Privacy policy

The website athar.ac (Arabic, English, Russian) is a personal project run by Abdelrahman Yahya as an individual — not a registered company. Any question about your data: [email protected].

This notice covers the website. The Athar Android app has its own policy at https://athar.ac/en/app/privacy/ — the account is the same on the website and in the app, so deleting it in either place deletes it in both.

You can read opportunities and guides and use the tools without signing in. Our hosting provider (Cloudflare) records technical request data — IP address, time and requested page — in its logs; how long it keeps them is set by the provider under its own rules.

The site uses Cloudflare Web Analytics (a small script that measures page performance and visits in aggregate). Cloudflare states that it does not collect or use your visitors' personal data. The website itself does not set cookies in your browser.

The opportunities search box logs the text you type (2–80 characters), the number of results, the language, the page and the time — so we can learn what students look for and what has no result. In that table the entry is not linked to your account, email or IP address. Don't type personal data into the search box. We delete the search log automatically after 90 days.

When you create an account we keep: your email address; the name you enter; your interface language; the registration date; sign-in data (a password hash — not the password itself — or a Google sign-in identifier); the opportunities you save; and the notification and interest settings you choose. We keep this data while your account exists, and it is deleted with the account.

If you choose “Continue with Google”, Google confirms your identity and sends us what the sign-in scope requests: your email address and your name. The sign-in service we use (Supabase) keeps in your sign-in record the profile fields Google sends, including a link to your profile picture and whether your email is verified. Athar does not display or use the picture, and uses your name and email only to create your account or sign you in.

We do not read your Gmail, Drive, contacts or any other Google data, we do not use Google data for advertising, and we do not sell it or give it to third parties for their own purposes. You can use email and password instead of Google, and you can revoke Athar's access at any time at https://myaccount.google.com/permissions.

Student help: your messages and attachments (text, images or audio) are stored with your account — in the database and in private attachment storage — so the Athar team can reply. Live sessions: we keep your registration, your answers to the registration questions, the status of your request and the team's notes on it. Impact stories: the text of your story, your country, the type of impact, university, admission year and language, your consent choices (publication on the website / use in official documentation) and the files you choose to attach; it is published on the website only after approval and only if you consented to publication. A cryptographic (HMAC) hash of the IP address is kept with it to limit abuse. You can send a story without an account (we then need your name and email). Document translation service: we keep the order details and the documents you upload (such as passport, certificates, official documents and payment receipts) in private storage, plus the order messages and revisions.

Periods: help messages and their attachments, session registrations and account data are kept while your account exists and are deleted with it. Translation files (source documents, clarifications and the final translation) are deleted from storage 90 days after the order is closed; we carry this out ourselves in periodic batches (not instantly), and we do not delete files of an order that is open, disputed or under a legal duty of retention. Payment receipts are not covered by the 90 days: they are kept while your account exists and are deleted with it. If it turns out that we are legally required to keep payment records for a set period, we will keep only the minimum required, and we will update this notice before changing how deletion works. Impact stories sent without an account are published only with your explicit consent, and are kept until you withdraw consent or ask us to delete them (email [email protected]); we review unpublished stories periodically.

Email alerts are not sent until you confirm your subscription from a link in the confirmation email, and every email carries an unsubscribe link that works without signing in. Telegram is linked only if you start the link yourself with a one-time link; then we keep your Telegram account identifier only to send alerts.

The website does not ask for your age or date of birth, and sign-up has no age check, so we cannot tell whether a visitor is under 18. The site includes school olympiads, so students under 18 may use it. If you are under 18, we recommend using the site with the knowledge of a parent or guardian, especially before uploading documents or sending a story. A parent or guardian who wants to review or delete a minor's data can write to [email protected].

The name, email and message you type in the form are sent as an email to the site owner through Brevo and are not stored in the website's database. What is stored, to limit spam, is only a cryptographic (HMAC) hash of the IP address, not the address itself, and it is deleted after about 24 hours (cleared the next time the form is used after that).

The website does not set cookies. It keeps in local browser storage only what it needs: your sign-in session (if you signed in), your appearance choice (light/dark), the list of universities you saved or are comparing (it stays on your device), and a few simple interface flags. There are no advertising cookies.

Database, sign-in and files: Supabase (Supabase Inc., USA) — servers on Amazon Web Services, region eu-central-2 (Zurich, Switzerland), as stated in the app policy (section 7.1). Hosting, network, analytics and email routing: Cloudflare. Confirmation, password-reset and alert emails and the contact form: Brevo. Google sign-in: Google. And Telegram if you link it. All connections use HTTPS.

You can change your name and language in your account. To delete your account, email [email protected] from the email the account is registered with (or in the app: Account → Delete account). Once we have verified that you are the account holder, we carry out the deletion within 30 days at most, and we do it manually from the admin panel (it is not automatic): it removes the account and everything above that is linked to it, including the files in storage (student help, translation and impact stories), and checks that nothing is left before the deletion counts as done. If the law requires us to keep specific data, we will tell you in our reply what it is and why.

Backups: The operator does not keep manual backups of the database or of students' files — not on a personal computer, not on Google Drive, not anywhere else. Service providers (Supabase, Cloudflare, Brevo, Google, Telegram) may keep logs or copies under their own rules; the database provider makes no automatic backups on our current plan (per its documentation). So deleting your data from our systems does not instantly erase records or copies held by those providers.

You can request by email to [email protected], from the registered email: a copy of the data we hold about you, its correction or deletion, or the withdrawal of your consent to publish a story. There is currently no self-service data download on the website, so we prepare the copy manually after verifying your identity and reply as soon as we can. If you have a complaint, you may also contact the data-protection authority in your country.

The current version and its date are always on this page; if anything important changes, the date of the new version is shown here.