Privacy policy

Sijill is a place to study: your notes, books, questions and revision. What you write is private unless you choose to share it.

There are no adverts, no analytics and no tracking scripts. Fonts and every other file are served by Sijill itself, so opening a page tells no other company that you visited.

Sijill sends no email and never holds anyone's money. When you pay a teacher or an institute, the money goes straight to them; Sijill keeps the record and your receipt. Card payments are not switched on, so Sijill holds no card details. You can download what you have put in, and delete your account, at any time.

Messages are between students and their own teachers, and a parent you have linked can see them. Your voice stays on your own phone or computer unless you choose to send a recording to your teacher, and Sijill never uses your recordings to train AI or shares them with anyone.

Your account: your name, your email address, your interface language, and, if you give it, your country. Whether you have said “I teach”, which side of the app you last chose (studying or teaching), and whether you asked for the vowel marks to stay on for your screen reader. Your password and your recovery code are stored only as scrambled one-way hashes (scrypt); nobody, including the site's administrators, can read them.

Signing in with Google, if you choose it: this is optional, and until the site's operator sets it up the button only says it is coming soon. When you use it, Google tells Sijill your name, your email address (only one that Google has checked) and an account number that identifies you to Google, and nothing else. Sijill keeps that account number so it knows you next time. If the Google email matches an account you already have, Sijill asks for that account's password once before joining the two. Signing in with an email and password works without Google.

Signing in with Apple is not available yet. Its button says it is coming soon, and nothing is sent to Apple. Before it is switched on, this page will say exactly what Apple sends to Sijill.

What you tell Sijill about your studies, if you fill it in: the subjects that interest you, the languages you study in, your city, your level, a short note about yourself, and what you came to Sijill for. Sijill uses it to suggest classes, and your city to show teachers who come to it.

What you study, in Your Sijill and around it: notes, sources, collections and tags; highlights, bookmarks and where you stopped reading; questions you ask, including questions on a line of a book for your class, and the answers you receive; your revision cards and history, including how many times you repeated each line aloud and your weekly and monthly full reviews; your memorisation plans, with the days you chose and the intention you wrote; words you add to your vocabulary; study paths; books you import; posts in a class's or study group's discussion.

Classwork: homework you hand in, your answers to quizzes and to the i'rab tasks your teacher sets, and the marks and feedback your teachers give you.

If you teach: your teaching profile (it is public, so students can see who they would learn from), including your travel area if you give one: the cities you travel to, how far you will go, and whether you teach online or in person. Also the classes and study groups you run, the sessions you log, recordings you upload, attendance you record, quizzes and homework you set, marks and feedback you give, notes you leave for your class on a line of a book, the i'rab you write and check for your class with the books you cite, and certificates you issue.

The course and dawra board: if you post a listing, everything in it (its title, texts, dates, place, how it is taught, access for women, the price as you write it, language and description) and whether it has been approved. If you apply to one, your application, the message you add if any, and the organiser's answer.

Fees you pay: when a teacher or an institute asks you for a fee, Sijill stores the order: who it is for and who it is paid to, what it is for, the amount with each part on its own line, the date it is due, how you paid, the reference you type when you say you paid, whether it was confirmed, cancelled or refunded, and the receipt number. Sijill never holds the money.

If you take fees: your price plans (what you charge, in which currency, and for what), how you want to be paid (cash, bank transfer, Vodafone Cash or InstaPay, with the instructions you write for payers), the orders you issue, refunds, and your ledger of money in and out with the notes you add. Receipt numbers run in order for each teacher or institute and year.

Student lists: a teacher, or an institute, keeps one list of their students and of the people who have enquired. Each entry holds a name, a phone number and an email address if given, a stage (enquiry, trial, enrolled, paused, finished, lapsed or lost), where the person came from, whether they agreed to be contacted and whether they asked to stop, the notes staff write, and the follow-ups staff plan. Students of a class are added from the class list with their name only.

Enquiries: an institute's public page has a short form anyone can send, with or without an account. It stores your name, a phone number or an email address (at least one), your message, and your tick saying they may contact you about it.

Notifications: the messages Sijill shows you inside the app (a fee is due, a payment was confirmed, a class is soon, a reply arrived), whether you have read them, and your choices for each kind. A teacher or an institute may switch on reminders, such as a welcome, a class reminder or a gentle note about an unpaid fee. These start switched off, and Sijill records each one it sends so none is sent twice.

Private lessons: if a teacher offers booking, their weekly hours, time zone, notice period, days off and the price they set. When you ask for a lesson: the time, your message, the teacher's answer, and whether it was confirmed, cancelled or done.

Institutes: who holds which staff role (owner, administrator, teacher, finance or front desk) and who gave it. If the institute switches its public page on: its address, how it teaches, a short line about it, its WhatsApp number if given, and its questions and answers. Whether the site's administrators verified it, with a note of the evidence.

Community pages: a teacher or an institute can have a page. Sijill stores the page's description and settings, its posts and announcements, the pictures in them with the description each one carries, and who follows the page (and whether they asked to hear about new events). Pictures are made again when they are uploaded, and their hidden details, such as where and with which camera they were taken, are removed. If you comment, or say “JazakAllahu khayran” on a post, Sijill stores that too, with the time you agreed to the posting rules.

Events: what the organiser enters (title, time and time zone, place or online link, who it is for, access for women, number of places and price), and each sign-up: who signed up, the note they added if any, whether they are confirmed, waiting for an answer or on the waiting list, and, for a paid event, whether they paid.

Event sign-up questions, tickets and check-in: if an event asks questions when you sign up, your answers. They are deleted 90 days after the event ends, or after the period the organiser chose (between 7 and 365 days). Your ticket code, and each time you are checked in at the door: when, which member of the organiser's staff did it, and how (a scan, the code, or the name list). If a guardian follows your progress and the event asks for their agreement, their answer.

Your timetable: the day your week starts, whether Hijri dates and prayer times are shown, how long before a class you want a reminder, and any calendar link you make. A calendar link is a private address your calendar app reads; Sijill keeps only a scrambled form of it and when it was last read, and you can switch it off at any time. Prayer times are worked out on Sijill's own server from the place a class or an institute sets. Sijill never asks for your device's location.

Pen marks: what you draw over a text in the reader with the pen or the marker, tied to the line it belongs to.

Certificates and ijazas: what the teacher writes on one (your name as they wrote it, the book, the scope, the wording and the date) and whether it has been withdrawn. A memorisation certificate also holds the part you memorised and the teacher's word that they heard you recite it.

Messages, phone notices and recordings of your voice each have their own part below.

Lesson videos: a teacher can link a lesson to a YouTube video. Sijill stores the video's code and the minute it starts at, never the video itself.

Reports and safety: reports you make (what, why, and your note), the decisions moderators make about posts, comments, events or pages and why, any request you make for a second look, the people you block and the people or pages you mute.

Recitations: a recording of a library text is uploaded only by the site's administrator. It is stored with the reciter's name and a note of who gave permission to publish that voice.

Security records: a log of significant actions (for example, signing in, deleting a note or posting on the board) that records who, what and when, but never the text of notes, questions, searches or staff notes, and never anyone's payment instructions. Short-lived counters used to stop password guessing and floods of enquiries, which hold your email address, your account, a random key from a cookie on your device or, behind a trusted server, your network address.

Everything you write is private by default: only you can see it.

You can share a note with a class you belong to; then its members can see it. A question sent to your teacher is seen by that teacher only, unless you choose to share it with the class.

Your teacher sees your attendance and, if you follow their study programme, your name and progress in it. Recordings of a class's sessions are seen by its members; if the teacher allows students to upload recordings, a student's recording is seen the same way.

Study groups: friends studying together without a teacher. Every member sees the other members' names, the join code, and what is posted in the group. A study group has no marks, quizzes or certificates.

Quizzes: your answers and marks are seen by you and the class's teachers, never by classmates. Feedback a teacher writes to you is seen by you and the class's teachers only.

Homework and i'rab tasks: your teacher sees your work once you hand it in, and never sees what you have not handed in. Your answers and marks are seen by you and the class's teachers, never by classmates.

Questions and notes on a line: a question you ask on a line of a book for your class is seen by the class's teachers, and the answers are seen by the class. A note a teacher leaves on a line for the class is seen by that class's members.

Memorisation plans: your plan, its days and the intention you wrote are seen by you alone.

Institutes: if you join one, its staff see that you are a member, which cohorts you are in, and, for the classes of your cohort, your attendance and marked results. They do not see your notes, questions or revision.

Parents and guardians: nobody can follow your progress unless you give them a code. You choose whether they see your attendance, your results (an exam only once your teacher releases it), your teachers' feedback, your fees and your timetable, and you can change that or end it at any time. They never see your notes, questions or revision. If a teacher's reminders are set to reach guardians too, a guardian you linked receives class reminders, and fee reminders only if you share your fees with them.

Fees: an order is seen by you, by whoever paid it, and by the teacher, or by the institute staff whose role covers payments (the owner, administrators and finance, and front desk staff who record cash). The site's administrators see only how many orders there are, never who paid whom or for what. The payment instructions a teacher or an institute writes are shown to the people who have something to pay them.

Student lists are seen only by the teacher who keeps them, or by the institute's staff whose role allows it. A teacher in an institute sees only the students of their own classes, and front desk staff do not see notes. The notes staff write about you are never shown to you, to your parents or guardians, in search or in the security log, and a note marked private is seen by its writer alone. The site's administrators have no way to open a teacher's or an institute's student list.

Enquiries: an enquiry goes only to the institute you sent it to, and inside it only to the staff who handle enquiries (or only to the teacher you wrote to).

Notifications are seen by you alone. A lesson request, its message and the answer are seen by you and the teacher.

Teaching profiles are public, travel area included, so students can find a teacher who comes to their city. The city on your “What you study” page is not shown to anyone; it is only compared with teachers' cities when you ask for teachers who come to you. An institute's public page, once the institute switches it on, can be seen by anyone, with everything listed on it.

The board: a listing is seen by nobody but its poster and the site's administrators until an administrator approves it. Once approved, everyone signed in sees it, with the poster's name and, if it was posted for an institute, the institute's name. The administrators who check listings also see the poster's email address. An application, its message and the answer are seen by the applicant and the person who posted the listing, and nobody else.

Following a page is quiet: the page is not told who follows it, and its staff see only how many people do. Nobody else sees that number unless the page chooses to show it.

Posts and events: the public posts and events of an active page can be seen by anyone, including visitors who are not signed in (for an institute, only once it has switched its public page on). Posts and events for members are seen by members only. The first few posts of every page are read by the Sijill team before they appear. How many people said “JazakAllahu khayran” is seen by the page's staff only, unless the page chooses to show it.

Comments are never public. They are seen only by people signed in to Sijill who can see the post, with the writer's name and nothing else.

Event sign-ups: the organiser's staff see who signed up, the note they added, and whether they are confirmed, waiting or on the waiting list. The link to an online event is shown only to confirmed sign-ups and the organiser's staff: never on the public page, in search results, in posts, or in anyone else's calendar file.

Sign-up answers and check-ins are seen by you and the organiser's staff. Your pen marks and your timetable choices are seen by you alone; a calendar link shows your classes to whoever has the link, so keep it to yourself and switch it off if it is shared by mistake.

Reports, blocks and mutes: the person you report is never told who reported them. A block works both ways and quietly: neither of you sees the other's comments, neither can comment on the other's posts or sign up for the other's events, and a teacher you block disappears from your view with their page. Nobody is told they were blocked. A mute is one-sided and silent: the person or page simply stops showing for you.

Recitations: the reciter's name and the permission note are shown to everyone who opens that part of the text, so you can see whose voice it is and that they agreed.

Certificates and ijazas: anyone who has a certificate's code can check it on the verification page, which shows what is printed on it: your name as the teacher wrote it, the book, the teacher, the date, and whether it still stands. For a memorisation certificate it also shows the part memorised and the teacher's word that they heard it recited. Nothing else about your account is shown there, and search engines are asked not to list that page.

Administrators of the site can see account details (name, email, when you joined) so they can help you recover an account or stop abuse, and they see what is reported to them so they can moderate it. They cannot read your notes, questions or revision; the software does not give them a way to.

Messages are written words only, with no pictures or files. A teacher can write to their own students, and a student can write to their teacher when the teacher's settings allow it. Students cannot write to one another. A parent or guardian can write to a teacher when that is allowed, and an institute's staff can write or look over its messages only if their role gives them that.

For each message Sijill stores who sent it, who it went to, the words, when it was sent and whether it was read. The sender can remove a message within 60 minutes of sending it.

A conversation is read by the people in it and, unless you switch it off on the Parents and guardians page, by a parent or guardian you have linked. That starts switched on, and Sijill tells you once that it is. The site's administrators have no way to open a conversation.

A parent or guardian can also write to their child's teacher about the child. Each of these conversations is between one parent, one teacher and about one child; the parent starts it and the teacher replies. The child does not see it and is not told about it.

If you report a message, the moderators see that message and up to ten messages before it, so they can understand what happened, and nothing else from the conversation. They may keep it, remove it, or remove it and pause the sender's messages for 7, 30 or 90 days, and the sender is told the decision. The copy the moderators saw is emptied 180 days after the decision. Blocking someone stops messages in both directions, and they are not told.

Phone notices are optional, and you choose them on each device. When you allow them, Sijill stores the notice address and keys your browser gives it, a name for the device, your time zone and your quiet hours (10 at night to 7 in the morning to begin with), and a record of each notice sent, kept for 30 days. You can have up to ten devices. A notice is locked so that only your device can read it, and for a message it says only who wrote and from which class, never the words.

Phone notices travel through the notice service of your browser's maker (Google, Mozilla, Apple or Microsoft). That service carries the locked notice to your device and cannot read it.

Reciting to check yourself: the revision pages can listen while you recite, using the speech recognition built into your browser. Sijill receives nothing from it, neither the sound nor the words. Your browser may send the sound to its maker to turn it into words (Chrome sends it to Google, and Edge to Microsoft). Sijill tells you this before you begin, and remembers your answer only in your browser.

Practice recordings: when you record yourself on the practice page, the recording stays in your browser tab, and closing the tab removes it.

Sending a recording to your teacher: only if you choose to. The recording is then stored on Sijill's own server under a random name. Only you and the teacher you chose can listen to it, the teacher cannot download it, and you can delete it whenever you like. Each recording can be about 15 minutes long at most.

A teacher's voice for a section: a teacher can record themselves reading or explaining a section for their class. Only that class hears it.

Lesson recordings: a recording a teacher adds to a class session is stored on Sijill's own server under a random name, up to 200 MB. It is heard by the teacher and the students of the class, or by anyone if the course is public. A student may add a recording to a session that has none, when the teacher allows it.

Library recitations: a recording of a library text is added only by the site's administrator, with the reciter's name and a note of who gave permission to publish that voice.

Sijill never uses your voice or your recordings to train AI, never sells them, and never shares them beyond the people named here. Turning recordings into text is switched off. If it is ever switched on, this page will name the company that does it, and you will be asked first.

The word tool: when you tap a word in the reader, Sijill looks it up on its own server, in the dictionaries and word lists it keeps there. Nothing is sent to an outside service, and Sijill keeps no list of the words you look up.

Those sources each carry their own licence, and each entry names where it comes from: the Quranic Arabic Corpus (GPL, credited with a link to corpus.quran.com), the classical Arabic dictionaries from the OpenITI project (CC BY-NC-SA 4.0), the word analysis of CAMeL Tools (GPL) and, where it is used, Lane's Arabic-English Lexicon (CC BY-SA 3.0). None of them receives anything about you.

Printed pages: where a book has pictures of its printed edition, they are sent to signed in readers from Sijill's own server. A link to the place a picture came from opens only if you tap it.

Each text in the library names where it was copied from and the licence it is shared under. The terms of use say more about this.

Sijill uses the cookies below. All are needed for the site to work; none is for tracking or adverts.

Signed in (sijill_session, called __Host-sijill_session on the live site): keeps you signed in. It lasts 30 days, and ends when you sign out.

Language (sijill_locale and sijill_locale_choice): remember the language you chose, and that you chose it yourself. If you open one of the Arabic pages before choosing, Sijill remembers Arabic. Each lasts a year.

Time zone (sijill_tz): your device's time zone, set by the page itself so class times and reminders show in your own time. It lasts a year.

Guest teaching link (sijill_guest): only if a teacher lets you in as a guest through a link. It is sent only to the guest pages, and lasts 8 days at most.

New recovery code (sijill_new_recovery): shows you a new recovery code once. It lasts ten minutes at most.

Google sign-in (sijill_google_state and sijill_google_link): only when Google sign-in is switched on and you use it. The first lives while you are on Google's page, so Sijill can check that the answer belongs to the sign-in you started; the second while you confirm with your password that an existing Sijill account is yours. Each lasts ten minutes at most.

Enquiry key (sijill_dk): a random key with nothing about you in it. It is set only when you send an enquiry from an institute's public page while not signed in and Sijill cannot see a trusted network address, and it is used only to limit how many enquiries come from one device. It lasts a year.

Following (sijill_feed_seen): the time of the newest post you have seen in Following, so Home only says there is something new when there is. It holds that one number and nothing else, and lasts a year.

There is no cookie banner because there are no optional cookies to accept or refuse.

Some things are kept only in your browser, on your device, and are never sent to Sijill: the reader's text size, its vowel marks switch and your highlight colour; your pen settings and the size of printed pages; the words you chose to hide while revising; your answer about listening while you recite; when you last said not now to installing Sijill or to phone notices; the words of a post or a message you are still writing (until you send it); where you were in the reader for this visit; and books you save for offline reading. Saved books are wiped when you sign out, when another account signs in on that device, and when nobody has opened Sijill signed in there for 30 days.

Printing a text, a note or a receipt happens in your own browser. The print view is an ordinary page; nothing extra is stored when you print.

Sijill does not send your data to any other company, with one exception you choose yourself: if you sign in with Google, Google confirms who you are and sends Sijill your name, email address and account number, and Google knows you signed in to Sijill, as it does for any site you use it with. Google's own privacy policy covers what Google does.

Two more things happen only if you switch them on, and both are described above. Phone notices travel, locked, through your browser maker's notice service. Reciting to check yourself uses your browser's own speech recognition, which may send the sound to your browser's maker; Sijill itself sends nothing.

No payment company is connected. Fees are paid in cash or by transfer, directly between you and your teacher or institute. When a card payment company is connected, this page will name it and say exactly what it receives, before anything is sent to it.

Pictures posted on community pages are made smaller and cleaned on Sijill's own server; no outside service sees them.

Some buttons take you to another service when you tap them: an institute's WhatsApp button, and an event's map link or online meeting link, which the organiser wrote. That service's own policy then applies. An event's calendar file is made by Sijill and opened by your own calendar app.

Lesson videos: a lesson page with a YouTube video sends nothing to YouTube when it opens. Only when you tap “Play here” does the video load, from YouTube's privacy-enhanced player (youtube-nocookie.com); YouTube, which belongs to Google, then receives what any video player receives, such as your network address, and its own policy applies. “Open in YouTube” takes you to YouTube itself.

The optional AI features are switched off. If they are ever switched on, this page will name the provider and say exactly what is sent, before anything is.

The company that hosts the server stores the data on its computers, as any website requires. That company will be named here when the site is published.

Card payments: paying by card through a payment company is planned, but it is not switched on and no payment company is connected. When it is, this page will name the company, say exactly what it receives and what Sijill keeps, and before you pay you will see Sijill's share and the company's fee each on its own line. Card details will go straight to that company and never to Sijill. Today Sijill takes nothing from cash or transfers.

Email and text messages: Sijill sends no email and no text messages to phones yet. Before it does, this page will name the service that sends them and say what it receives.

Signing in with Apple: the button is there and says it is coming soon. Nothing is sent to Apple until it is switched on and this page says what Apple shares.

Your data is kept for as long as you have an account. Deleting a note deletes it. Deleting your account (Settings, then Security and privacy) removes your account and everything that belongs to it straight away, including your teaching profile and travel area, the classes and study groups you run, recordings you uploaded, your board listings and applications, certificates issued to you (their codes stop working), your notifications, your lesson bookings, your follows, comments, appreciation, event sign-ups with their answers, tickets and check-ins, your timetable choices and calendar links, your pen marks, your messages and your conversations with parents or teachers, the devices you allowed phone notices on, recordings you sent to a teacher, your homework, marks and revision decks, blocks and mutes, your teacher page with its posts and events, and the entries teachers and institutes kept about you in their student lists, with their notes and follow-ups. If you take fees, your price plans, payment instructions, ledger and student list go too.

A few records stay, without a link to your account. Orders stay with the teacher or institute you paid, as their record of money received, keeping only your name as it is on the receipt; orders your own students paid stay with them as their receipts. Posts you wrote on an institute's page stay as the institute's. Reports you made stay without your name, and so do moderation decisions about you. Certificates you issued to your students stay valid, because they belong to the students. Copies in the server's backups disappear as those backups are replaced.

Messages are not kept for ever. A conversation is deleted with its messages 365 days after its last message (the site's operator can set this between 30 days and ten years), and it closes when the student leaves the class or institute. The copy moderators saw of a reported message is emptied 180 days after their decision.

Removed posts and comments are deleted for good 30 days after a moderator removes them, unless a second look is still waiting. An enquiry sent without an account is not linked to any account; to have one removed, write to the contact address at the end of this page.

You can download what you have put into Sijill as one file from the same page, at any time. Besides your studies, it holds your orders with their lines, payments, refunds and receipt numbers, your notifications and their settings, your lesson bookings, your messages and your conversations with parents or teachers, the devices you allowed phone notices on, your homework and marks, what teachers and institutes hold about you in their student lists (name, phone, email, stage and where you came from), and your part in the community: your page, follows, posts, comments, appreciation, sign-ups, events you created, reports you made, blocks, mutes and decisions about you. The notes staff write about you are their working notes and are not included, and recordings are not in the file either, because they are sound files; you can listen to yours and delete them in Sijill. If you teach, the file also holds the records you keep: your price plans, payment instructions, ledger, the orders you issued with their receipt numbers, and your student list with its follow-ups. An institute's records are in its owner's file only, without the phone numbers and email addresses in its student list.

You can correct your name, language, country and screen reader setting in Settings, what you study on the “What you study” page, and what your guardians may see on the Parents and guardians page.

Passwords and recovery codes are hashed with scrypt. Every page and action checks, on the server, that you are allowed to see or change what you asked for. Guessing passwords, codes and join codes is limited, and so are floods of enquiries. The site runs with a strict content security policy. The measures are described in detail in SECURITY.md in the project, including the limits that are still open.

No system is perfectly secure. If you believe you have found a weakness, please tell the site's operator.

Sijill is for people studying with or without a teacher. Anyone under 13 should use it only with a parent's or guardian's permission, and teachers of children's classes are responsible for having that permission.

Sijill has no separate accounts for children and never asks anyone's date of birth. A teacher may write a student's date of birth in their own records of the class. A parent or guardian is linked only by a code the child gives them, and sees only what the child chooses to share, as described above.

Someone whose progress a guardian follows does not comment on community posts and does not sign up for paid events, unless the site's settings are changed to allow it.

If this policy changes, the new version will be published here with its date before it takes effect.

A contact address will be added here before the site opens to the public.