Privacy policy

1. Who we are and who is responsible

1.1. This policy is published by Kyan Oberas, sole proprietor operating as Oberas Co (Ontario BIN 1001234697), referred to here as "we", "us" or "Oberas Co". We run two brands: DeenWell (films, the DeenWell app, the DeenWell Media Academy and the DeenWell Network) and Oberas Co (Kyan Oberas's own content).

1.2. Accountable person (Privacy Officer): Kyan Oberas. Contact: To confirm: privacy contact email and mailing address. The live app policy uses oberasco@gmail.com; a business mailing address is not recorded anywhere in the vault.

1.3. We are responsible for personal information in our control, including information we pass to service providers to process for us (PIPEDA, Schedule 1, Principle 4.1).

2. What this policy covers

2.1. This policy covers personal information we collect through:

(a) our websites, including deenwell.org and its pages such as /watch and /studio;
(b) the DeenWell app for iOS and Android (com.deenwell.app);
(c) our email lists;
(d) gifts made to us through LaunchGood, through our Stripe donation page, or through Buy Me a Coffee;
(e) the DeenWell Media Academy on Skool;
(f) Instagram direct messages sent through our ManyChat automations on @oberasco;
(g) our social media accounts (YouTube, Instagram, TikTok) where you interact with us; and
(h) anyone who works with us, such as creators who submit films, contractors and sponsors, to the extent their information is not covered by a separate agreement.

2.2. It does not cover websites and platforms run by others (for example LaunchGood, Skool, Instagram, YouTube, Apple and Google). Their own privacy policies apply when you use them.

3. What we collect, why, and on what basis

We collect only what we need for the purposes below (Principle 4.4, limiting collection). We tell you the purpose at or before the time we collect (Principle 4.2).

3.1 Website

What: To confirm: whether deenwell.org runs any analytics, cookies or tracking pixels. Nothing in the vault records one. The site is static and served from Firebase Hosting, per the internal notes, 24 September 2026. Firebase Hosting, like any web host, receives your IP address and browser details when it serves a page.
Later: a pop-up to join our email list is planned. When it goes live, section 3.3 applies to it.
Why: to show you the site and keep it running and secure.

3.2 The DeenWell app

You can use the app as a guest without an account. In guest mode your progress and settings stay on your device and are not sent to us.

If you sign in (with Google, Apple or email), we collect and store, through Google Firebase:

Information	Why we collect it
Email address and display name	To create and manage your account
A unique user ID (Firebase UID)	To link your synced data to your account
Your app activity, synced to your account: progress, streak, bookmarks, history of what you opened and when, favourites, onboarding answers, Quran listening progress, ritual stats, comics progress, feedback reactions inside the app, best Endless Quiz score and founding-reader status	To back up your progress and sync it across your devices

Other things the app does:

Endless Quiz leaderboard. If you post a score, your chosen name, your best score and the time it was set are shown to everyone who uses the leaderboard. Use a name you are happy to have public.
Send feedback. If you send feedback, we receive your message, its type and subject, the email you give us, your user ID, the app version, your device platform, and a screenshot if you choose to attach one. We use it only to answer you and improve the app.
Purchases. If the app offers paid features (DeenWell Plus), payment is handled by Apple or Google, and RevenueCat tells us whether your subscription is active. We never see your card details.
Donations. The app's donate links open our donation page in your web browser. Section 3.4 applies.
Reminders. Daily reminders are scheduled on your device. We do not receive a notification token.
Voice recall prompts. If you record an answer to an "in your own words" prompt, it is not saved or sent to us.

The app has no advertising and no third-party analytics or advertising SDKs. To confirm: re-check the app's dependency list before each release. As read on 24 October 2026, the internal notes carries Firebase Auth, Cloud Firestore, Google and Apple sign-in and RevenueCat, and no analytics package.

Source for this section: the Firestore rules map in the internal notes, read from firestore.rules on 7 September 2026, and the app's dependency list.

3.3 Email lists

What: your email address, your name if you give it, where and when you signed up, and the wording you agreed to.
Why: to send you news about our films, the Academy and ways to support the work, but only if you have agreed to receive them, or where Canada's Anti-Spam Legislation (CASL) otherwise allows. How we get and record that agreement, and how you unsubscribe, is in our email consent procedure (DW-LGL-CO-011).
We do not add you to a marketing list just because you created an app account, gave a gift, or messaged us, unless you agreed at that point or the law allows it.
Email service: To confirm: which email platform we use. None is recorded in the vault.

3.4 Gifts (sadaqah) and donors

Where gifts are made: LaunchGood (our campaign at launchgood.com/oberasco), our Stripe donation page linked from deenwell.org and the app, and Buy Me a Coffee for Oberas Co. Each platform collects your payment details itself. We never see or store your full card number.
What we receive: from each platform, the information it shares with campaign owners, which can include your name, email address, the amount, the date, any message you write, and whether you asked to stay anonymous. To confirm: exactly which donor fields LaunchGood, Stripe and Buy Me a Coffee pass to us, and whether LaunchGood donors agree to be contacted by the campaign owner.
Dedications. If you dedicate a gift "in memory of" or "in honour of" someone, we collect that person's name and the wording you choose, so we can put it on the film credits or our supporters' page as described in our Give page terms (DW-LGL-FIN-001). The dedication is public by design. Only give a name you have the right to share.
Why: to process and record your gift, to thank you, to deliver the credit or dedication you chose, to keep the financial records the law requires, and to answer questions or refund requests.
Supporters' wall and credits. We only publish your name if you chose a credit or dedication, and we show it exactly as you asked. You can ask us to remove or change it for future films and for the web page at any time. A film that has already been released cannot always be changed.

3.5 DeenWell Media Academy (Skool)

The Academy runs on Skool, which collects your account details and processes your payment. Skool's privacy policy applies to what it collects.
What we see: your Skool profile name and photo, your email address, your membership status and plan, your posts, comments and course progress inside the community, and anything you submit for review, such as a film. To confirm: what member data Skool shares with community owners.
Why: to run your membership, teach you, review your work, and answer you.
Your films. If you submit a film to the DeenWell Network, its use is governed by the film submission terms and distribution agreement (DW-LGL-NET-002 and DW-LGL-NET-001), not by this policy.

3.6 Instagram direct messages (ManyChat)

When you comment a keyword such as FILM on an @oberasco post, or send it to us by DM, our automation tool ManyChat sends you a direct message with the link you asked for. It may first ask you to follow the account.
What ManyChat receives: your Instagram username and profile name, the comment or message you sent, which buttons you tapped, and whether you follow the account.
Why: to send you what you asked for, and to measure whether the automation works (for example, how many people who commented received a message).
We do not use your DM conversation to send you marketing by email.
Other comment words. The same applies to the other keywords we use, GIVE and CLASS, when they go live.

3.7 Analytics and social platforms

Platform analytics. YouTube, Instagram, TikTok, LaunchGood and Skool give us aggregate statistics, such as views, reach and where viewers come from. These do not identify you to us.
Measuring our own automations. We may compare comments against messages sent to check the DM automation works. This uses the usernames already described in 3.6.
Website analytics: [TO CONFIRM, see 3.1].

3.8 People who work with us

Contractors, creators, sponsors and volunteers give us contact details, payment details and, where relevant, tax information. We use these only to run the working relationship and to meet our legal and tax duties. The agreement with each person sets out the details.

4. Consent

4.1. We rely on your consent to collect, use and disclose personal information, except where the law allows otherwise (Principle 4.3).

4.2. Where the information is sensitive, or where you would not reasonably expect a use, we ask for express consent. Religious belief can be sensitive, and some of our audience may reveal their faith by using our services. We treat that with care and never use it to build profiles.

4.3. You can withdraw consent at any time, subject to legal or contractual limits, by contacting the Privacy Officer. We will tell you what withdrawing means, for example that we can no longer sync your progress.

4.4. Children. The DeenWell app is intended for users aged 13 and over, and the store age rating is expected to be Teen-equivalent (the internal notes). We do not knowingly collect personal information from children under 13. Many of our films are watched by families. If a parent tells us a child under 13 has an account, we will delete it.

5. Who we share it with

5.1. We do not sell personal information, and we do not share it for advertising.

5.2. We share it only with service providers who process it for us, under their terms and our instructions:

Service provider	What for	Where data may be stored
Google Firebase (Authentication, Cloud Firestore, Hosting)	App accounts, synced progress, feedback, hosting the website	To confirm: the Firestore region of project `deenwell-c550a`
RevenueCat	Subscription status, if paid features are live	United States [TO CONFIRM]
Apple App Store and Google Play	App distribution and in-app payments	Their own terms
LaunchGood	Gifts to our campaign	[TO CONFIRM]
Stripe and Buy Me a Coffee	Gifts and payouts	[TO CONFIRM]
Skool	The Academy	United States [TO CONFIRM]
ManyChat	Instagram DM automation	United States [TO CONFIRM]
Meta (Instagram), Google (YouTube), TikTok	Our social channels	Their own terms
To confirm: email platform	Email lists	[TO CONFIRM]
To confirm: accountant or bookkeeper, when appointed	Our books and tax	Canada

5.3. Outside Canada. Some of these providers store or process information outside Canada, mostly in the United States. While it is there, it may be accessed by courts, law enforcement and national security authorities of that country.

5.4. When the law requires it. We disclose information when the law requires it, for example to the Canada Revenue Agency for tax records, or under a valid court order.

5.5. If the business changes hands or incorporates. If Oberas Co incorporates, or its brands are transferred, personal information may pass to the new owner, who will be bound by this policy.

6. How long we keep it

Information	How long
App account and synced data	Until you delete your account, or 24 months after the account was last used, whichever comes first To confirm: inactivity period. No deletion of inactive accounts is in place today
App feedback	24 months [TO CONFIRM]
Email list records and the record of your consent	While you are subscribed, then the consent record for
Gift and donor records	At least six years after the end of the tax year they relate to, because the Canada Revenue Agency requires business records to be kept that long
ManyChat contact records	While the automation runs, then deleted To confirm: ManyChat's retention and whether contacts can be bulk-deleted
Academy member data	While you are a member, then [TO CONFIRM]

We destroy or anonymise information when we no longer need it (Principle 4.5).

7. How we protect it

7.1. We protect personal information with safeguards that match its sensitivity (Principle 4.7), including:

(a) Firestore security rules that stop users reading each other's data, and that make app feedback write-only from the app;
(b) encryption in transit for the app and the website;
(c) two-factor sign-in on every account that holds personal information To confirm: that 2FA is on for Firebase, Google, LaunchGood, Stripe, Skool, ManyChat and the email platform;
(d) access limited to people who need it for their role, recorded in DW-POL-CO-006 (Accounts and access);
(e) no credentials stored in our document repository.

7.2. If there is a breach. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada, notify the people affected as soon as feasible, and keep a record of every breach for 24 months, as PIPEDA and the Breach of Security Safeguards Regulations require.

8. Your rights

8.1. You can ask us:

(a) whether we hold personal information about you, and for a copy of it;
(b) to correct information that is wrong or incomplete;
(c) to delete your information, where we no longer need it or the law allows; and
(d) how we have used it and who we have shared it with.

8.2. Send your request to the Privacy Officer at the contact in 1.2. We answer within 30 days, as PIPEDA requires, and tell you if we need more time and why. Access is free.

8.3. Delete your app account yourself: in the app, go to Profile, then Delete account. This permanently removes your account and synced data from our systems. Scores already shown on the public leaderboard are removed with it. To confirm: that account deletion also deletes the leaderboard entry and any feedback documents linked to the user ID.

8.4. Unsubscribe from emails: use the unsubscribe link in any email.

8.5. Complaints. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

9. Changes to this policy

9.1. We will update this page when our practices change and change the effective date at the top. If a change affects how we use information you have already given us, we will tell you before it takes effect and ask for consent where the law requires.

10. Governing law

10.1. This policy is governed by the laws of Ontario and the federal laws of Canada that apply there, including PIPEDA.

Effective date and approval

Effective date: [BLANK: date of publication]

Approved by:

Kyan Oberas, sole proprietor operating as Oberas Co (Ontario BIN 1001234697), Privacy Officer

Date: _______________

Reviewed by Ontario lawyer:

[BLANK: lawyer name and firm]