# Security and privacy _Mektebi 1.3 · reviewed 2026-10-24_ How Mektebi protects the data of mosques and families, what you can do yourself to keep your account safe, and which rights you have. This chapter explains, in plain words, how the data on Mektebi is protected and which rights you have. The promises themselves are in the [privacy policy](/privacy), in its section on keeping your data secure, and in the [data processing agreement](/dpa), in its list of technical and organisational measures. ## Encrypted on the way and in storage **On the way.** All communication with Mektebi is encrypted in transit, on the website and in the apps. **In storage.** Sensitive personal data is also encrypted in the database. This includes: - postal and contact addresses, phone numbers, dates of birth and gender; - religious titles and guardian-relationship details; - teachers' notes, grades and remarks on grades and attendance; - the text of chat messages and the notes in absence reports; - teachers' notes on recitations, remarks in progress reports and the published progress reports themselves; - two-factor secrets and access tokens. **Files.** Files in chats, homework, notices and lesson exercises, and recitation recordings, are shown only to the people allowed to see them, through links that expire after five minutes. ## Passwords and sign-in **Passwords:** never stored in readable form, only as salted hashes. **Sessions:** your session cookie is encrypted and holds only a random key, which Mektebi checks against its own record of your session. Signing out really ends the session. A device that has not been used for two weeks must sign in again, and changing your password signs out your other devices. ## What you can do yourself - **Two-factor authentication.** You can switch it on in **Settings → Two-factor**. Signing in then needs a code from an authenticator app as well as your password. It is optional. - **Passkeys.** In **Settings → Passkeys & biometric** you can add a passkey, so that you sign in with Face ID or your fingerprint instead of typing your password. A passkey is a private key on your device. On the same page you can switch on the **Biometric app lock**, so that the installed app asks for Face ID or your fingerprint each time you open it. - **Sign out on shared devices,** and choose a password that you use nowhere else. {{shot:two-factor-settings}} ## Who can see what All data is stored on access-controlled servers in the European Economic Area. Each mosque sees only its own records, and inside a mosque each role, admin, muallim, parent or student, has only the access it needs. Chapter 2, "Your data stays yours", explains how this works for one person in several mosques, and where the data is stored. Authorised FETOSOFT support staff look into a mosque's data only when it is needed for support or to keep the platform running, and they are bound by confidentiality. ## No advertising, no tracking There is no advertising, tracking or profiling inside the platform or the apps, and personal data is never sold or shared for commercial purposes. Usage statistics are used only on the public website, for visitors who are not signed in, and their analytics cookies are set only after the visitor clicks "Accept". ## What reaches your phone If you allow notifications in the app, each notification's title, short text and link are passed to Apple or Google, only to deliver the notification to your device. You can switch off individual kinds of notification in your notification settings, or all of them in your device settings. {{shot:notification-settings}} ## If something goes wrong If FETOSOFT becomes aware of a personal data breach, it informs the mosque without undue delay, with the information the mosque needs to meet its own obligations. FETOSOFT also helps the mosque to protect the data and to answer requests from the people concerned. ## Your rights and your account You have the right to see the data held about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. Chapter 2 explains these rights in more detail. You can delete your account yourself, in the app or on the website, under **Settings → Danger zone → Delete account**. The personal data that belongs to it is then deleted as the [privacy policy](/privacy) describes. ## Changes and contact The privacy policy may be updated from time to time. The new version is posted on the website, and where the changes are material, reasonable steps are taken to let you know. For any question about your data or about security, write to FETOSOFT DOOEL, Kumanovo, North Macedonia, at support@fetosoft.com. If you are a student, a parent or a muallim, your mosque is usually the quickest place to ask. ## Binding texts The binding texts are the [privacy policy](/privacy), the [data processing agreement](/dpa) and the [terms](/terms). If anything here differs from them, those texts apply.