Deenia

Privacy Policy

Last updated 13 October 2026

Deenia is the system your madrasa or Islamic school uses for enrolment, classes, attendance, progress and fees. Deenia is a Sehrapp service: Sehrapp runs it for schools and madaris, and FungalCode.com, the developer named on Google Play, develops it. Your school decides what it records about your family and is responsible for it under the privacy law where the school is; for a school in British Columbia, that is the Personal Information Protection Act. Sehrapp keeps that information on the school's behalf and uses it for nothing else.

What is kept

About parents and guardians:

  • Names, email addresses and phone numbers, the home address and an emergency contact.
  • The enrolment form, including any extra questions the school adds, and the declaration you agreed to.
  • Fee plans and payment records. Deenia never stores a card number or security code; fees are paid at the school office. At most the last four digits of a card are kept if the school records them.

About pupils:

  • Name, date of birth, gender, a health card number if the school asks for one (for a school in British Columbia, the Personal Health Number), allergy notes and whether a custody order applies.
  • Class and course placement, attendance and late or early departures, marks, teacher notes, homework, term reports and progress in lessons.
  • A photo, only if the school adds one.
  • A sign-in for the pupil, made by the school. Pupils never create their own accounts.

About teachers and staff:

  • Name and email, clock-in and clock-out times with the device's browser description, and class notes.

About everyone who signs in:

  • Sign-in records: which device (for example "Safari on iPad" or "Deenia app on iPad"), when, and how. A log of changes made in Deenia, with the internet address they came from.
  • If you set them up: passkeys (only their public keys), two-step verification (the secret is encrypted) and recovery keys (stored only as scrambled hashes). Passwords are stored only as salted hashes.
  • If you choose Google, Microsoft or Apple sign-in: only that account's identifier and email address. Deenia does not read anything else from those accounts.
  • A profile photo, if you add one. Pupils cannot add their own: a pupil's photo is added only by the school.

About anyone who writes to us through the contact form: your name, email address, the topic you chose and your message. Not your internet address.

Why it is kept

To run the school: enrolment, class lists, attendance, teaching and progress reports, fees and notices to families, and to keep every account secure. Nothing is sold, used for advertising or shared for marketing.

Who can see it

  • Your school's staff, according to their role. Each school sees only its own records; another school on Deenia cannot see yours.
  • Parents see their own children. Pupils see their own work.
  • Sehrapp, and FungalCode as its developer, only to run, support and repair the service for your school.
  • Services that carry out part of the work: the school's own email provider sends Deenia's emails, Cloudflare carries traffic to the website, Google's email service delivers contact form messages to Sehrapp, and Apple's iCloud holds the encrypted backup copies. Google, Microsoft or Apple take part in sign-in only if you choose to sign in with them.

Deenia has no advertising, no analytics and no tracking. The website loads nothing from other companies and uses only the cookies listed below.

Where it is kept, and for how long

  • On a server in British Columbia, Canada, with backups kept for 14 days. An encrypted copy of each nightly backup is also kept for 30 days in Apple's iCloud storage; only Sehrapp holds the key that opens it.
  • Records stay while your family or the staff member is part of the school, until the school removes them.
  • Payment records are kept for six years (for a school in Canada, the Income Tax Act requires this), even after an account is removed; the name on them is then replaced with "Deleted account".
  • The log of changes is kept for two years. Sign-in records are removed 30 days after the sign-in ends.
  • Contact form messages are kept for one year.

Your choices

  • To see or correct what is kept about you or your child, ask your school. The school can correct or delete records in Deenia.
  • To delete your account, choose Delete my account in the Deenia app (Account) or on the website (My Sign-in Security). A parent can also ask to delete a child's account there. Your school will review your deletion request within 30 days and you get an email when it is decided. A school may decline only when a law requires it to keep the records, when it cannot confirm who asked, or when a technical problem prevents it, and it must tell you why. Payment records are kept for six years without a name.
  • You can end your sign-ins on any device from My Sign-in Security, and switch Google, Microsoft or Apple sign-in off there.
  • If your school cannot help, write to privacy@deenia.fungalcode.com from the email address on your account, and name your school.

Children

Pupil accounts are made by the school, for the school's own use. Pupils cannot sign in with Google, Microsoft or Apple, and nothing in Deenia shows pupils advertising.

Cookies

Deenia uses five cookies and six items of browser storage, all needed for it to work, none for advertising, analytics or tracking, and none from other companies. The Cookies page on this website lists each one with how long it lasts.

  • deenia_session: keeps you signed in (until the browser closes, or up to 30 days with "Keep me signed in").
  • deenia_csrf: stops other websites from acting in your name.
  • deenia_pending_sign_in: holds a sign-in for five minutes while you enter a two-step code.
  • deenia_oauth_bind: ties a Google, Microsoft or Apple sign-in to your browser for ten minutes.
  • __Host-deenia_app_handoff: ties a sign-in made in the browser for an older Deenia app to that app, for fifteen minutes.
  • In browser storage, never sent anywhere: whether you ticked "Keep me signed in", when you last used Deenia (so every tab locks together), that you said "Not now" to a passkey, that a passkey should be offered once after a password sign-in, that you stopped the roll call reminder from moving, and that you have seen the cookie notice.

The Deenia apps

The Deenia apps for iPhone, iPad and Android use the same account and keep what is described here. You sign in inside the app, which talks only to this Deenia server. On the device the app keeps the sign-in token, in its secure storage (the Keychain or the Android Keystore), and the email address you last signed in with, so it can fill it in next time. If you turn on the app lock, the token opens only after Face ID, Touch ID, your fingerprint or your phone's PIN. The app never sees your face or fingerprint: the phone only tells it yes or no. If a teacher or the school office allows notifications, the app sends this server the notification address Apple or Google gives the phone, so the server can remind them to clock in and take the roll call. The reminder names the class and how many pupils are in it, never a pupil. The address is deleted when they sign out of the app, and it stops being used when that sign-in ends.

Contact

Start with your school office: it looks after your account and your records, and it can reach Sehrapp, which runs Deenia. Or write to the address for your question:

If this page changes in a way that matters to you, your school will be told before the change takes effect.

© 2026 Sehrapp. Deenia™ is a trademark of Sehrapp.