Privacy Policy

You can read the whole site without an account. We count page views with Vercel Web Analytics, to see which pages are read and from which countries and browsers. It sets no cookies, stores nothing on your device and does not follow you across sites; according to Vercel, a visitor is only recognised by an anonymous hash that is discarded after 24 hours. We run no advertising or other tracking scripts, and we do not set cookies.

Your reading settings, language, saved ayahs and last-read position are saved in your browser's local storage so the site can remember them. If you save all surahs for offline reading, the pages are kept in your browser's cache. This data stays on your device and is never sent to us. See the Cookies page for the exact entries.

If you use the contact form or the delete-account form, we receive what you type (your name, email address, message) together with your IP address and the time, as an email sent through our email provider, Brevo. We use it only to answer you or to handle your request, and we keep it only as long as that takes.

The site is hosted on Vercel. Like any web host, it processes technical request data such as your IP address, browser type and the page requested, to deliver the site securely and to prevent abuse. Fonts and the Quran text are served from our own domain, so reading does not call other services. Searching the text sends your search words to our server to find the ayahs; we do not store them. When you play a recitation, our server looks up the ayah timings with the mp3quran.net API, and your browser streams the audio from mp3quran.net's audio server (cdn.mp3quran.net), which receives your IP address like any web server.

The app stores the following on your device only:

• Bookmarks and favorites
• Reader preferences such as theme, text size and language
• Reading statistics (dates and pages read, kept for up to about 400 days)
• Small app state used for prompts, for example a review request

Quran and hadith content is bundled in the app, so it can be read without a connection.

If you turn on Cloud Sync, you sign in with Google and the app backs up your bookmarks, favorites, reader preferences and reading statistics to Firebase Firestore under your Firebase user ID. While you are signed in, your Google display name, email address and photo may be shown inside the app.

Signing out stops future syncing. It does not by itself delete data that was already synced; see Your rights below.

• Firebase Authentication, for the Google sign-in used by Cloud Sync
• Cloud Firestore, for Cloud Sync backups
• Firebase Analytics, for screen views
• Firebase Crashlytics, for crash and error diagnostics
• Firebase App Check with Play Integrity, to protect our backend and token service from abuse
• Google Play Billing, for optional donations. Google handles payment and we never receive your card details
• Google Play In-App Review, to request a rating

When you open a reciter or download a recitation, the recordings, their sizes and the ayah timings come from mp3quran.net. When you share a verse, the app requests its text from the Quran.Foundation Content API (the service behind Quran.com) and, as a fallback, Al Quran Cloud. When you download a translation, it comes from Tarteel's Quranic Universal Library. To authorize requests to the Quran.Foundation API, the app asks our own server for a short-lived access token and proves that it is the genuine app with a Firebase App Check token. This sends no personal data, but our server and these providers can see standard network data such as your IP address.

The app only asks for the INTERNET permission. It does not request your location, contacts, camera or microphone.

Data on your device stays until you clear the app's storage, uninstall the app or clear your browser data. Cloud Sync data stays in Firebase until it is deleted. Depending on your Android settings, system backup may also store app data in your Google account. Messages sent through the contact and delete-account forms are kept only as long as needed to handle them.

The website and app are for a general audience, including younger readers. We do not ask for profile details through our own forms. If you believe a child's data was handled improperly, contact us and we will look into it.

Data in transit is encrypted with HTTPS/TLS, and we rely on Firebase security controls for synced data. No system is perfectly secure, but we take reasonable steps to protect your data.

You can delete local data at any time by clearing the app's storage or your browser data. To delete your Cloud Sync account and its data, use the delete-account page on this website with the email of the account you signed in with. To access or correct that data, email us from that address. In both cases we reply to that address to confirm it is you before we act.

If you are in the EEA or the UK, you may have rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to your data protection authority. We process data to provide features you ask for (such as Cloud Sync), for our legitimate interest in keeping the app reliable and secure, and, where required, with your consent.

We may update this policy as the website or app changes. The date at the top shows the latest version. If we ever add cookies or advertising to the website, we will update this page and ask for your consent first.