Privacy policy
This policy explains what personal data Masar-Fintech collects, why, who receives it, how long we keep it and what rights you have. We have tried to keep it short and exact: it describes what the service really does.
Who runs Masar and what it is
Masar is a free, non-commercial personal learning project. It is run by one individual, Mahmoud Sabry, who lives in Abu Dhabi, United Arab Emirates. He decides how your personal data is used, so he is the data controller. Masar asks for no money of any kind.
The lessons are for education only. They are not professional, financial, legal, tax or investment advice, and they do not come from any exam body.
The personal data we keep
- Your email address and your sign-in data: a protected form of your password, or the fact that you sign in with Google.
- Your learning progress.
- An optional first name, only if you choose to show it on your certificates. We do not ask for or keep your full name, your phone number or your age.
- Your consent record: which version of this notice you agreed to, when, and how (the sign-up form, Google, an invitation or the prompt at sign-in).
- Security records that protect your account, such as sign-in sessions and counts of failed sign-ins.
- The questions you type to the AI tutor, as described below.
Who receives your data, and transfer outside your country
- Cloudflare, Inc. hosts the site and stores your data on its global network. It also sends our emails, and turns a recorded spoken answer into text when you use that feature.
- Anthropic, PBC, in the United States, answers your questions to the AI tutor and to the Ask Masar help assistant. It receives only the text you send.
- Both act on Masar's instructions under their data processing terms. Your data is therefore transferred outside your country. At sign-up you agree to this transfer with its own separate box.
- We never pass your data to others for money, show advertising or use advertising trackers.
AI chats, speech and voice
- Do not type health, religious, political or financial personal details into the AI tutor or Ask Masar.
- Stored AI tutor chats are deleted after 30 days. Ask Masar keeps no conversation.
- We never store your voice or any audio on our servers.
- The speech-recognition switch is off by default. If you turn it on, your browser's own speech service turns your speech into text; in Google Chrome that service is run by Google, under Google's terms.
- The AI tutor is open only to signed-in learners. Answers for visitors who are not signed in have ended.
How long we keep your data
- An account with no activity for 12 months is deleted, with everything in it, certificates included. We send no reminder, so download your certificates if you want to keep them.
- You can delete your account yourself at any time on your account page. It is deleted at once, certificates included.
- Stored AI tutor chats are kept for 30 days at most.
Your rights
- You can ask to access, correct or delete your data, withdraw your consent at any time, and object to how we use it.
- On your account page you can download your data as one file and delete your account.
- Withdrawing consent does not change what was done before it. To stop all use of your data, delete your account.
- Write to the privacy address at the end of this page. We reply within 30 days.
The data protection laws we follow
- Egypt: Law No. 151 of 2020 on the Protection of Personal Data. You may complain to the Personal Data Protection Centre.
- United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. You may complain to the UAE Data Office.
- Saudi Arabia: the Personal Data Protection Law (Royal Decree No. M/19 of 1443 AH). You may complain to the Saudi Data and Artificial Intelligence Authority.
- We apply the strictest of these rules to every learner.
Age
You must be 18 or older to create an account.
Privacy contact
One privacy contact serves every Masar site. Privacy questions and data requests go to the controller, Mahmoud Sabry, at:
Lesson videos and templates
Lesson videos are published on YouTube. A lesson page loads nothing from YouTube until you press play; then the video plays from YouTube's privacy-enhanced address (youtube-nocookie.com), and Google receives your request as for any YouTube video. Templates (spreadsheets and documents) are downloaded from this site and need no sign-in data beyond your account.
- The Ask Masar help assistant processes the question you type in order to answer it: the question is sent to Anthropic (Claude) to write the answer. Conversations are not stored by Masar; we keep only anonymous thumbs-up and thumbs-down counts, and rate-limit counters keyed by hashed (unreadable) IP and session identifiers, which expire after at most 48 hours.
What we collect
You join Masar-Fintech with an invite code or, when self-serve sign-up is open, by creating an account yourself and confirming your email address. We collect information from you when you create your account and study, from the staff member who invites you (if any: your teacher and access dates), and automatically when your browser connects to the service.
| Information | What exactly |
|---|---|
| Account | Email address, the optional first name you choose for certificates (otherwise "Learner"), your role (learner, teacher, admin or owner), your teacher (if any), your access end date, whether the account is active, and when it was created, changed and last signed in to. |
| Password | Never stored as you type it. We keep only a slow, salted one-way hash (PBKDF2-SHA256, 600,000 rounds in all). Nobody at Masar-Fintech can read your password. When you choose a new password, we check it against the Pwned Passwords list of passwords exposed in known data breaches (see section 5): only the first 5 characters of a one-way SHA-1 hash of the password leave our server, never the password itself, and nothing about the check is stored. |
| Password reset links and codes | When you ask for a reset link: a keyed hash of the link (not the link itself), the time it was made, used or expired (it works once, for 24 hours) and a hashed IP address. We send the link only to the email address on the account, and we give the same answer whether or not an account exists. A reset code given by the site owner is stored only as a hash. |
| Sign-in sessions | A hash of your sign-in token (not the token itself), a hashed form of your IP address, your browser's user-agent string (for example "Chrome on Android"), and the session's start, last-use and end times. |
| Sign in with Google (optional) | If you choose Google, Google sends us your name, email address, Google account ID and a link to your profile picture. We keep your name, email address and Google account ID; we do not keep the picture link. The Google account ID is a number that identifies your Google account. Google does not send your password or your contacts, and we keep no Google token. We keep the Google account ID next to your account so that your next Google sign-in finds it; your name and email are kept as for any account. Only learner accounts can use Google sign-in; staff accounts sign in with a password and a code. Your data export lists the Google account ID. |
| Security records | An audit log of account events (for example sign-ins, failed sign-ins, password changes, invite codes used, changes made by staff, blocked requests), with the time, the account involved and a hashed IP address. Counters of failed attempts and request limits, keyed by a hashed IP address or hashed email. Invite codes, stored only as hashes. Your agreement to the Terms of use and this policy, when you signed up and each time they change: the version, the date and a hashed IP address. |
| Two-step sign-in (staff accounts only) | Only for owner, admin and teacher accounts that turn it on; learners are never asked. The key of your authenticator app, stored encrypted; the time step of the last code accepted (so a code cannot be used twice); ten one-time recovery codes, stored only as hashes, with the time each one was used; and, for the few minutes between your password and your code at sign-in, a hash of that sign-in step with its start and end times and the number of codes tried. Your data export lists when it was turned on and how many recovery codes are left, never the key or a code. |
| Study progress | One progress document for your account: the lessons you marked complete (episode code and time, done), the next lesson to continue (ftLast), and the history of your tutor questions that you choose to keep. It is saved on the server so it follows you to any device, is part of your data export and is erased with your account. It also decides which stage certificates you can claim. Nothing of it is kept in your browser. |
| AI tutor use | Table tutor_usage: how many tutor questions you asked each day (and a site-wide daily total), as numbers only. Your tutor conversations themselves are saved with your account, inside your progress document (see Study progress) and, when it grows large, in table tutor_archive, one entry per conversation. Each conversation is deleted automatically 30 days after our server first stored it, and at once if you delete your account. Until then you can download the stored ones from the tutor panel ("Download older chats"), and they are part of your data export. |
| Invite a friend | From 31 October 2026, Invite a friend gives you a personal link with a random 12-character code (no name or email in it), made when you first open it and kept while your account exists. When someone opens your link, a cookie (masar_inv) keeps the code in their browser for up to 30 days; if they then create an account, we record which account invited which account and the date, and show you only the number of people who joined. There are no rewards of any kind. At most 20 joins are counted in any 30 days and 200 in all. These records are in your data download and are deleted when either account is deleted. The optional Share button opens your phone's own share menu and the Telegram button opens Telegram, each only with your link; we send nothing to them. |
| Certificate check page and printed copy | From 31 October 2026, when you have completed every episode of a journey stage, you can ask for a certificate of completion. It records a random 32-character id, the stage, the name shown on it (your display first name, or "Learner" if you have not set one) and the date; it is kept while your account exists, is in your data download and is deleted with the account. It is our own record of your study on this free site, not a qualification. Each certificate has a check page (/verify/ and its id) that shows only whether it is valid, your display first name (or "Learner" if you have not set one), the course, the level and the date, never your email, scores or progress. You can change or remove your display first name at any time on your account page. The printable copy is made for you alone and is not stored. |
| Impact counts (no person) | Daily totals only: sign-ups, lessons completed, certificates issued and joins through an invitation, with the two-letter country code Cloudflare gives for sign-ups and lessons. No account, name, email or network address is stored in them. We use them to report how many people this free project reaches. |
| First-party statistics | To see how well the course works, our own server counts a few events as daily totals only: homepage views, visits through our short campaign links (/yt, /ig, /tt, /wa and /fb, one count for each link), sign-ups, the first lesson opened, diagnostics started and finished, and the results of the security check (Cloudflare Turnstile) on the sign-up form: passed, failed, expired or timed out. A few older counters only hold history from before 30 October 2026. Each count is a number for the day (for example "12 sign-ups on 6 October"). It contains no name, email, account id, IP address, cookie or device detail, and these daily totals are not sent to any third party. The site owner also sees weekly totals and how many learners keep studying after 7 and 30 days, worked out from the account and activity records described in this section; nothing extra is collected for that. |
| Visitor analytics | Our host, Cloudflare, provides Cloudflare Web Analytics for our public pages. It is privacy-first: it sets no cookies, uses no local storage or other browser storage, and does not track you across sites or build a profile. It reports only aggregate page views, referrers, country and browser type. It holds no personal data about you that we can see, and we do not combine it with your account. |
| Visit statistics | When a page of the website or the app is opened, our own server adds it to aggregate daily visit statistics: page views per page (without the query part of the address), an estimate of the number of different visitors, the country (taken from the connection), the type of device (phone, tablet or desktop) and where the visitor came from (the website name of the referring site, such as YouTube, Facebook, Instagram, WhatsApp, TikTok, Google or Bing, or "direct"). Only the totals are kept, for up to 25 months. We use no cookies and no script on your device, we do not keep your IP address, and we do not identify anyone. To count a visitor only once a day, the server makes a short code from your connection details and browser type together with a secret key that changes every day; this code cannot be reversed or linked from one day to the next, it is used only to check whether the visitor was already counted that day, and it is not stored for more than 48 hours. Bots and the site owner's own visits are not counted. |
| Automatic error reports | When something goes wrong in the app or on our website (for example a script error or a request to our server that fails), your browser sends us a short report so that we can fix the fault. It holds the kind of fault, a scrubbed error message (email addresses, long numbers and codes removed), where in our code it happened, the page without its query string, your browser family and version, the operating system, whether the device is a mobile or a desktop, a screen size band and the page language. It holds no account identifier, no email address, no IP address or IP hash, no cookie and nothing you wrote in the course. A report is kept for 30 days after the fault last happened, and we use reports only to fix faults. |
| Self-serve sign-up | The email and password (hashed) you enter at sign-up, kept for up to 24 hours until you open the confirmation link we email you (we keep only a keyed hash of that link). The result of the bot check on the sign-up form (Cloudflare Turnstile). Masar-Fintech is free and nothing limits your access; a new account may carry an internal access marker, which has no effect, and older accounts may carry access dates from before 30 October 2026. Where you first came from, as one category only (for example a Masar campaign link, YouTube, Google, another website or direct); never the address of a page, a referrer address or your IP address. |
| Support requests and the support assistant | Your support requests and our replies, their category and status, and (only if you tick it) the lesson and page you were on and your browser type; tutor conversations are never attached. Visitors' messages: the email address you give, and whether you also asked for news (a separate choice, off unless ticked). Questions you ask the automated support assistant are not stored unless you choose to include the conversation in a support request. The site owner may add private notes to your record. |
| Service emails | A log of the service emails we send you (for example the sign-up link, a password reset link and a reply to your support request): the type, address, time and whether it was delivered. |
| Messages to us | What you write when you contact us, and our reply. |
We do not ask for, and ask you not to send us, sensitive data such as health, religious or financial details. Please do not type such details into the AI tutor, your notes or a support message.
Information kept on your device
To work quickly, the app keeps some information in your browser's storage on your device: a copy of your progress and settings, your language choice (English or Arabic, in the storage key masar-lang; the small cookie masar_lang holds the same two letters so that pages and emails use it), and small records such as where you stopped in a lesson video. When you sign out, the app removes what it keeps for your account on the device: the progress copy and settings, and the page to return to. It does not remove your light or dark display choice, your language choice or the video positions; clear this site's data to remove them. You can remove everything at any time by clearing this site's data in your browser. Details: Cookies.
Who receives your information
Inside Masar-Fintech, our owner and admins can see account details and security records to run the service, and your teacher can see a summary of your progress. They are bound to keep it confidential.
We use these service providers. They act on our instructions (as processors) unless stated otherwise:
| Provider | What they do | Data they handle | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Cloudflare Pages and Workers), the database (Cloudflare D1), network security, the support assistant model, bot protection on the sign-up and contact forms (Cloudflare Turnstile) and service emails (Cloudflare Email Service) | Everything the service stores, every request to the site (including your IP address as it passes through the network), the text you send to the support assistant, and the email address and content of service emails | Cloudflare's global network; the region of the database's main copy will be stated here once confirmed |
| Google LLC and Google Ireland Limited (only if you choose Continue with Google) | At your request, Google confirms that you own the Google account and tells us your name (which we do not keep), email address and Google account ID. Google is an independent controller of your Google account and handles your sign-in under its own privacy policy; we do not send Google anything about your learning. | That you are signing in to Masar-Fintech; the sign-in itself | Worldwide, under Google's terms |
| Anthropic PBC | The model behind the AI tutor. Our server sends it the text of your question, a short instruction and the last few turns of your conversation, and shows you the answer. | The text of your tutor questions and the answers. Your name, email and account number are not sent. The provider handles it under its own terms; the status of those terms will be stated here once confirmed. | The provider's own locations, which may be outside Egypt |
| Pwned Passwords (Troy Hunt, through Cloudflare) | Tells our server whether a new password appears in known data breaches | Only the first 5 characters of a one-way hash of the password; never the password | Cloudflare's network |
| Google LLC and Google Ireland Limited (only if you choose Continue with Google) | At your request, Google confirms that you own the Google account and tells us your name (which we do not keep), email address and Google account ID. Google is an independent controller of your Google account and handles your sign-in under its own privacy policy; we do not send Google anything about your learning. | That you are signing in to Masar-Fintech; the sign-in itself | Worldwide, under Google's terms |
| Google LLC (YouTube, only when you press play on a lesson video) | Plays the episode video in the lesson page from youtube-nocookie.com | Your IP address and browser details, as for any YouTube video; YouTube acts as an independent controller under its own privacy policy. Nothing loads before you press play. | United States and other countries |
Content we publish is stored in our database with no personal data: the YouTube video id for each episode (fintech_media, fintech_playlists) and the articles (fintech_articles); each change records only the staff account that made it.
How long we keep it
An automatic clean-up applies these periods. It has no fixed timetable: normal use of the service starts it (at most once an hour) and the owner can also start it by hand, so a deletion can happen some time after its period ends.
| Information | How long |
|---|---|
| Account and progress | While your account exists. You can delete it yourself at any time on your account page; it is deleted at once, certificates included. An account with no activity for 12 months is deleted in the same way. |
| Sign-in sessions | They end after 14 days without use, or 30 days at most (for owner and admin accounts, 12 hours without use, or 7 days at most), and are deleted at the next clean-up. Deleting your account, or "Sign out everywhere", deletes them at once. |
| Sign in with Google | The Google account ID: while the account exists; deleting the account deletes it. A one-time mark of each Google sign-in attempt (a hash of a random value, no personal data) is deleted after a day. |
| Two-step sign-in (staff accounts) | The encrypted key and the recovery code hashes: while two-step sign-in is set up on the account. Making new recovery codes deletes the old ones; a reset by the owner or an admin, or deleting the account, deletes all of it at once. The sign-in step between the password and the code ends after 5 minutes and is deleted at the next clean-up. |
| Failed attempt counters | 30 days |
| Password reset codes and links | Deleted at the next clean-up once used or expired (they work for 24 hours) |
| Invite codes | 90 days after they are used, expire or are revoked |
| Audit log | 24 months. Entries that record an agreement to the terms and the use of an invite code are kept longer, as evidence, for the limitation period the law sets. |
| Record of your agreement to the terms | While your account exists and, after a deletion, without your name, email or IP address, for the limitation period the law sets |
| Daily AI tutor counts | While your account exists; deleted with your account |
| AI tutor conversations | 30 days from when our server first stored each conversation (in your progress or your chat archive), or sooner if you delete your account. Our AI provider handles the text it receives under its own terms (see section 5). |
| Messages to us | A limited period after the matter is closed |
| Support requests | Their messages, contact details and attached context are deleted 24 months after the request is resolved; deleting your account deletes your support requests at once |
| Sign-up details before confirmation | Deleted when the link is used or after 24 hours |
| Service email log | 90 days |
| Visit statistics | Daily totals 25 months; the daily visitor codes 48 hours |
| Automatic error reports | 30 days after the fault last happened |
| Backups | The database keeps restore points for up to 30 days; deleted data disappears from them after that |
How we protect it
We use measures suited to the risk, including: encrypted connections only (HTTPS with HSTS); passwords stored as slow salted hashes; sign-in tokens, IP addresses, invite codes and reset codes stored only as hashes; a sign-in cookie that scripts cannot read and other sites cannot send; limits on failed sign-ins; access checked on the server on every request; staff access limited to what the role needs, with a record of staff actions and two-step sign-in for staff; and encrypted backups. No system is perfectly secure. If a personal data breach is likely to harm you, we will tell you and the authority the law names, as the law requires. To report a weakness, write to [email protected].