Privacy Policy

Version 2026-09-26. Tibixa is run by TIBA SOLUTIONS (طيبة للحلول الذكية), commercial register no. 206511, Cairo Investment Commercial Registry Office, 25, 23 July Street, Banha, Qalyubia, Egypt, which decides how the data described here is used (the "controller"). Questions and requests: [email protected] or the contact form.

What we store, and why

• Your account: name, email address, a hashed password (we cannot read it), country, month and year of birth, the version of the terms you accepted, and when you last signed in. Why: to run your account (contract), and country and age to apply the rules for young people and for purchases (legal obligation).
• Learning records: lessons opened and finished, answers to quizzes, exercises and in-video questions, practice test scores, skill levels, study time per day, and feedback you choose to give. Why: to run the courses, show your progress and adapt practice to you (contract).
• Parents and students: which parent follows which student, a parent's approval of a young student's account (with the text version and time), and profiles a parent creates for younger learners (first name, grade, avatar, hashed PIN; no email). Why: parental consent where the law requires it, and to show progress to the parent (consent, legal obligation).
• Plans and payments: the plan, its status and dates, amounts and tax, and who paid. Card details are never stored by us: Paddle stores them. Why: to give access and keep accounting records (contract, legal obligation).
• Emails we sent (recipient, subject, delivered or not) for 90 days, to fix delivery problems (legitimate interest).
• In your browser: one session cookie that keeps you signed in, and in local storage your light or dark choice, player settings and, for guests, your progress. These are strictly necessary or your own preferences; we use no advertising or tracking cookies.

Young people

Students below the age at which the law of their country lets them agree to the use of their data alone (13 to 18 depending on the country; 18 in Egypt and several other countries) can use their account only after a parent or legal guardian approves it by email. Until then we store only what the student entered to sign up, and delete it after 30 days if nobody approves. Younger learners use a profile their parent creates. A parent who approved or follows a student sees their progress and can ask us to download or delete the student's data.

Who else receives data

• Paddle.com (payments): as Merchant of Record it receives your name, email, country and payment details when you buy a plan, and handles them under its own privacy policy.
• Our email provider delivers account emails (approvals, password resets, renewal reminders, weekly reports): it receives the recipient address and the message.
• YouTube (Google) plays some lesson videos; it may set its own cookies when a video plays. Other videos come from our cloud storage (Cloudflare) through a temporary link, without cookies.
• Cloudflare carries all traffic to the site (security and speed) and stores lesson videos.
• AI providers (for example Anthropic, OpenRouter, Google) receive lesson material to write and check courses. Learners' written feedback may be sent to summarise it for the course team, without names or emails.
• Google and Microsoft, when you choose "Continue with Google" or "Continue with Microsoft": they confirm who you are and give us your name, email address and an account number for this site. We ask for nothing else from them (no contacts, files or mail). You can remove the link on My account.
• For course creators who connect a YouTube channel: see "Course creators" below.
• We do not sell personal data, do not share it for advertising, and show no ads.

Where the data is

Our servers are in Egypt; the services above may process data in other countries, including the United States and the European Union. Where the law requires it, transfers are covered by the safeguards those providers offer (for example the EU standard contractual clauses).

How long we keep it

• Your account and learning records: until you delete the account (or ask us to). Accounts waiting for a parent's approval: 30 days.
• Payment records: as long as tax and accounting law requires (up to 10 years), without your name once your account is deleted.
• Consent records: as long as needed to show the consent was given.

Your rights

Depending on where you live (for example under the GDPR in Europe, the UK GDPR, Egypt's Personal Data Protection Law, Saudi Arabia's PDPL, California's CCPA), you can ask to see, correct, download or delete your data, restrict or object to its use, and withdraw a consent. Two of these you can do yourself at any time on My account: download your data and delete your account. For anything else write to us; we answer within 30 days. You can also complain to the data protection authority of your country.

Course creators

• AI provider keys you add are stored encrypted and used only to run your own Studio jobs.
• YouTube channel connection: when you click "Connect YouTube channel", Google asks your permission for this site to manage your YouTube account. We keep your channel's name and id and an encrypted access token, and use them only to upload the videos of your own courses to your channel (unlisted, with playlists) when you ask. We do not read, change or delete anything else on your channel.
• This site uses the YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your data follows the Google Privacy Policy. You can withdraw the access at any time: "Disconnect" on My account, YouTube channel, or at myaccount.google.com/permissions.

Security

Passwords and PINs are stored only as hashes, keys and tokens are encrypted, the site is served over HTTPS, and payment cards never reach our servers. If a breach affecting your data happens, we tell you and the authorities as the law requires.

Changes

If we change this policy in a way that matters, we tell you on the site or by email before it applies.