Privacy Policy

The app “Abyat” («أبيات») for iPhone and iPad, and this website
Effective date: 31 October 2026

This is a translation. If it differs from the Arabic text above, the Arabic text prevails.

1. Who we are

The app, this website and the app’s server are run by the developer Asim Ali (“we”). For any privacy matter, write to asimapps.dev@gmail.com.

2. What the app saves on your device

• Your profile: the verses you saved, your four verses and your poets, your lists (such as “verses about mothers”), your reading diary (the verse or poem you read, and the day), and the name, bio, symbol and colour if you add them.
• Notebook: the lines you write yourself, with the poem’s Circle number if you published it (from version 1.1).
• Duel: your best score, longest chain and number of games.
• Friends: the profiles you opened from links and saved, and which ones you hid or blocked.
• The restore code and the Circle key (from version 1.1): kept in the iOS Keychain on your device, encrypted, readable only by this app, and never put in iCloud Keychain. The Circle key is made only if you join the Circle.
• Settings: such as the language, when the card colours you unlocked with an ad expire, when to remind you to save a copy, and from version 1.1 haptics and your agreement to the Circle rules.

This data stays in the app’s own storage on your device. Your device backup (such as iCloud or a computer) includes it, and it moves to a new iPhone with Quick Start, depending on your settings and under Apple’s policy. In version 1.0 none of it reaches us. From version 1.1 none of it reaches us except what sections 4 and 5 describe: the encrypted backup, and what you publish yourself in the Circle. Your profile is deleted from the device when you delete the app; from version 1.1, iOS may keep Keychain items after the app is deleted, so if you install it again your profile and Circle come back by themselves.

3. What you share

None of the following happens unless you tap it yourself.

Your profile link and QR code: “Share your profile” gives you a link of the form https://le3batna.github.io/abyat/p/#…, and a QR code with the same link. The link carries:

• the name, bio, symbol and colour if you added them, and the date you shared it;
• a random profile identifier made on your device, which does not identify you, so that a friend’s app can update its saved copy of your profile when you send a newer link;
• your four verses, your poets, your latest readings and their days, your saved verses, and your lists;
• a few counts, such as how many verses you saved and your best duel score.

Verses travel as numbers only, never as text, and your notebook never goes into the link. All of this sits in the part after the #, which browsers never send to any server, not even this website’s. The profile page on this website decodes the link inside the browser of whoever opens it, then loads the verse texts from the poets’ files on this same website (such as Al-Mutanabbi’s file), so the server only sees requests for those files, as with any web page.

Anyone who gets the link can see what is in it, so send it only to people you choose. The link is a snapshot of your profile when you shared it, and it does not update by itself. Because we do not store it, we cannot delete or disable it; if you want a friend to see your latest profile, send a new link.

Your Circle invite link (from version 1.1): a link of the form https://le3batna.github.io/abyat/c/#…, with a QR code and an eight-character code. It carries only the invite code; section 5 explains it.

Cards and images: verse cards, notebook cards, your profile image, and from version 1.1 cards of a friend’s Circle poem and the picture of your restore code, are all drawn on your device, then your device’s share sheet opens, and you choose the app and the person. The images never pass through us. If you choose “Save Image”, iOS asks your permission to add it to Photos. The app can only add the picture; it cannot see or read your photos.

The “Move to another phone” file: from Settings, the app saves your whole profile, including your notebook, as one file through the share sheet, and you choose where it goes (Files, AirDrop, or a message to yourself). Treat it as a private file: whoever has it can read what is in it. The file never holds the restore code or the Circle key. “Restore from a file” reads only the file you pick. Once a month the app reminds you to save a copy; the reminder only shows inside the app.

Reports by email: “Report a wrong attribution” opens your mail app with a draft that contains the verse, the poet we show, the poem number and its source. “Report content” on a friend’s profile opens a draft with that profile’s content and link. Nothing is sent automatically: you decide whether to edit, send or discard it. A report inside the Circle (from version 1.1) goes straight to our server (section 5).

Outside links: “Open on Wikisource” and the privacy policy link open the page in your browser, outside the app, where that site’s policy applies. “Rate the app” opens the app’s page on the App Store.

4. The backup with a restore code (no account)

This feature starts with version 1.1; version 1.0 does not have it.

So you can bring your profile back on a new phone without signing in, the app gives you a restore code. Whenever your profile changes, the app uploads a copy by itself, but before anything is uploaded, your profile is encrypted on your phone with a key made from that code (end-to-end encryption, AES-256). If you joined the Circle, the encrypted copy also holds your Circle identity key, so your Circle comes back with you on the new phone.

Our server, which runs on Cloudflare, stores only the encrypted copy, its size, the time of the last backup, its version number, the app’s name and a one-way fingerprint of an ID derived from your code. We cannot read your profile and we do not know who you are: the copy is not linked to your name, e-mail, phone number, advertising ID, or your Circle profile on our server. Cloudflare processes your IP address to deliver each request; we do not store it.

The restore code stays on your phone (in the iOS Keychain) and with you; we never receive it, so we cannot recover a lost code, and anyone who has it can open and change your copy. Keep it to yourself; we will never ask you for it.

Deleting your cloud copy: in Settings › Delete my cloud copy, the encrypted copy is erased from our database at once and backups stop; only a marker that the code was retired remains (the fingerprint, the app’s name and the time), so the copy cannot come back from another device. Your profile stays on your phone. Deleting the app does not delete the cloud copy, so delete the copy first if you want it gone. You can then back up again with a new code.

5. The Circle: your poems, for your friends only

The Circle is an optional feature, from version 1.1 (version 1.0 does not have it), where you publish your own poems to the friends who follow you. None of the following happens unless you join it yourself.

Your Circle identity: when you join, your phone makes a key pair (Ed25519). The public key is a random number that serves as your Circle identifier; the private key never leaves your phone except inside the encrypted backup (section 4). The app signs every request with your private key, so nobody can post as you, and our server holds no secret about you.

What our server keeps (on Cloudflare):

• your Circle display name, emoji and colour, your identifier (the public key), and when you joined;
• the poems you publish (title and verses), and when you published and edited them;
• your comments and replies on poems, and when you wrote them;
• your likes (which poems, comments and profiles you liked), and the number of likes on each;
• your in-app notifications: who followed you, who liked what you published or your profile, who commented on your poem or replied to your comment, and when you read them;
• who you follow and who follows you, and who you blocked;
• your current invite code and when it expires (30 days, or until you replace it);
• reports: who reported (their identifier), which poem, comment or person, the reason and an optional note.

What we do not keep: no phone number, email or real name (unless you write one in your display name or a poem), no IP address, and no device or advertising identifier. Cloudflare processes the IP address to deliver each request; our server holds it in memory for at most a minute to limit abuse and never writes it anywhere. Workers Logs are off, and the server does not log what requests contain.

Who sees what: your poems, name and emoji are seen only by the people who follow you, and nobody can follow you without your own invite code or link. There is no public page and no people search, and Circle poems never appear on this website. A comment on a poem is seen by whoever sees the poem (its author and their followers), except people with a block between them. People see how many likes poems, comments and profiles have; who liked what you published is shown to you alone, in your notifications. Anyone who has your code can follow you while the code is valid, so send it only to people you choose, and replace it at any time (“New code”): the old code stops working. You can remove any follower, or block them.

Blocking: when you block someone, the follows between you end both ways and the notifications between you are deleted; afterwards neither of you can follow the other, see the other’s poems, comments or profile, or comment on or like the other’s poems. We do not tell them you blocked them.

Reports and moderation: you can report a poem, a comment or a person. We review reports ourselves, usually within 24 hours. When three different people report a poem or a comment, it is hidden automatically until we review it. The reported person is not told who reported them. We may remove content that breaks the Circle rules or stop an identifier from using the Circle.

The filter: display names, titles, verses and comments pass through a filter for inappropriate words, on your phone and again on the server, before they are published.

Retention and deletion:

• Your Circle profile, poems, comments, likes and follows: until you delete them.
• Deleting a poem or a comment: its text is erased at once, and what remains of its record (the identifier and times) is deleted within 30 days, unless a report on it is still waiting for review. A comment can be deleted by whoever wrote it, or by the poem’s author from their own poem.
• Notifications: deleted after 90 days, and only the latest 500 are kept. Notifications from a blocked or deleted person, or about deleted or hidden content, are not shown.
• “Delete my Circle profile”: deletes at once your profile, poems, comments, likes, follows both ways, invite code, your notifications and the ones you caused for others, and the blocks you made. Blocks other people made against your identifier stay, so whoever blocked you stays protected if you come back with the same identifier.
• Content we remove for breaking the rules: its text is kept for up to 90 days for review, then erased. A stopped identifier stays stopped.
• Reports: kept until we review them, then deleted 90 days after they are closed.
• Expired invite codes are deleted automatically.

Deleting the app does not delete your Circle profile; delete it from inside the Circle first if you want it gone.

6. Ads (Google AdMob)

Where and when: a small banner on browse lists only; never in the duel, in your notebook or in the Circle. On the card screen there is a button for an optional rewarded ad: if you tap it and finish the ad, the locked card colours open for a day. That ad never starts unless you tap its button yourself.

What happens in the background: shortly after the app starts, and if consent allows (see below), it starts the Google Mobile Ads SDK and gets a rewarded ad ready in advance. So the SDK contacts Google’s servers even if you never tap an ad.

What Google may collect: according to Google, its ads SDK may collect:

• the IP address, from which an approximate location is inferred (a city or region, never your precise location);
• a device identifier scoped to this app or to this developer’s apps. Nobody gets the advertising identifier (IDFA), because the app never asks for tracking permission;
• data about the ads you were shown and how you interacted with them (such as watching or tapping an ad);
• diagnostic data about performance and crashes.

Google uses this data to show and measure the ad, to limit how often an ad is shown, to fight fraud and abuse, and to improve its ad services. We give Google nothing from your profile, your backup or your Circle, and we never link them with ad data.

Non-personalised, family-safe ads: every ad request asks for non-personalised ads, which are not based on your past activity or interests. Google may still pick an ad from general context, such as the device language and the country. We also limit ads to content suitable for general audiences with parental guidance (PG).

No tracking: the app never asks for Apple’s “App Tracking Transparency” permission. We never link data about you with data from other companies’ apps or websites for advertising, and we do not sell data or share it with data brokers. The app uses Apple’s SKAdNetwork, which lets advertisers count the installs their ads brought without identifying you.

Consent: in the UK, Switzerland and the European Economic Area, and anywhere else the law requires it, Google shows a consent message when you open the app (Google’s User Messaging Platform). If you do not agree, the app requests no ads at all, and the app stays complete. The “Ad and privacy choices” button then appears in Settings, so you can change your choice at any time.

More: How Google uses information from sites or apps that use its services and the Google Privacy Policy.

In our AdMob account we see aggregated figures only (such as ad views and earnings by country). They do not identify anyone.

7. What the app does not do

No accounts or sign-in, no in-app purchases at the moment, no analytics or crash-reporting tools of our own, no chat or private messages, no public pages, and no push notifications. The app never accesses your contacts, precise location, microphone or camera, and never reads your photos. The library and the rhyme dictionary are inside the app and work offline; only the backup and the Circle (from version 1.1), the ads, the consent message and opening links need the internet.

8. All ages

The app is for a general audience, and its poetry selection is family-safe. What people publish in the Circle (from version 1.1) passes through a filter and is subject to the Circle rules, reporting, blocking and review. The app never asks your age, and we do not knowingly collect personal data from anyone, whatever their age.

9. Emailing us (optional)

• If you email us, we receive your email address, the display name on it, your message and any attachments.
• We use them only to reply to you, to fix the attribution, to handle a report or a copyright takedown request, or to sort out what you asked about. We never use them for marketing, and we share them with no one unless the law requires it.
• Retention: up to 12 months after our last exchange, then we delete them. You can ask us to delete them sooner: we do so within 30 days and confirm.
• Our support email is hosted by Google (Gmail), and messages may be stored on servers outside Saudi Arabia.

10. This website

• The website is static pages hosted on GitHub Pages by GitHub.
• No cookies, no analytics, no trackers, and no fonts or scripts from other sites.
• The profile page (/abyat/p/) reads the profile from the link inside your browser only, and sends it nowhere. The invite page (/abyat/c/) shows the invite code from the link inside your browser only, and contacts no server.
• Like any host, GitHub may log technical data about a visit in its server logs (such as the IP address, browser type and the page or file requested) for operation and security, under GitHub’s privacy statement, and its servers may be outside Saudi Arabia. We do not ask for or use these logs.

11. Who processes data with us, and transfers

• Cloudflare runs the app’s server and database (Cloudflare Workers and D1) on our behalf, for the encrypted backup and the Circle (from version 1.1). Its servers are in several countries, including countries outside Saudi Arabia, under its own policies and safeguards. Like any network provider, Cloudflare may process technical data about requests (such as the IP address) for operation and security; we do not ask for or use it.
• Google processes ad data on its servers in several countries, including countries outside Saudi Arabia, under its own policies and safeguards.

12. Your rights

Under Saudi Arabia’s Personal Data Protection Law you have the right to know how your data is processed, to access it and get a copy, to have it corrected, and to ask for it to be destroyed. You can use most of them in the app itself:

• Your profile is on your device and in your hands: you edit or delete it in the app, and deleting the app deletes all of it.
• The backup (from version 1.1): “Delete my cloud copy” in Settings. We cannot read it to give you a copy, but it is a copy of the profile on your phone.
• The Circle (from version 1.1): you edit your name and emoji, delete your poems and comments, undo your follows and likes, and “Delete my Circle profile” deletes all of it.
• For anything else, write to us and we reply within 30 days. Because we do not know who you are, we may ask you to show that the profile is yours (for example by sending your request from inside the Circle).

The data Google collects for ads is managed from the “Ad and privacy choices” button in Settings (where it appears) and from Google’s own tools. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA). If you live in a country with its own data-protection law, you have the rights it gives you.

13. Changes

If we change this policy, we update this page and its effective date above. If the app ever collects other data, or asks for tracking permission, we will say so here before that update, and update the App Store privacy details.

14. Contact

asimapps.dev@gmail.com