Privacy Policy

If you never sign in: we collect analytics about how the site is used — pages viewed, approximate location derived from your IP address, browser and device type. This goes to Google Analytics.

If you sign in with Google: we receive your name, email address and profile picture from Google, and store them so your account exists. We never receive your Google password.

As you learn: we store your progress — lessons completed, quiz answers, vocabulary review schedule, XP, streak, gems, achievements, bookmarks and leaderboard position. This is the product; without it nothing would be saved between visits.

If you post or write in: messages you send in the community chat and any feedback you submit, along with the account that sent them.

If you subscribe to the weekly digest: your email address and the fact that you opted in.

If you donate: Stripe handles the payment. We never see or store your card details. We receive confirmation that a payment succeeded, its amount, and an order reference, which we use to mark you as a supporter.

To run your account and save your progress, to show leaderboards and the community chat, to send the digest if you asked for it, to record donations, and to understand which parts of the site are used so we know what to improve.

We do not sell your data. We do not use it for advertising. We do not build profiles for anyone else.

• Google — sign-in, and Google Analytics for usage statistics.
• Vercel — hosting. Standard server logs, including IP addresses.
• Stripe — payment processing for donations.
• Resend — sending the weekly digest email, if you subscribed.
• Other learners — your display name and XP appear on public leaderboards, and anything you post in the community chat is visible to other signed-in users.

A session cookie keeps you signed in. It is required — without it the site cannot tell who you are. Google Analytics also sets cookies to count visits.

Account and progress data is kept while your account exists. Delete your account and it is deleted with it. Analytics data follows Google’s retention settings. Donation records are kept as long as required for financial records.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it entirely, and we will do so. If you are in the UK, EU, or another region with data protection law, those rights apply to you by law — but we will honour these requests from anyone, wherever you are.

To exercise any of these, email salam@quroots.com.

QuRoots is suitable for all ages, but signing in requires a Google account, and Google sets its own minimum age. If you are a parent and believe a child has created an account you would like removed, email us and we will remove it.

If this policy changes in a way that materially affects you, we will say so on the site rather than quietly editing this page.