Privacy Policy

Effective and last updated: 6 September 2026

Ustadhy (“Ustadhy”, “we”, “us”) helps adult learners and adult parents or guardians discover teachers and communicate with them. This policy applies to the Ustadhy mobile application and related support services.

Data we collect

• Account data: name, email address, authentication identifiers, language and account role.
• Profile data: profile photo, country, city, age confirmation, teaching qualifications, certificates, subjects, languages, availability and pricing preferences.
• User content: teacher videos, messages, ratings, reports, saved teachers and matching requests.
• Location: approximate or device-provided location only after permission, used to suggest country, city, time zone and display currency. Users may enter these values manually.
• Purchase data: product identifier, purchase token, entitlement, purchase status and fraud-prevention records. We do not receive full payment-card details.
• Technical data: push-notification token, app interactions, installation identifiers, diagnostics, crash logs, device model, operating-system version and network metadata.

Why we use data

We use data to create and secure accounts, review teacher profiles and content, provide discovery, matching, booking, lesson reminders, one-to-one live classrooms, lesson reports and messaging, process purchases and entitlements, prevent fraud and abuse, respond to support requests, measure product performance and diagnose technical failures.

During an active lesson, camera video, microphone audio and a user-initiated screen or application share may be transmitted to the other lesson participant through Ustadhy's hosted real-time classroom service. Live media is not recorded or stored by default. A teacher may explicitly share a classroom file or web address; shared files and lesson state are stored so the participants can view the lesson content. Android overlay access is used only for the teacher's movable annotation toolbar during an active screen share.

Service providers and disclosure

We use Apple, Google and Firebase services including Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Apple Push Notification service (APNs), App Check with App Attest or Play Integrity, Sign in with Apple, Google Sign-In, StoreKit and Google Play Billing. We also use a hosted real-time classroom provider, device geocoding, an exchange-rate provider and an email-delivery provider. Providers process only the data needed to supply their services under their applicable terms and are required to protect it consistently with this policy and applicable law. Approved teacher profile information is visible to signed-in users. Learner profile information is limited to the learner and authorized administrators, and is disclosed to a selected teacher only after contact is opened.

We do not sell personal data or use it for cross-app advertising tracking. Analytics and Crashlytics are off by default, require the user's optional consent, and can be disabled at any time in profile settings. We may disclose limited data when required by law, to protect users, investigate fraud or abuse, or complete a business transaction subject to appropriate safeguards.

Security and international processing

Data is encrypted in transit using HTTPS/TLS. We use access controls, Firebase Security Rules, role-based administration, App Attest or Play Integrity through App Check, and server-side App Store or Google Play purchase verification. No system is completely secure. Apple, Google and other providers may process data outside the user’s country under their contractual and legal safeguards.

Retention and deletion

Active account data is retained while the account is used. When an account is deleted, the account, profiles, uploaded media, conversations, messages, matching requests, notification tokens and user-controlled records are deleted or de-identified. Security reports and moderation records may be de-identified and retained for up to 24 months to prevent repeat abuse. Purchase and fraud-prevention records may be de-identified and retained for up to seven years where needed for accounting, disputes, fraud prevention or legal obligations. Backups expire through the provider’s normal retention cycle.

Users can delete their account inside the app under My profile → Delete account permanently, or start an external request at myustadh.com/delete-account.

Choices and rights

Users may edit their profile, choose a display currency manually, decline location and notification permissions, block or report users, opt in or out of analytics and crash reporting at any time, and request access, correction or deletion subject to applicable law.

Adults and children

Account holders must be at least 18 years old. A parent or guardian may use an adult-owned account to find a teacher for a child. Children do not receive independent accounts and must not use messaging or provide personal data directly.

Contact

Privacy enquiries: support@myustadh.com
General support: support@myustadh.com
Published policy site: myustadh.com