Majal privacy policy

Last updated 20 October 2026. A shorter version appears in the app under Privacy (footer link, Settings → Your data, and the first setup screen).

The short version

Majal keeps your study life on your Mac. You don’t need an account to use it, and there are no ads and no tracking. Nothing leaves your Mac unless you turn on a feature that needs it, and Majal tells you before it does.

What Majal keeps on your Mac

• Your profile (name, university, major and year, all optional).
• Semesters, courses, tasks and thoughts, which study plan courses you’ve ticked as finished, and the grades, marks and transcript GPA you add on the Grades page.
• Notes and their files.
• Flashcards and their review history, and quizzes.
• Focus sessions and the notes you add to them.
• Exam plans, weekly check-ins and settings.

They’re saved in your Mac user account’s Library folder (~/Library/Application Support/Margin), and only your account can read them. Majal’s local service only accepts connections from this Mac.

A transcript you import (on the Grades or Courses page) is read on this Mac: the text you paste, or the PDF you choose, which the app reads with Apple’s PDFKit. Majal keeps the semesters, courses and grades you choose to import, not the file or its text, and sends none of it anywhere.

When something leaves your Mac

Only in these cases, and only after you turn them on:

• AI features, only when you choose. Majal’s AI buttons (Flashcards, Quiz me, Explain it back, I’m stuck, Ask) write a question with what that feature needs:

  • your question or the note you chose,
  • the course and topic,
  • your university and year, if you entered them (never your name).

  It opens in ChatGPT or Claude when you press Open ChatGPT or Open Claude: in the link when it’s short, and on your clipboard. Majal itself sends nothing. You can see the question first, and what you send there goes to OpenAI or Anthropic under your own account and their terms. Majal has no AI service of its own; if it adds one, this policy will say what it handles before it does. A key for your own OpenAI or Anthropic account, added in an earlier version, still sends requests straight from your Mac to that provider, after you agree on a consent screen.

• AI apps you connect, off by default. With Settings → Connect ChatGPT or Claude turned on, apps such as Claude Desktop or Claude Code (through the local Majal connector, mcp.mjs) can read your courses, tasks, notes, flashcards and exams and add tasks, thoughts, flashcards and exams when you ask them to; they can’t edit notes or delete anything. What they read goes to that app’s company under your own account with them. The connection only works while Majal is open, uses a key that changes every launch, and stops the moment you turn it off. ChatGPT gets a copy-and-paste bridge instead: a study summary you copy and paste yourself (courses, tasks, deadlines, exams, inbox thoughts and note summaries; never the notes themselves), and flashcards you paste back and check before saving.
• Apple Calendar, off until you press Add to Apple Calendar on the Calendar page (in the Mac and iPhone apps). Majal then puts your exams, deadlines and planned study sessions (their titles, course names, days and times) in a calendar called Majal in Apple Calendar, and keeps it up to date while Majal is open. Apple Calendar is outside Majal: if your calendars sync with iCloud or another account, these events sync there too. Majal only changes the events it added, and you can remove the Majal calendar from the Calendar page at any time. Downloading the calendar file (.ics) just saves a file for you to open where you like.

• Sync with your other devices, off until you turn it on in Settings → Sync with your other devices. Majal then sends an encrypted copy of your Majal to Majal’s sync service (sync/), so your other devices (iPhone, iPad, another Mac, the web version) have the same: your profile, semesters, courses, tasks, thoughts, notes and their files, flashcards and their review history, quizzes, exams, focus sessions and check-ins. It never includes your AI key, and some settings stay on each device (appearance, AI consent, crash reports and the Claude connection).

  • Everything is encrypted on your device first (AES-256-GCM), with a key only your devices and your recovery key have, so the service can’t read it. SYNC.md describes how.
  • You sign in with your email and a 6-digit code. The service keeps a keyed hash of your email, hashed sign-ins (with the kind of device: Mac, iPhone or iPad, or browser), and the encrypted copy. It can see how much you keep there and when your devices sync. Rate limits use hashed network addresses.
  • If you lose every device and your recovery key, nobody can open the copy, not even Majal.
  • Turning sync off on one device leaves the copy for your other devices. Delete the online copy (or Delete everything) removes it.
• Crash reports, off by default. A short technical report: the kind of error, where in Majal’s code it happened (file names and line numbers), and the Majal and macOS versions. No error messages, notes, names or anything you typed (crash.mjs defines the exact shape, and the service refuses anything else).
• Community, off until you join. Other verified students in the spaces you join see your display name, university, major and year, and what you post and reply, including flashcards you choose to share, the meetups you plan or say you’re going to, and the materials you share in a course’s library (files and links, shown once one of its course admins approves them); in fields across universities, that includes students from other universities. If you apply to look after a course’s library, its admins (or a moderator) see your note and whether you said you took the course. A course’s sections (a CRN, its instructor, class times and rules, and the quiz, assignment and exam dates students add) are seen by students at your university, with the name of whoever added or last changed each date; a section’s history of changes is seen by its students and the course’s admins. Which sections you’re in is shown only as a count. Your university email is used once, to send a verification code, and only a keyed hash of it is kept, so one email makes one account. Where the community offers UAE PASS, you can verify with it instead: Majal then keeps your UAE PASS identifier, your verified full name, your account’s level of assurance (SOP2 or SOP3) and when you verified, apart from everything else; no other student, course admin or moderator can see them, and only Majal’s operator can look, giving a reason that is recorded each time. Your public name becomes your verified first and last name. UAE PASS also sends your Emirates ID number, phone, email, gender and nationality; Majal never keeps them. With anonymous mode, other students, course admins and moderators see a neutral alias (like “Teal Falcon 482”) instead of your name, everywhere; Majal keeps the link between the alias and your account for safety, under the same rule. Majal keeps your age band (15–16, 17, or 18 and over) and whether you said it or UAE PASS did, never your birth date; 15- and 16-year-olds start anonymous and have a quieter community (see community/UAE-PASS.md). Your notes, tasks, the flashcards you don’t share and everything else stay on your Mac. Studying now is off unless you turn it on: then, while your focus timer runs on a course, students in that course’s room see your name until the session ends. Leaving deletes your community account, the text of everything you posted, and the materials you shared with their files. The community runs on Majal’s community service, on Cloudflare (see Outside the UAE).

Do Not Disturb works by running your own shortcuts on your Mac, and nothing is sent. Study groups are hidden unless a study-group service is configured; when one is, your display name and weekly focus minutes are shared with your group.

Outside the UAE

ChatGPT and Claude run on servers outside the UAE, mainly in the United States. What you send them is between you and OpenAI or Anthropic, under your account with them; Majal sends them nothing. (A key of your own, from an earlier version, is used only after you agree on a consent screen that says where requests go: a PDPL cross-border transfer with the data subject’s express consent.)

Majal’s own services (the community, sync and crash reports) run on Cloudflare, whose servers may be outside the UAE. What you share in the community is kept there as described above. What sync keeps is encrypted on your devices before it leaves them and can’t be read there, and the sync screen says where it goes before you turn it on.

Your rights

Under the UAE’s personal data law (Federal Decree-Law No. 45 of 2021), you can:

How long things are kept

• On your Mac: until you delete them. Majal keeps a safety copy before each upgrade or restore, and Delete everything removes those too. With sync on, it also keeps copies of how things were before changes another device brought: the last three, and apart from them the last three versions set aside when the device joined or you chose between two versions. They stay when sync is off, until you remove them (Settings → Sync with your other devices → Remove these copies) or delete everything.

• On Majal’s sync service:

  • the encrypted copy until you delete it (Delete the online copy, or Delete everything); note files it no longer uses (after a restore, say) about a week later,
  • sign-in codes expire after 15 minutes, and a code for adding a device after 10,
  • sign-ins after 180 days without use, or when you sign out,
  • your sync account (the hash of your email) when you delete everything.
• On Majal’s service: crash reports are deleted after 90 days.
• In the community: posts and replies (with shared decks and meetups), and course materials with their files, until you delete them, you leave, or a moderator or course admin removes them; applications to look after a course until they’re decided; sections and their dates (with their history of changes) until a course admin or moderator removes them, and when you leave, your places in sections go and the dates you added are removed; reports until a moderator resolves them; a record of moderators' actions, so moderation stays fair; when you last opened each space, to show what’s new, until you leave it; and “studying now” until your session ends, at most three hours. Verification codes expire after 15 minutes. Your UAE PASS identity, your alias and your age band are kept until you leave; a UAE PASS sign-in in progress for at most 15 minutes; and a record of each time the operator looked at who is behind an account, with the reason given, so those looks stay accountable.

Age

Majal is for students aged 15 and over, the UAE’s minimum age for social platforms. Setup asks you to confirm this. Under UAE law anyone under 18 is a child, so Majal keeps everything on your device unless you turn on a feature that needs to send something, and says so before you do.

Changes

If this policy changes, Majal will show you what changed before anything new leaves your Mac.

Contact

Questions about your data? Contact the developer at help@getmajal.ae.