Privacy Policy

Last updated: 7 October 2026 · Commercium Limited

This Privacy Notice explains how Commercium Limited (“we”, “us”, “our”) collects, uses, shares and protects information when you use the iPhone app Sebak (the “App”) and this website, sebakapp.com. We are the data controller of the information described here. If you do not agree with this notice, please do not use the App. Questions: support@thecommercium.com.

1. What information do we collect?

Stored only on your device

Your progress (the sebaks you sealed, your streak), the notes you write, your reminder time, your App language and your display settings are stored on your iPhone. The Home Screen widget reads today’s sebak from storage it shares with the App on your device. We do not receive any of this. Deleting the App deletes it, and Settings › Reset progress removes your seals, streak and notes.

Microphone and your recitation

Only when you tap the microphone does iOS ask whether the App may use it. While you recite, the App listens and a speech model on your iPhone compares what it hears with the verse. The audio is processed in memory on your device and discarded; it is never saved to a server, uploaded, or sent to us or any service provider. You can change your choice at any time in iOS Settings › Sebak › Microphone.

Downloading the speech model

The first time you use the listening teacher, the App downloads its speech model from Hugging Face (huggingface.co), where the model is published. Like any download, this request reveals your IP address and device type to Hugging Face. Nothing about you or your recitation is sent with it. You can remove the download in Settings.

Daily reminders

If you allow notifications, the reminder is scheduled on your iPhone by iOS. No push service and no server are involved.

Purchases (subscription)

The subscription is sold through the App Store. Apple processes the payment under its own terms and privacy policy; we never receive your name, Apple ID or payment details. To know whether your subscription is active on your devices, the App uses RevenueCat, Inc., which receives a random app user ID created by RevenueCat, your App Store purchase receipts and transactions (product, price, currency, dates, renewal and refund status), the App version, iOS version, device model, storefront country, and the IP address of the connection.

Anonymous usage statistics

To improve the App, it may send usage events to our analytics provider Amplitude, Inc., unless you turn statistics off. The events are: the App was opened; onboarding was completed; a tab was shown; a lesson was opened, started, moved to its next step or completed (with the lesson number); a recitation attempt was made (with the verse number, the number of words heard as written, marked or uncertain, and how long it took, never the audio); a check question was answered (its type and whether it was right); a note was saved (only its rough length, never its text); a surah was opened in the Read tab; the reminder or the coloured letters were switched on or off; the speech model was downloaded; your progress was reset; the subscription screen was shown, and a purchase was started, failed (with the store’s error code) or restored, with the plan.

Each event also contains a random installation ID, a session number, the time of the event, the App version, the iOS version, the platform, your device’s language setting, the App language, the number of sebaks you sealed and your current streak. A placeholder IP address is sent in place of yours, so Amplitude does not derive your location from it. Statistics never contain your voice, what you recite, or what you write. Events wait on your device until they are sent, and are deleted when they are sent or when you turn statistics off.

Using a Quran app may say something about your beliefs. That is why the statistics are tied only to a random ID that we cannot connect to you, contain no name, contact details or location, and are never used for advertising or to build a profile of you.

Support e-mails

If you write to us, we receive your e-mail address and what you tell us, and use them only to answer you.

This website

sebakapp.com sets no cookies and runs no analytics or advertising scripts. Our server keeps standard access logs (IP address, time, page requested, browser) for security, for up to 30 days.

2. How do we use your information?

• To provide the App and the subscription, and to restore purchases on your devices.
• To understand how the App is used and improve it (anonymous statistics).
• To find and fix problems.
• To answer your support requests.
• To comply with legal obligations, such as tax records of sales that Apple reports to us.

We do not use your information for advertising, for profiling that has legal or similarly significant effects, or for automated decision-making.

3. What legal bases do we rely on?

If you are located in the UK or the EEA, the UK GDPR and the GDPR require us to explain our legal bases:

• Consent, given through the iOS microphone and notification prompts, for using the microphone on your device and scheduling reminders. You can withdraw it at any time in iOS Settings.
• Performance of a contract for providing the subscription, restoring purchases and answering your support requests.
• Legitimate interests for anonymous usage statistics and website security logs. We have balanced this against your interests: the data is minimal, linked only to a random ID, never used for advertising, and you can switch statistics off at any time.
• Legal obligations where we must keep or disclose information by law.

If you are located in Canada, we rely on your implied consent to collect anonymous statistics when you use the App. You can withdraw it at any time in Settings › Share anonymous usage statistics.

4. When and with whom do we share information?

• Apple, which sells the subscription through the App Store and processes the payment, under Apple’s own privacy policy (apple.com/legal/privacy).
• RevenueCat, Inc. (United States), our purchase-management service provider, processes purchase information on our behalf under a data processing agreement.
• Amplitude, Inc. (United States), our analytics service provider, stores and analyses the usage statistics on our behalf under a data processing agreement and may not use them for its own purposes.
• Business transfers. We may transfer information in connection with a merger, sale of company assets, financing or acquisition of all or part of our business.
• Legal requirements. We may disclose information where required by law or to protect the rights, property or safety of our users, us or others.

We do not sell personal information and do not share it for cross-context behavioural advertising.

5. International transfers

RevenueCat and Amplitude process data in the United States. Where information is transferred from the UK or the EEA, it is protected by the safeguards required by UK and EU law, such as standard contractual clauses and the UK International Data Transfer Addendum.

6. Cookies, tracking and Do-Not-Track

The App uses no cookies and no advertising identifier, and does not track you across apps or websites owned by other companies, so Apple’s App Tracking Transparency prompt is not shown. There is no agreed standard for Do-Not-Track signals, so we do not respond to them; because we do not track you, there is nothing for such a signal to switch off.

7. How long do we keep your information?

• Progress, notes and settings on your device: until you reset them or delete the App.
• Your recitation audio: not kept. It is discarded on your device as soon as it has been compared.
• Statistics waiting on your device: deleted as soon as they are sent, or immediately when you turn statistics off.
• Statistics held by Amplitude: only as long as needed to analyse how the App is used, then deleted or anonymised.
• Purchase records held by RevenueCat: for as long as you subscribe and afterwards as long as needed for accounting, tax and refund handling.
• Support e-mails: as long as needed to handle your request and any follow-up, unless the law requires us to keep them longer.
• Website access logs: up to 30 days.

8. How do we keep your information safe?

Information is sent over encrypted connections, contains no directly identifying information, and access to it is restricted. We use appropriate technical and organisational measures, but no transmission over the internet or storage technology can be guaranteed to be 100% secure.

9. Children

Children may use Sebak to learn with their families. The App asks for no personal information, and the statistics contain no name, contact details or location. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, for example by e-mail, contact us and we will delete it.

10. What are your privacy rights?

In some regions, such as the UK, the EEA, Switzerland and Canada, you have the right (i) to request access to and a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict processing, (iv) to data portability where applicable, and (v) not to be subject to automated decision-making. You may also object to processing based on legitimate interests and withdraw consent at any time.

In the App you can exercise the most important rights yourself, at any time:

• Settings › Share anonymous usage statistics stops all statistics. Pending events are deleted.
• Settings › Delete my statistics deletes pending events and replaces the installation ID.
• Settings › Reset progress removes seals, streak and notes from your phone.
• iOS Settings › Sebak › Microphone withdraws or changes microphone access.
• iOS Settings › Apple Account › Subscriptions manages or cancels the subscription.

Because statistics and purchases are linked only to random IDs that we cannot connect to you, we normally cannot find records that belong to a particular person. If you would like us to act on past records, contact us and we will help as far as we are able.

If you are located in the UK and are unhappy with how we have handled your information, you can complain to us by e-mail at support@thecommercium.com or by post (see section 14). We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. If you are not happy with our final response, you can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you are located in the EEA, you may complain to your national data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

11. Do United States residents have specific privacy rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the right to know about, access, correct, obtain a copy of and delete the personal information we hold about you, and not to be discriminated against for exercising these rights.

Categories of personal information collected in the past twelve (12) months:

• A. Identifiers: YES. A random installation ID and a random purchase-service ID (online identifiers); the IP address of purchase-service connections.
• B. Personal information in the California Customer Records statute: NO
• C. Protected classification characteristics: NO
• D. Commercial information: YES. Subscription purchases and status.
• E. Biometric information: NO
• F. Internet or other similar network activity: YES. Interactions with the App (the usage events listed in section 1).
• G. Geolocation data: NO
• H. Audio, electronic, sensory or similar information: NO. Your recitation is processed on your device only; we do not receive it.
• I. Professional or employment-related information: NO
• J. Education information: NO
• K. Inferences drawn to create a profile: NO
• L. Sensitive personal information: NO

We have not sold personal information or shared it for targeted advertising in the preceding twelve (12) months, and we do not profile you. We disclose information only to our service providers RevenueCat, Inc. and Amplitude, Inc. for business purposes under written contracts.

To exercise your rights, e-mail support@thecommercium.com. You may use an authorised agent; we may ask for proof that the agent is validly authorised and may need to verify your request. If we decline to act on your request, you may appeal by e-mailing us; we will reply in writing with our reasons. If your appeal is denied, you may complain to your state attorney general. California residents may also request, once a year and free of charge, information under California Civil Code Section 1798.83 (“Shine The Light”); we do not disclose personal information to third parties for their direct marketing.

12. Do other regions have specific privacy rights?

Japan. We handle personal information in line with the Act on the Protection of Personal Information (APPI). Information shared with our providers in the United States is protected by contracts that require measures equivalent to the APPI. You may request disclosure, correction, suspension of use or deletion using the contact details below.

Australia and New Zealand. We process personal information in line with Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020. You may request access to or correction of your information using the contact details below, and complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Republic of South Africa. You may request access to or correction of your information using the contact details below. If you are unsatisfied with how we handle a complaint, you can contact the Information Regulator (South Africa): enquiries@inforegulator.org.za.

13. Do we make updates to this notice?

We may update this notice from time to time. The “Last updated” date at the top shows the latest version. If we make material changes, for example new kinds of data collection, we will update this page and, where appropriate, tell you in the App.

14. How can you contact us?

For privacy questions, contact our Data Protection Officer at michael@thecommercium.co.uk, or write to:

Commercium Limited
Data Protection Officer
14/2e Docklands Business Centre
10-16 Tiller Road
London, Tower Hamlets, E14 8PX
United Kingdom

Commercium Limited is registered in the United Kingdom under company registration number 16456125 and is the data controller of your personal information. App support: support@thecommercium.com · thecommercium.com.

15. How can you review, update or delete your data?

Your data is under your control in the App: Settings › Share anonymous usage statistics turns statistics off, Settings › Delete my statistics resets them, Settings › Reset progress clears your progress, and iOS Settings controls the microphone. For any other request about your personal information, e-mail support@thecommercium.com with the subject “Sebak privacy request”.