Privacy Policy

Effective date: 17 April 2026 · Last updated: 17 April 2026

1. Who we are

"99 Names" (the "App") is operated by Tawakel Ltd, a company registered in England and Wales. Our registered address is 20–22 Wenlock Road, London, N1 7GU, United Kingdom. In this policy, "we", "us" and "our" refer to Tawakel Ltd. "You" refers to anyone who uses the App.

For privacy questions, contact us at support@99namesapp.com. For the purposes of the UK GDPR, Tawakel Ltd is the data controller of your personal data.

2. What we collect and why

2.1 Information you give us directly

• Account details: first name, last name, email address, chosen username, and password (stored hashed, never in plain text). We use these to create your account, sign you in, and address you personally.
• Age confirmation: a checkbox confirming you are 13 years or older. We do not collect your date of birth.
• Preferred language: used to show content in your language.
• Optional social sign-in: if you sign in with Apple or Google, we receive a verified email and a stable unique identifier from that provider. We do not receive your social contacts or other profile information.
• Feedback you send us: if you submit a bug report, suggestion, or message through the in-app feedback form, we store the text you send and associate it with your account so we can reply.

2.2 Information generated as you use the App

• Learning progress: which Names you've seen, how you answered review cards, your spaced-repetition schedule, quiz scores, and assessment results.
• Gamification data: your streak, XP, level, unlocked achievements, and multiplayer match history.
• App events (analytics): which screens you visit and which features you use, so we can understand what's working and what needs improvement. You can turn this off in Settings.
• Technical logs: crash reports and error traces, to diagnose problems. These do not include the content of your messages or your password.

2.3 What we do not collect

• Your date of birth.
• Your precise or approximate location.
• Your photos, camera, microphone, or contacts.
• Health, fitness, or financial data.
• Advertising identifiers. We do not serve ads and do not track you across other apps.

3. Legal bases for processing (UK/EU users)

Under the UK GDPR and EU GDPR, we process your personal data under the following legal bases:

• Contract: to create and run your account and provide the learning features you ask for.
• Legitimate interests: to keep the service secure, prevent abuse, fix bugs, and improve the App. We balance these interests against your rights and only collect what's needed.
• Consent: for optional analytics. You can withdraw this at any time from Settings.
• Legal obligation: where we're required to retain certain records (for example, tax records related to donations).

4. How we share your data

We do not sell your personal data. We share it only with the service providers we need to run the App:

• Supabase (Supabase Inc., data hosted in the EU — Frankfurt / eu-central-1). Provides our database, authentication, and real-time features. Your account and progress live here.
• Mixpanel (Mixpanel, Inc.). Provides product analytics. Only pseudonymous event data — not your password or the text of your feedback — is sent. You can opt out from Settings.
• RevenueCat (RevenueCat, Inc.). Manages donation/subscription receipts from the Apple App Store and Google Play, if you choose to donate. We do not receive or store your payment card details.
• Apple and Google, if you use Sign in with Apple or Google, or if you donate through the App Store or Play Store. Payments are handled entirely by them under their own privacy policies.
• Expo / Sentry-style crash reporting for diagnostic error logs.
• Legal or safety recipients, where we are required by law, or where it's necessary to investigate fraud, enforce our Terms of Service, or protect the rights and safety of our users.

Each of these providers is contractually bound to process your data only on our instructions and to keep it secure.

5. International data transfers

Our primary database is hosted in the European Union. Some of our service providers (for example, Mixpanel and RevenueCat) are based in the United States. When data is transferred outside the UK/EU, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where applicable.

6. How long we keep your data

• Account data & learning progress: retained for as long as your account is active.
• After account deletion: we delete or anonymise your personal data within 30 days of your deletion request, except where we are required to keep certain records (e.g. donation/tax records) for up to 7 years.
• Analytics events: retained for up to 24 months in Mixpanel, after which they are aggregated or deleted.
• Crash & error logs: retained for up to 90 days.

7. Your rights

Depending on where you live, you have the following rights over your personal data:

• Access — ask for a copy of the data we hold about you.
• Correction — ask us to fix data that's wrong or incomplete.
• Deletion — ask us to delete your account and data. You can also do this yourself in Settings → Delete account.
• Portability — ask for an export of your data in a machine-readable format.
• Objection & restriction — object to, or ask us to limit, certain processing (for example, analytics).
• Withdraw consent — where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, email support@99namesapp.com. We'll respond within 30 days. If you believe we've mishandled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local EU data protection authority.

8. Security

We protect your data with encryption in transit (TLS) and at rest, hashed passwords, least-privilege access controls, and regular dependency updates. No system is perfectly secure, but we take your trust seriously and will notify you of any data breach affecting your personal data within 72 hours where required by law.

9. Children's privacy

99 Names is not directed at children under 13. During sign-up, we ask you to confirm you are 13 or older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account and its data promptly. For parents of children aged 13–17 in the UK/EU, you may contact us to exercise rights on your child's behalf.

10. Donations

Donations are processed by Apple (App Store) or Google (Play Store), not by us directly. We receive only the receipt confirming the donation — we never see your payment card, billing address, or other financial details. Of every donation received, 50% is forwarded to registered charitable causes and 50% supports the development team that maintains the App.

11. Cookies & tracking

The App itself does not use browser cookies. This website uses only essential cookies needed to serve the pages. We do not use advertising or cross-site tracking cookies.

12. Changes to this policy

If we make material changes, we will update the "Last updated" date at the top of this page and notify you in the App before the change takes effect. Continued use of the App after an update means you accept the revised policy.

13. Contact

Tawakel Ltd
20–22 Wenlock Road, London, N1 7GU, United Kingdom
support@99namesapp.com