Privacy
Privacy notice
Sanabil is made for family reading time, so we collect as little as we can and explain the rest plainly. This notice tells you what we hold, why we hold it, how long we keep it, and what you can ask us to do.
About this notice
Sanabil is a storytelling service for families: a mobile app for iPhone and Android, and this website at sanabil.app, including the blog and the free web stories.
This notice covers the personal data we handle across both. Sanabil is operated from the United Arab Emirates, and where data-protection law applies to you we act as the controller of the data described here.
Who can use Sanabil
Account holders must be 15 or older. We ask for an age band when you sign up and do not open accounts below that age.
Sanabil is a general-audience service, not a children's app. Children enjoy Sanabil by reading and listening with the parent or guardian who holds the account. Children do not sign in and have no account of their own.
We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us data, write to us and we will remove it.
What we collect
- Account and sign-in details Your email address, and the identity token we receive when you sign in with Apple, Google or Facebook. We never see the password for those accounts.
- Your age band An age band and an adult-or-minor flag, taken at sign-up. Where a band is enough, we keep the band rather than your full date of birth.
- Child profiles An optional first name and age band for each child, so a story lands at the right level. Nothing more.
- Subscription and credits Your plan, your entitlement state, and the story credits you have earned or spent.
- Payment references The receipt and subscription identifiers returned to us by Apple, Google, Stripe or RevenueCat. Card numbers stay with those providers and never reach Sanabil.
- Stories and the choices behind them The language, age band, theme, moral and occasion you pick, and the stories and images created from them.
- Safety records Moderation decisions, withheld content, and anything you report to us.
- Consent and acceptance records Which version of this notice and of our terms you accepted, and when.
- Security and activity logs Sign-ins, entitlement and credit changes, deletions and data requests — recorded so we can keep the service secure and our accounts correct.
- Product analytics Aggregated, privacy-safe usage events, and only where you have agreed to them.
- Website data The essential cookies this site needs to work. Anything beyond essential is set only after you agree.
Why we use it, and on what basis
- To run the service you signed up for Creating your account, generating and storing stories, managing your subscription and credits. Our basis is the contract between us.
- To keep Sanabil safe Checking generated words and images, handling reports, and preventing fraud and abuse. Our basis is our legitimate interest in a safe service, and our legal duties.
- To meet legal duties Keeping financial, tax, consent and audit records for as long as the law requires. Our basis is legal obligation.
- To improve Sanabil, and to write to you Product analytics and any news we send. Our basis is your consent, which you can withdraw at any time without losing the service.
We do not sell your personal data, and we do not use it to build advertising profiles.
Stories, and how AI fits in
Sanabil writes stories and illustrations with an AI provider. The instructions we send are assembled from your choices — language, age band, theme, moral, occasion — not from who you are.
Your name, your email address and your child's name are never sent to that provider. A check runs before anything leaves Sanabil and rejects free-text personal details.
Every generated story and image passes a safety and values check before it reaches your reading space. When a check fails the story is withheld, and you are not charged for it.
We contract with our AI provider on terms that do not permit your content to be used to train their general models.
If you are between 15 and 17
Account holders under 18 are treated more protectively than the law's minimum:
- We rely only on our contract with you to run the service — never on consent-based extras.
- No behavioural tracking, no advertising SDKs, and no personalised marketing profiles.
- No marketing messages. You receive only the service messages the app needs to send.
- Your usage events are suppressed or stripped of identifiers before they reach analytics.
Children's data
- A child profile is deliberately small: a first name and an age band, and nothing else.
- Child profile data is never sent to our AI provider, and never appears in analytics or marketing.
- Notifications and emails go to the account holder, never to a child.
- Only you can see the child profiles on your account.
Who else handles your data
We work with a small set of providers. Each one is under contract, and each one only handles what its purpose needs:
- Identity providers Apple, Google and Facebook, to sign you in.
- Subscription platforms RevenueCat and Superwall, to manage entitlements and plans.
- Payment providers Apple, Google Play Billing and Stripe, to take payment and handle tax. They hold the card details; we do not.
- AI provider To generate story text and images from non-personal instructions.
- Messaging providers Apple and Google push services, and Azure Communication Services for email, to send you service messages.
- Hosting and analytics providers To run the service and to understand privacy-safe usage.
Where we keep it, and for how long
Your data is stored in a region with an adequate level of data protection, encrypted in transit and at rest.
We keep account data for as long as your account is open. When you delete your account we erase or anonymise your personal data within 30 days.
A few records are kept for longer because the law or child safety requires it — financial records, moderation decisions, consent records and security logs. Those are kept in a form that no longer identifies you.
Your rights
At any time you can ask us to:
- Show you what we hold and give you a machine-readable copy of it.
- Correct anything that is wrong or out of date.
- Delete your account and data from inside the app. We confirm it with you, sign you out everywhere, and finish within 30 days.
- Withdraw your consent to analytics or to news, without losing access to the service.
- Object to processing that rests on our legitimate interests.
Cookies on this website
This website sets the essential cookies it needs to work — remembering your language and keeping the site secure.
Anything beyond essential is set only after you agree, and you can change your choice at any time.
You can read the blog and the free web stories without an account.
How we protect your data
- Encrypted connections in transit, and encryption at rest for everything we store.
- Least-privilege access: you reach only your own data, and our own access is role-based and logged.
- Passwords are stored hashed, never in readable form, and sessions can be revoked.
- Personal data and secrets are kept out of application logs.
No service can promise perfect security. If a breach affects your data we will tell you and the relevant authority, as the law requires.
Changes to this notice
This notice is versioned. When we make a material change we will tell you in the app or by email, and record the version you accepted.
The version and date at the top of this page always describe the notice in force today.
Questions about your privacy?
Write to our privacy team. We verify that a request really comes from you, and we answer within 30 days. If our answer does not satisfy you, you can complain to your local data protection authority.
Email the privacy teamprivacy@sanabil.ae