service you asked for; the chat filter, reports, our review of reported chats and keeping messages are based on our legitimate interest in keeping the people who use Mashi, many of them young learners, safe, and on any legal obligation to keep records. Notifications and bug reports are sent only with your consent, which you can withdraw in Settings.
7. How long we keep it
- Account, learning, class, organization and purchase records — for as long as your account exists.
- Chat messages — no automatic deletion period yet: kept while either account in the conversation exists, and after that as long as needed for safety and legal reasons (see section 3).
- Chat reports, with the copy of the messages they saved — kept for safety reasons, including after either account is deleted.
- Usage events — 180 days, then deleted automatically.
- Translation history — until you delete your account.
- Bug reports and screenshots — until the bug is fixed and the report is cleared, or until you delete your account.
- Teacher earnings and payout records — for as long as we are legally required to keep payment records, even after the account is deleted. These keep the teacher’s name and email so a payment can be traced.
8. Deleting everything
In the app: Settings → Delete account → confirm. This runs immediately and removes your account, profile, learning history, class and organization memberships, translation history, subscription records, notification tokens and bug reports. It is not a soft delete and there is no waiting period.
Some things survive:
- Messages you sent in chats. They stay in the other person’s conversation, shown as from a “Deleted account” without your name, and the conversation becomes read-only. Messages in your organization’s or your own chat with the Mashi team stay with us too.
- Chat reports you made or that were made about you, with the messages they saved.
- Entries in our internal administration log that record that an action happened, with your identity removed.
- For teachers, the commission and payout records we must keep as payment records, which keep your name and email.
By role. A teacher’s classes are removed and their students unlinked. An organization member’s seat is freed. An organization owner deletes from More → Delete account; while the organization still has members, the Mashi team must close the organization first (or change its login email to someone else at the company), and an organization account with no members left closes the organization by deleting.
The Mashi team can also suspend an account, or delete one, when it breaks our Terms or when you ask us to. A deletion by us follows the same rules as one you make yourself.
Deleting your Mashi account does not cancel an App Store or Google Play subscription. Cancel that in your store first, or you may keep being charged.
If you can no longer sign in, email support@mashiapp.pro from the address on the account and we will delete it for you.
9. Your rights
Wherever you live you can ask us to show you the data we hold, correct it, export it, delete it, or stop processing it for a particular purpose. Email support@mashiapp.pro and we will do it; most of it you can also do yourself in the app. If you are in the UK or EU you can also complain to your data-protection authority.
10. Children
Mashi asks for an age group at sign-up, and some of its age groups are for children under 13. We do not knowingly create accounts for children under 13 without a parent, guardian or teacher doing so on their behalf. A child’s account collects exactly the same data as any other and nothing more: no advertising, no tracking, no location, no voice upload.
Chats and children. A child can chat only with the teacher who approved them, and with the Mashi team. The chat works the same way for every age: the same filter hides phone numbers, email addresses, links and offensive words, and the child can report or block the teacher like anyone else. There is no separate parent view of a child’s chats in the app.
A parent or guardian can ask us at any time to see or delete a child’s data, including their chats, by emailing support@mashiapp.pro. Teachers should only approve students they are entitled to teach.
11. Security
Data is held in Supabase behind row-level access rules, so a signed-in account can only read the records it is entitled to: a chat between a student and a teacher can be read only by those two people, and by the Mashi team only through a recorded review after a report. Passwords are handled by the sign-in provider and are never visible to us. Recordings of the course are public files; your screenshots and images are private. Connections are encrypted in transit.
12. This website
This site sets no cookies, loads nothing from third parties, runs no analytics and has no forms. The download buttons are plain links to the App Store and Google Play.
13. Changes to this policy
If we change how we handle your data we will update this page and the date at the top, and tell you in the app if the change is significant.