Privacy policy

Data we use and where it comes from

You provide your name, email and profile details, such as school, subject and stage. Password sign-in stores a derived password hash rather than the password text. If you choose Google or Microsoft sign-in, we receive the account identifier, name and available email from that provider. Sign-in does not grant access to Drive files or Classroom classes.

Connecting Google Drive (optional)

If you connect your Drive from «My evidence» or «Backup», we ask for one permission, drive.file: with it Tawak sees only what it creates in your Drive and what you pick yourself in the Google picker, and none of your other files. We use it for three things you ask for: saving each completed evidence as a PDF in its element folder inside the performance file folder, fetching the photo you pick to attach it to an evidence, and saving your backup in a private folder that is never shared. In «My Drive files» you pick files of any type from your Drive (photos, PDF, Word, slides, sheets, video); we keep only their description (ID, name, type, size, date and suggested element), not their content, except a photo you make an evidence photo, which is kept reduced like your other photos. When you open a file or its thumbnail we read it from your Drive and show it to you directly. We arrange evidence files in your Drive in a school-year folder with numbers in your order; moving and renaming them does not change their content. No folder is shared unless you press «Folder link from Drive» for a specific element; then anyone with that link can see that folder's files only. We keep the access key encrypted on our server and never send it to the browser, together with the Google account email and the IDs of the folders and files we created. You can disconnect from «My evidence» at any time: we revoke the key with Google and delete it, and your files stay in your Drive under your control. You can also remove the permission from your Google account settings.

Tawak's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Drive data for advertising or to train AI models, we do not sell it, and no one on our team reads it except with your explicit consent for specific support, as needed for security, or when legally required.

Reading a question-paper photo with AI (optional)

When this service is turned on and you choose “Read it accurately with AI” in “From my paper”, the question-paper photo you picked is shrunk on your device and sent to the connected AI provider (Anthropic, the provider of Claude, or OpenAI, the provider of GPT, when Claude is not connected), where it is processed outside Saudi Arabia under that provider’s commercial terms; the question text comes back to your device for you to review. We do not keep the photo or its text on our server; we keep only the number and size of readings, for usage limits. Nothing else from your account or your students’ data is sent, so photograph the question paper alone, not a student’s sheet. Reading on your device stays available at all times and sends nothing.

Writing evidence from a photo or your voice with AI (optional)

When this service is turned on and you tap “Write the report” in “My evidence”, the photos you picked for this piece of evidence (up to three, shrunk on your device) and what you typed or dictated, with your stage, subject and grade, are sent to the connected AI provider (Anthropic, the provider of Claude, or OpenAI, the provider of GPT, when Claude is not connected), where they are processed outside Saudi Arabia under that provider’s commercial terms; a draft report comes back for you to review before saving. Your name, your school’s name and your students’ names are not sent, so choose a photo of the activity, the board or students’ work rather than their faces. We do not keep the photos in this step; we keep the draft text for seven days only so a request is not repeated, and the number of requests for usage limits. Photos are stored in your private library only if you save the evidence. “From your voice” uses the dictation in your browser or your device keyboard (by its provider, such as Google or Apple), and Tawak receives only the text. “Help me” on a standard's page sends only the standard, your stage, subject and grade, and the lesson if you type one, and three ideas come back; we keep their text for seven days for the same reason, and an idea you keep “for my lesson” stays on your device. “Illustration” sends only the evidence title and its standard to Cloudflare's AI service to draw an image without people; we keep the image only if you keep it in your evidence, and it is printed marked “Illustration”. Adding evidence by hand stays available at all times and sends nothing.

AI lesson plans and kindergarten plans (optional)

When this service is turned on, “AI lesson plan” sends only the grade, subject and the topic you typed, and “Kindergarten plan” sends only the level, unit and day, to the connected AI provider (Anthropic, the provider of Claude, or OpenAI, the provider of GPT, or Cloudflare Workers AI as a fallback), where they are processed outside Saudi Arabia under that provider’s commercial terms. Your name, your school and your students are not sent. We keep the draft for seven days so the request is not repeated, and the number of requests for usage limits. A kindergarten day plan for a listed unit is kept in Tawak’s shared library so others get it without a new request; it is general text with no data about you, while what you edit and save stays in your own “My plans”.

Evidence barcodes (optional)

If you choose «A barcode per evidence» or «One barcode for the file» in «My evidence», Tawak creates a secret code for each barcode that opens a read-only page with your completed evidence (text and photos), your name, school and subject. Anyone who scans the barcode or has its link can see it, without signing in, and it is not shown in search engines. Drafts and deleted evidence never appear. If you attach files from «My Drive files» to a completed evidence, their names appear on the page and anyone with the barcode can open them: we read them from your Drive on request and show them, without making your Drive or the file public, and this stops with «No barcode» or when you remove the file from the evidence. Choosing «No barcode» stops every page at once, including barcodes already printed. Take care before turning it on if photos show students. The «Barcode» tool in My tools makes barcodes on your device; the link is not sent to us or saved.

Teaching and student data

You may add class and student names, attendance, assessments, grades, plans, reports, attachments, photos, messages and suggestions. These come from your entries or selected files; a plan is not evidence of an outcome or completed work. Use only data you are authorised to provide, and limit student details and photos to the task. The service does not ask for student identity numbers or health information.

Purposes and basis of processing

We process data to provide accounts, save your work, carry out requested recording, analysis, export and communication, secure sessions, resolve faults and support requests, and administer subscriptions. This relates to delivering the requested service and its obligations, consent where appropriate for an optional feature, and protecting the service within applicable limits. A teacher entering student data does not automatically establish consent for Tawak; the teacher or responsible organisation must establish the authority relevant to its situation.

Sessions and device storage

We use essential session and security cookies and browser storage for preferences such as language, drafts and selected tools. Teacher sessions are designed to last up to seven days unless ended or revoked. "Continue as a guest" sets one cookie holding only the visit start time: it allows 30 minutes of browsing and stays for a day so the same browser cannot start another visit. No account is created and nothing is saved for a guest. Some lesson tools work on the device; do not assume their data is saved to your account. Disabling storage can affect features. On a shared device, sign out and protect your data.

Sharing, service providers and processing location

Access to account data follows permissions. Operational access is limited to administration, support and security needs. Messages and files you choose to share go to your selected recipients, and downloaded copies are under your control. Tawak currently uses Render to host the application and database in Frankfurt, Germany, so the service involves processing outside Saudi Arabia. Support sent to Gmail is also handled through Google. We use Sentry in the United States for technical error reports: it receives the error type, where it happened in the code, and the screen it happened on, after removing any email, numbers, or identifiers, without your name, your content, or your students’ data. We do not claim Saudi hosting or completion of an independent transfer assessment. In the current setup, we do not sell data or use it for AI model training or advertising targeting. Satrin’s ownership does not automatically share Tawak data with its other applications; Tawak is operationally independent. We may disclose necessary information in response to a binding lawful request.

Protection, retention and deletion

We use HTTPS, identity and permission checks, account isolation and password hashes to protect the service. Data is processed while needed for the account, service and related lawful purposes. Versions, security logs and backups may persist according to operational needs and legal requirements; deletion from all copies is not promised to be immediate. Deletion requests are reviewed manually, with the actionable scope and any required retention explained. This policy does not claim end-to-end messaging encryption or an absolute guarantee against data loss.

Your rights and privacy requests

Subject to applicable rules and exceptions, you can request information about processing, access and a copy of your data, correction or destruction, and withdrawal of consent where consent is the processing basis. Send the request type and account email to satrinstore@gmail.com initially; do not send passwords or unnecessary student data. We verify the requester proportionately and explain the result or why a request cannot be fulfilled. You may also complain through the official channels of the competent Saudi personal data protection authority.

Policy updates

We update this page when practices change and show the update date. Material changes are communicated through the application as appropriate. Review the policy before adding new data or sharing files.