Privacy Policy

Effective date: 3 November 2026.

This policy explains in brief what data Jalees collects, why, who receives it, how long we keep it, and what parents can do with it. It applies to the Jalees app and website, in every country where they are offered.

Jalees is a collection of illustrated Arabic stories for reading with children. A parent or guardian sets it up and manages it, and the account is theirs, not the children's.

For more detail on any point, download the detailed version of this policy (PDF) at the end of this page.

Who we are

Jalees is a product operated by Elementum Company For Technologies, a Saudi limited liability company, Unified National Number 7054945469.

"We" means Elementum Company For Technologies as the operator and data controller, and "you" means the parent or guardian using Jalees with their children.

Corporate website: elementum.com.sa. Contact for privacy and support: jalees_support@elementum.com.sa.

Back to contents

In short

Jalees has no ads or advertising trackers, and we do not sell or rent data.
Without an account, the children's profiles and reading stay on the device and never reach us.
With a family account, we keep the children's data only after a parent agrees, so that their reading appears on every device of the family.
Usage statistics stay off until a parent turns them on.
The card number and security code never reach us: the store or our payment provider handles payment.
A parent can get a copy of the family's data, remove a child, or delete the whole account at any time.

Back to contents

What data we collect

Without an account, the app keeps the children's names, ages and avatars, and their reading, on the device only, and sends none of it to us. To check that its version still works, it sends our server only the system (iOS or Android) and the app version.

With a family account, which is optional, we keep:

Sign-in: an email address and a phone number if you choose to add one. You can create an account by confirming your email alone, without WhatsApp. If you start with a WhatsApp code, we ask for your email after you confirm the number; verify the email now or later from the account page. A verified email is needed to start the free trial or pay on the website. A detail added without confirmation stays "unverified". An unverified detail is never used to sign in, and we send it nothing but its own confirmation code. An optional password is available. Where the app for iPhone and iPad offers Sign in with Apple, we ask Apple only for the email address, which may be a relay address Apple creates to hide yours. Each account has an internal identifier.
each child's profile: the name you type (a nickname is enough), the age (3 to 12) and an avatar from the app's drawings. We do not ask for children's photos or dates of birth;
reading: the position in each story, finished stories, answers to the end-of-story questions, and reading days (pages and time for each day);
the parent's consent record, and a one-way fingerprint of the parent PIN, never the PIN itself;
subscription records that link a purchase to the account and let us verify it;
the reports and questions you send us, with their replies, the app version and the device's system;
website favourites.

Only when a parent turns sharing on does the app also send usage statistics (counts and times for the device as a whole, with no name and nothing about any one child) and story likes, each with a random identifier that we do not link to the family account. Your view of the app (a rating and an optional comment), if you choose to send it, carries no identifier.

Two options in the app are off until a parent turns them on for a device, and stay on that device only: fingerprint or face unlock, where the device's own system checks the fingerprint or face and the app learns only whether the check passed; and the reading reminder, which needs the device's notification permission. Nothing about either is sent to us, and both are cleared when that device signs out of the account, when "Erase this device's data" is used, and when the account is deleted. The "one-way fingerprints" on this page are values computed from a PIN or an identifier, not anyone's fingerprint.

Like any connection, each request carries an IP address. The Jalees server does not record it, but our hosting provider's operating logs may keep it for 14 days, and the sign-in service keeps it, and a description of the app or browser, with sign-in sessions. For the stories the app downloads, those logs may also keep each request's path, which names the story or file. If you email us, we receive your message and your email address.

On the website, we count visits to its pages without cookies, as "The Jalees website" explains.

We do not collect the device's location, contacts, photos, voice recordings, the advertising identifier or the identifiers the device's system provides. The app sends no crash reports to us; Apple or Google may share crash data with us when the device's owner chose that in its settings.

Payments: the App Store or Google Play handles app purchases, and our payment provider handles website payments. Card details go directly to them, and the card number and security code never reach our server or our records. For website subscriptions we keep payment records and an encrypted payment token from the payment provider, to renew the plan you agreed to until you cancel.

After the first successful website payment and each paid renewal, we send the parent account's verified email address a confirmation with the plan, amount, currency, payment time, paid period end and payment reference, with no card details or marketing. The pending message record holds no extra copy of your email address or card details.

Paying on the website requires a confirmed email address because payment confirmations are sent there. We do not send payment confirmations to an unverified email.

When you request a website promotion, we keep the promotion code, quote and usage reservation, plan, percentage discount, charge, discount and normal renewal amounts, dates and redemption state with the family account, to calculate the eligible price, verify purchases and prevent repeated use. Promotion records are included in the family data export and deleted with the account.

Back to contents

The free family trial

If a parent chooses to start the family trial, we keep its start and end dates and state with the account, to open the same stories on the website and in the app until the 14 days end or the parent chooses to replace it with a paid subscription. No card, payment or automatic-renewal consent is created when starting the trial. Trial information is included in the family data export.

Starting the family trial requires a confirmed email address, including after WhatsApp sign-in. Confirming the email does not start the 14 days; they begin when you choose to start the trial afterward.

To prevent another family trial after deleting an account and registering again with the same verified email, after deletion we retain only a keyed one-way email fingerprint, its key identifier, and the trial start and end dates. This record contains no email address, account identifier, child data or card details. We retain it while we operate the one-trial-per-email offer, then delete it when no longer needed. You can contact us about this record and your rights over it.

Back to contents

Why we use the data

to provide the service: signing in, keeping each child's reading and syncing it across the family's devices, the parents' "Reading summary", and website favourites;
to decide which stories open, and to verify the subscription with the store or the payment provider;
to email the parent account's verified address a website payment confirmation after the first successful payment and each paid renewal;
to answer reports and questions, and to email you about them;
to run the service, fix faults and prevent misuse;
to improve the app, from the optional usage statistics and the views you send;
to learn how the website is used, from counting visits to its pages.

We do not use data for advertising, to build marketing profiles or to train artificial intelligence models, and we make no automated decisions about you with it.

In Saudi Arabia, we rely on the guardian's consent to keep children's data, on consent for the optional statistics and likes, on performing the service you asked for (sign-in, the subscription and support), on our legitimate interest in preventing misuse and in counting the website's visits where the law allows it, and on legal obligations where they apply.

Back to contents

Children's data and the parents' role

The account belongs to a parent or guardian. The app asks a child for no personal information, and it has no chat, no public page and no sharing between families.
Before the family account keeps anything about the children, a parent agrees to it once in the app, and our servers accept no child before that consent. To withdraw it, remove the child or the account in the parent area, or write to us.
In the app, the parent area, the subscription and the settings are behind the parent PIN (or a fingerprint or face saved on the device, where a parent turned that on for it), and a child sees no price there and cannot buy.
The "Reading summary" is for parents only, one child at a time, with no ranking or comparison.
If you learn that a child has sent us data without a parent's knowledge, write to jalees_support@elementum.com.sa and we will delete it.

Back to contents

Where data is kept and when it is deleted

Our service providers keep account data and the website's visit statistics on servers outside Saudi Arabia, so they are processed outside the Kingdom and may be processed outside your country. The detailed version (PDF) gives the places.

How long we keep it:

account, children and reading data, subscription records and website favourites: for as long as the account exists;
The email address, phone number and any unverified contact detail remain while the account exists and are removed from the sign-in service when the account is deleted. Copies may remain in logs and backups for the periods described here. WhatsApp and Meta retain delivery records and copies under their own policies; deleting a Jalees account does not remove messages from your WhatsApp conversation.
reports and replies: until you delete them or the account; our internal log then keeps only the report's number, its reason, whether it was about a story, and its history, never your comment, the replies or the contact email;
usage statistics: at most 400 days; story likes: 180 days; your views of the app: at most 2 years;
operating logs, which may hold an IP address: 14 days;
the website's visit statistics, with no IP address or browser description: for as long as we use the visit-counting service;
copies of the emails we send, including website payment confirmations: 30 days at our email provider, then up to 7 days more in its backups;
copies of your emails and of report alerts in the support team's mailbox: kept apart from the account and not deleted automatically with it, until you ask us to delete them;
database backups: up to 97 days for our weekly backups, and our database provider's own backups as its plan sets.

When the account is deleted, the family's data is deleted, then the sign-in account, and some of it remains afterwards, as "Deleting the account and its data" explains.

Back to contents

Your choices and rights

From the parent area of the app, a parent can:

see each child's "Reading summary";
change a child's profile, or remove the child with their data;
get a copy of the family's data as a file (JSON);
delete reports and questions with their replies;
erase this device's data, and sign out;
turn off sharing of usage statistics, which deletes the usage statistics and story likes we received from this device;
delete the whole account.

In Saudi Arabia, you have the right to know why and on what basis your data is collected, to access it and get a copy, to request its correction, completion or updating, to request the destruction of data no longer needed, and to withdraw your consent. Write to jalees_support@elementum.com.sa; we answer within 30 days, which may extend by up to 30 more days in the cases the regulations allow, with notice to you.

Families outside the Kingdom also have the rights their own countries' laws give them; write to jalees_support@elementum.com.sa to use those rights, and we will answer as those laws require.

Back to contents

Deleting the account and its data

This section is for the Jalees app, called Jalees Kids on Google Play («جليس: قصص عربية مصوّرة للأطفال» on its Arabic listing), and for the Jalees website, both from Elementum Company For Technologies, the developer Google Play shows as "Elementum Tech." (see "Who we are"). A parent can delete the family account, and the children's data in it, at any time:

In the app: open the parent area, then "Family account and sync", then "Delete family account". Before deleting, the app may ask you to confirm your sign-in with a new code sent by email or on WhatsApp to the number linked to the account, or with Apple for an account that signs in with Apple.
Without the app: write to jalees_support@elementum.com.sa and identify the email or phone number linked to the account to request deletion. Do not send a sign-in code. We check that the request comes from the account holder, asking only for what is needed to verify control of the sign-in method, then delete the account as set out below. You can also install the app again and delete the account from the parent area.

What is deleted: everything we hold for the family, including the children, their reading, answers and reading days, reports and replies, subscription records, website favourites and payment records, payment confirmations waiting to be sent, the parent PIN and the consent record; then the sign-in account itself.

What remains for a time after deletion:

website campaign usage totals, without the deleted family's identifiers: retained to manage campaign limits;
database backups, until each expires: up to 97 days for our weekly backups, and our database provider's own backups as its plan sets;
the sign-in service's log of sign-ins, for the log period of our database provider's plan;
the hosting provider's request logs, which may hold an IP address: 14 days;
copies of the emails we sent through our email provider (sign-in codes, support emails and website payment confirmations to the account's address), with their delivery records: 30 days, then up to 7 days more in its backups;
usage statistics and story likes a device sent, which are not linked to the account, so we cannot find them through it: at most 400 days for the statistics and 180 days for likes, unless they were deleted from that device first;
copies of your emails and of report alerts in the support team's mailbox, until you ask us to delete them;
a one-way fingerprint of the account identifier, which stops an old device recreating the account, and our internal operations log, which refers to that fingerprint instead of the identifier;
and the records the stores and our payment provider keep under their own policies.

Deleting the account does not cancel a subscription with Google Play or the App Store; cancel it in the store's settings (in Google Play: your profile picture, then Payments & subscriptions, then Subscriptions). To delete some data without deleting the account, see "Your choices and rights".

Back to contents

How we look after data

Connections to our servers are encrypted (HTTPS).
The database's access rules are designed to keep each family's data apart from every other family's.
The parent PIN is kept only as a one-way fingerprint, and after repeated wrong attempts it is not accepted for a while.
In the app, the sign-in session on the device is kept in the system's encrypted storage.
The Jalees team reaches reports only through specific roles, and its actions in the team's tool are recorded in an internal log; direct database access is limited to the operators who need it to run and repair the service.

No system is free of risk. If an incident affects your data, we will notify you and the competent authorities as the law requires.

Back to contents

The Jalees website

The website uses only the cookies needed for sign-in, managing the session and verifying account requests, and has no advertising trackers. Favourites are saved to the family account; website reading and quizzes are practice only and are not saved as a child's progress. Our hosting provider's operating logs may keep IP addresses and request paths for 14 days.

We count visits to the website's pages to learn how much it is visited, which pages are opened and where visitors come from, without cookies and without storing anything in the browser. When a page we count is opened, the website's server sends our visit-counting service: the page's address, with only the link's campaign tags, if it has any; the site the visitor came from; the browser's description; and the visitor's IP address. The service uses the IP address to estimate the country, region and city, and the browser's description to tell the browser, operating system and kind of device; with both it counts each visitor once a day, using a value that changes every 24 hours, and then keeps neither. We do not count the privacy policy and terms of use pages, the copies of the website's pages that the app opens, or visits from a browser that sends a Global Privacy Control or Do Not Track signal.

Back to contents

Changes to this policy

If we change this policy, we publish the new version here with its effective date, tell you in the app or website before any material change, and ask for consent where applicable law requires it.

Back to contents

Contact

Elementum Company For Technologies

Saudi Arabia

For privacy enquiries and rights requests: jalees_support@elementum.com.sa. Please do not send passwords, sign-in codes or unnecessary details about children.

Back to contents

jalees_support@elementum.com.sa · Support

Download the detailed privacy policy (PDF)

The detailed version has more on every point, including where data is kept.