Privacy policy

Information We Collect

• Account data such as your name, email address, and securely stored authentication details when you create an account.
• Learning or product-use data such as progress, bookmarks, preferences, reminders, and feature interactions needed to personalise your experience.
• Basic device and analytics data used to understand reliability, performance, and product quality.

How We Use Your Data

• To respond to support requests, safety concerns, and compliance-related issues.
• To understand which features are helping users and which flows need improvement.
• We do not sell personal data or run third-party advertising profiles against your account.

Your Rights

• You may request access to, correction of, or deletion of your account data at any time.
• One record is kept after an account is deleted: the safeguarding audit trail — which supervising adult viewed which learner’s data, and when. It is retained because it exists to be tamper-evident and may be needed to look into a safeguarding concern, and the deleted account’s identifiers in it are replaced by a tombstone so it no longer names a live account.
• You can clear browser-stored local data from your own device settings at any time.

Third-Party Services

• Analytics tools may be used for aggregated product insights and operational monitoring.
• Public Islamic content or utility APIs may power Quran, hadith, prayer, or related product features depending on the site.
• External services should only receive the minimum data needed to serve the relevant feature.

AI assistant and your questions

• When you ask the AI assistant a question, the question and the retrieved source passages are sent to OpenAI, our AI provider, to generate the answer. Your name and email are not included in that request.
• We do not permit our AI provider to use this content for model training, and OpenAI’s API terms exclude API content from training by default.
• A quality log keeps asked questions (capped at 500 characters, stored without your account identity) for at most 90 days, after which it is purged automatically. Signed-in assistant history you can see in the app is yours to delete at any time.

Voice and recitation audio

• These voice tools switch to the on-device Quran model once it is on your device, and until then use your browser’s built-in speech recognition: the Recitation Coach, on its own page; Find an ayah by voice, on its own page, in its card on the home page and in its box at the top of the Quran page; Identify a Recitation, on its own page and in its card on the home page; the ayah microphone in the site search (“Recite an ayah to find it”); Memorise and revise, on its own page and in its card on the home page; and the Recite From Memory panel in the surah reader, which opens from the Recite From Memory button at the top of a surah or from a verse’s “Recite … from memory” button. Wherever these tools offer a “Something is playing” mode (Find an ayah by voice, Identify a Recitation and the ayah microphone in the site search), that mode uses neither engine: it sends the fingerprint described below.
• These always use your browser’s built-in speech recognition, model or no model: the Khutbah Companion, on its own page and in its card on the home page; the “Recite from memory” section inside the Verse Details card, under the Notable ayat tab at the foot of a surah; and the dictation microphones, which type what you say into a box: “Voice” in the AI assistant, in the Ask boxes that hand a question to it (such as those on the home page, the Quran page and the hadith pages) and in the Ask bar on the study pages (such as tafsir, seerah and fiqh), “Say what you are looking for” in the site search, and “Search these lessons by voice” on the school pages.
• Whenever a voice tool is using your browser’s built-in speech recognition (always on the tools just listed; on the tools that switch, until the model is on your device and to the end of a recording already under way when it arrives, all the time on a device or browser that cannot run the model, whenever you pick browser speech on them, and for a recording you start in the moment a voice screen takes to check for the model when it opens; and in the Recitation Coach, whichever engine it uses, while live word-following is on), browsers typically process that audio on their vendor’s servers (for example Google on Chrome, Microsoft on Edge, Apple on Safari) under the browser’s own privacy terms.
• On a device and browser that can run it (the browser must support WebAssembly and tell the site how much memory the device has, which today Chrome, Edge and other Chromium browsers on computers and Android do, and Safari, Firefox and every browser on iPhone or iPad do not; and the device needs at least 4 GB of memory, as the browser reports it, and at least four processor cores), the on-device Quran model downloads in the background after five minutes with the site open and in view; that download never starts while your browser’s data saver is on or on a connection as slow as 2G, nor if you have declined it or chosen another engine in this browser (that answer is kept in this browser’s storage for the site, so it does not carry to another browser or a private window and is forgotten if that storage is cleared; an answer that cannot be stored there is kept at most for that visit, in that tab). Once the model is on your device, the voice tools that switch, listed above, use it for each recording you start from then on, even while data saver is on or the connection is slow, unless you pick browser speech on them or start the recording in the moment a voice screen takes to check for the model when it opens: they transcribe your recording in your browser on this device and do not send it to us or to a speech vendor. The voice screens say which engine is listening, one tap switches back to browser speech, and the recitation settings let you remove the model again. Live word-following in the Recitation Coach, which is on unless you switch it off, still uses your browser’s built-in speech recognition, so while it is on your browser’s vendor also hears the recording and any warm-up calibration you run.
• Identifying a recitation that is playing sends an anonymous acoustic fingerprint to our server, which matches it against known recordings. The fingerprint is a list of numeric landmarks computed on your device and cannot be turned back into audio; the recording itself is not sent.
• We do not store recordings of your recitation on our servers in either mode; scoring results you choose to save are kept as text.

Children and family accounts

• Where a parent links a child, or a teacher creates class logins, the supervising adult is the account contact and consents on the child’s behalf.
• Child profiles carry the same minimal data as any account (name or nickname, progress, saved study state) — no advertising profiles, and analytics stays off without consent like everywhere else.
• A parent, guardian, or school can request export or deletion of a child’s data at any time via the contact address below.
• The safeguarding audit trail of who viewed a child’s data is retained after deletion, with the identifiers tombstoned, as described under Your Rights.

Processors and storage we use

• Google Analytics for optional pageviews if you allow analytics. No session replay, and no advertising or remarketing tags.
• A signed-in session may use an httpOnly cookie (aiq_auth) and a short-lived token in sessionStorage as a fallback. Passwords are not stored in the browser.
• Functional localStorage keys keep bookmarks, progress, reminders, consent, and theme on this device.
• Contact messages are sent through our API proxy, not a public form key in the page.
• api.quran.com and related recitation APIs supply Quran text and audio. hisnmuslim.com supplies dua content. api.aladhan.com supplies prayer times and qibla direction. YouTube may load if you play a talk. Each receives only the request needed for that feature — your IP address is visible to it as with any web request, before any analytics consent choice.
• Hugging Face (huggingface.co) serves the files of the on-device Quran model to your browser: on a device and browser that can run it, the download starts in the background after five minutes with the site open and in view, or earlier when you choose the model, and never starts while your browser’s data saver is on or on a connection as slow as 2G. It receives the download request, with your IP address as with any web request, and no recording or text of your recitation.
• Interface typefaces (Poppins, Amiri, Noto Naskh Arabic — all SIL Open Font License) are served from our own domain since 27 August 2026. No font request reaches Google or any third-party host.
• JSON API writes check the request Origin against an allowlist (CORS). This is not a classic HTML form CSRF token.
• You can change analytics choices any time in the Consent Centre.