Privacy Policy

We Begins With Me Limited 1851 Walnut Crescent Coquitlam, BC V3J 7S9 Canada contactus@webeginswith.me

Effective Date: May 10, 2026

We know privacy is a big deal — especially when it comes to kids. At We Begins With Me, we’re committed to protecting your family’s personal information. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and the choices you have.

By using our app, you agree to this policy. If you don’t agree, please don’t create an account.

1. Who We Are

We Begins With Me Limited (“We Begins With Me,” “we,” “us,” or “our”) is a Canadian company that builds gamified learning experiences for Muslim children ages 7 to 12. We are the data controller and operator for the We Begins With Me app and related services.

Mailing address: 1851 Walnut Crescent, Coquitlam, BC V3J 7S9, Canada Email: contactus@webeginswith.me

2. Who This Policy Is For

This Privacy Policy applies to two groups of people:

Parents and guardians. Adults who create and manage a family account, choose settings, and supervise their child’s use of the app.

Children ages 7 to 12. Kids using the app under their parent or guardian’s supervision. Our app is designed with parents, for children — we do not knowingly allow a child to use the app without a parent’s involvement, and we do not knowingly collect personal information from children under age 7.

If you are between 13 and 17 and want to use the app on your own, please ask a parent or guardian to set up the account on your behalf.

3. What We Collect

We collect only the information we need to deliver the app’s core features and to keep your family’s account secure. Here is the full list, organized by category.

Information about parents and guardians

• Name — to address you and label your family account.
• Email address — to create your account, send important account notifications, and respond to support requests.
• Account password — stored only as a one-way encrypted hash by our authentication provider. We never see or store your raw password.
• Family preferences — your madhhab selection and any avatar appearance preferences (with or without faces) you choose for your children.

Information about each child profile

• First name or chosen nickname — to personalize their experience inside the app.
• Age or date of birth — to deliver age-appropriate content and to support our COPPA compliance.
• Avatar selection — which pre-designed avatar your child has chosen. The app does not collect or upload photographs of children.
• Prayer-tracking data — each time your child marks a prayer completed, we record the prayer type (Fajr, Dhuhr, Asr, Maghrib, Isha, Jumuah), the prayer category (Fard, Sunnah, Nawafil, Witr), the date, the timestamp, whether the prayer was tracked on time, and any optional “superpower” modifiers your child selected (such as praying in jamaah, at a masjid, making dua, or tasbih). These modifiers are self-reported by tapping in the app — we do not use GPS or location services to verify them.
• Progress and rewards data — XP (ajr), coins, badges earned, current streak, and level.
• Video viewing data — which video lessons your child has watched and how much of each lesson was completed.

Technical information

• Device identifiers — a randomized installation ID that helps us deliver push notifications and prevent duplicate accounts. This identifier is not linked to your personal identity by us.
• Push notification token — an anonymous token issued by Firebase Cloud Messaging that allows us to send your family prayer reminders or app updates. You can turn off push notifications in your device’s settings at any time.
• App and device diagnostics — when something goes wrong, we collect crash reports and anonymized usage data so we can understand and fix the problem. This data does not include your child’s name, age, or any other directly identifying information.

What we do NOT collect

We do not collect photographs of children, voice recordings or audio, location data (GPS or coarse), web browsing history, contacts, calendar events, or financial or payment information at launch. (In-app purchases are planned for a future update of the app and will be processed entirely by Apple or Google — we never see card numbers.) We also do not collect any data from social media accounts.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver the app’s core features — tracking prayers, awarding XP and coins, showing badges, displaying age-appropriate video lessons, enabling sibling competition within your family account, and personalizing the avatar experience.
• To create and manage your account.
• To send you account-related communications (password resets, important policy updates, prayer time reminders if you have enabled push notifications).
• To improve the app — we look at anonymized, aggregated usage data to understand which features work well and where children get stuck.
• To investigate and fix crashes and bugs.
• To comply with our legal obligations and to protect the rights and safety of our users.

5. What We Don’t Do

We want to be very clear about what we will never do with your child’s data:

• ❌ We will never sell your or your child’s personal information.
• ❌ We will never share your child’s data with advertisers, advertising networks, data brokers, or marketers.
• ❌ We will never use your child’s data for behavioral advertising, ad targeting, interest-based profiling, or any kind of psychographic analysis.
• ❌ We will never track your child across other apps or websites.
• ❌ We do not enable any third-party tracking SDKs that profile children.

6. Parental Consent and Control

Before any child can use the app, a parent or guardian must create a family account. By creating the account, the parent confirms they are authorizing us to collect the limited information described in Section 3 for their child, in compliance with the Children’s Online Privacy Protection Act (COPPA) and similar laws.

We rely on the “internal use only” exception under COPPA — the personal information we collect from children is used only by us (and our data processors named in Section 8) to deliver the app’s features, and it is not disclosed to any third party for that third party’s own purposes. As a parent, you can at any time:

• Review the personal information we have collected about your child by emailing contactus@webeginswith.me.
• Update or correct your child’s profile from inside the app’s parent area.
• Delete your child’s profile from inside the app’s parent area, or your entire family account by emailing contactus@webeginswith.me.
• Refuse further collection by deleting the account.

Parents have full control. Children cannot change settings, contact us directly, make purchases (when purchases are eventually offered), or interact with anyone outside their own family — all of those are gated behind the parent’s PIN-protected area inside the app.

7. Data Deletion and Retention

While your account is active, we retain your data so the app can function — your child’s prayer history, streak, badges, and progress all depend on having a record of what they have done.

When you delete your account or your child’s profile, we permanently delete the associated personal data from our active production systems within 30 days. Some data may remain in encrypted, access-restricted backups for up to 90 additional days as part of our normal backup retention, after which it is overwritten and unrecoverable.

Anonymized, aggregated data — for example, statistics like “85% of our users completed at least one prayer today” with no link to any individual — is retained indefinitely to help us understand and improve the app.

To request deletion, email contactus@webeginswith.me with the subject line “Delete my data.” We will confirm receipt within 5 business days and complete the deletion within 30 days.

8. Service Providers and Third Parties

We use a small number of carefully selected service providers to operate the app. Each is bound by a Data Processing Agreement that limits how they may use your information — they may only use it on our behalf to deliver the service we have hired them for, and they cannot use it for their own marketing or other purposes.

Where data is stored. Our primary database and authentication systems are hosted by Supabase in their Canada (Central) region — ca-central-1, located in Montréal, Québec, Canada. When you and your child use the app from outside Canada, data is transferred to Canada for processing.

When you eventually make in-app purchases (in a future update of the app), payment data will be processed entirely by Apple Inc. or Google LLC according to their respective privacy policies. We will receive only a transaction confirmation — we will never see your payment card or bank details.

9. Push Notifications

If you enable push notifications, we may send you reminders for prayer times, daily streak alerts, achievement notifications, and occasional app updates. We will never include your child’s name in a push notification’s text — notifications are written generically. You can turn off push notifications at any time in your device’s settings; doing so does not affect any other part of the app.

10. Sibling Competition and Social Features

Inside your family account, children can see siblings’ progress, badges, and streaks for friendly competition. This visibility is limited to children in the same family account. There are no public profiles, no friend requests, no chat features, no comments, no follower system, and no way for any user outside your family to see anything about your child. Future updates may introduce parent-approved friend connections for cross-family competition — when that feature ships, this policy will be updated and parents will be asked to explicitly opt in for each connection.

11. Security

We protect your data using a layered security model:

• In transit: all data exchanged between the app and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• At rest: all data stored in our database is encrypted with AES-256 by our hosting provider.
• Access control: we use database-level Row Level Security to ensure that one family’s data cannot be accessed by another family, even by us in normal operations.
• Authentication: passwords are stored only as one-way hashes; we never see your raw password.
• Principle of least privilege: only personnel with a specific operational need can access production systems, and access is audited.

In the unlikely event of a data breach affecting your personal information, we will notify you by email within 72 hours of becoming aware of the breach and notify relevant regulatory authorities (including the Office of the Privacy Commissioner of Canada) as required by applicable law.

12. Your Rights

You have the right to:

• Access the personal information we have collected about you and your child.
• Correct or update any inaccurate information.
• Delete your account and all associated data (see Section 7).
• Request a portable copy of your data in a machine-readable format.
• Object to specific uses of your data.
• Withdraw your consent at any time (which is equivalent to requesting deletion).

To exercise any of these rights, email contactus@webeginswith.me. We will respond within 30 days.

If you are based in Canada and believe we have not handled your data properly, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you are based in another jurisdiction, you may have similar rights with your local data protection authority.

13. International Users

The We Begins With Me app is offered primarily in Canada and the United States. When you use our app from another country, your data is transferred to and stored in our service providers’ data centers, where data protection laws may differ from those of your country. By using the app, you consent to this transfer.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes (changes that affect what we collect, how we use it, or your rights), we will notify you by email and through an in-app notice at least 30 days before the changes take effect. Continued use of the app after the effective date of the new policy means you accept the updated terms.

The current version’s effective date is shown at the top of this page.

15. Contact Us

For any privacy question, data request, or concern, please reach us:

By email: contactus@webeginswith.me By mail: We Begins With Me Limited, 1851 Walnut Crescent, Coquitlam, BC V3J 7S9, Canada About COPPA specifically: contactus@webeginswith.me, subject line “COPPA request”

We are committed to responding to every privacy inquiry within 30 days, and to most within 5 business days.

Thank you for trusting us with your family’s journey.

— The We Begins With Me Team