Privacy Policy

The data controller for this website is: Ihab Oweis, IOQ Software, Lessingstraße 48, 47166 Duisburg, Germany. Email: info@quranh.com. A Data Protection Officer has not been appointed, as this is not required for this non-commercial project.

QuranH only collects data that is necessary for the operation of the application. No data is shared with third parties for advertising purposes. The application does not set its own cookies.

Providing your data is voluntary. The app can be used fully in offline mode without registration. However, cross-device synchronization is not available without registration.

When you register, your email address and a display name are collected. Authentication is handled via Supabase (Supabase Inc., USA) as a data processor. Supabase stores your email address, display name, and a hashed password. Providing this data is voluntary. The app can be used without registration in offline mode. However, cross-device synchronization is not available without registration. Legal basis: Art. 6(1)(a) GDPR (consent through voluntary registration). You may withdraw your consent at any time by deleting your account. You can use the same account to sign in to mutunh.com, an app by the same provider for memorizing classical texts; your learning progress there is stored separately. Account emails (confirmation, sign-in link, new password, change of address) are sent by Resend (Resend, Inc., USA) as a data processor; for this, Resend receives your email address and the content of the email.

QuranH stores your learning progress, settings, and authentication tokens in your browser's localStorage. Additionally, temporary session data is stored in sessionStorage. This data only leaves your device if you register and use cloud synchronization. Reminders in the app (time, on or off) also stay on your device; your phone shows them itself, and no data is transmitted for them. Without registration, the app works completely offline. Legal basis: § 25(2) TDDDG (technically necessary storage).

When you are logged in, your learning progress and settings are synchronized with the Supabase database. The following data is stored: learning progress per ayah (FSRS data), completed surahs and juz, learning statistics and streaks, daily progress, and your app settings (reciter, language, font size, etc.). Data is stored with Supabase (USA). Legal basis: Art. 6(1)(a) GDPR (consent through voluntary registration). — For the device overview in the settings, we store for each device you are signed in on: platform, operating system and version, device model, browser and version, app version, country, language, time zone, window size, network type, the browser identifier (user agent), the device name and the time of first and last use. Signing in a new device and signing a device out are logged. To recognise a device, we store an identifier: in the browser a randomly generated one in localStorage, in the app the one assigned by the operating system. This lets you see where your account is signed in and sign out other devices. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of your account), and § 25(2) No. 2 TDDDG for the identifier.

When you send feedback while signed in, we store the text, the kind of feedback and your display name. You can make a feature request public: once we approve it, other users see it with your display name and can vote for it. You can report other people's public suggestions and block their authors; we then store the reported suggestion, the reason and your optional text, or the person you blocked. Only the QuranH team sees reports, and nobody who is reported or blocked learns by whom. To make feedback and replies readable in all app languages, our server translates them automatically: it sends the title and text, without your name or email address, to OpenRouter (OpenRouter, Inc., USA), which forwards them to a language model. Providers that use inputs for training are excluded. If you are signed in, the app occasionally asks after a lesson how it went, and less often how likely you are to recommend QuranH. If you answer, we store the score with your account, your optional comment, the app version and the platform (website, Android or iOS), and for a lesson also which verses it covered. The score is stored as soon as you tap it, even if you never press send. Legal basis: Art. 6(1)(a) GDPR (voluntary submission), and for handling reports Art. 6(1)(f) GDPR (our legitimate interest in respectful conduct in the app). This data is deleted together with your account.

With an account, you can start a group or join one through an invite link or code. For the ranking, our server reads from your synced learning progress only on which days you completed or started your daily plan, and notes when that first arrived; from this it calculates points, places and trophies. The other members see your display name and profile picture, since when you have been in the group, whether you lead it, your points, for each day of the week whether you completed or started it, and your trophies in this group. They do not see what you know by heart, which verses you are learning, your streak or your email address. Anyone who is signed in and knows the code sees, before joining, the group's name, the number of members, the lead's name and picture, and up to five profile pictures. The app does not accept names containing words from our list of words that are not allowed for groups, and others do not see such names there. You can report groups and members because of their name and block people; we then store the reported name, the reason and your optional text, or the person you blocked. Only the QuranH team sees reports; it can replace a group name with a neutral one, delete a group, remove a member or suspend an account. Nobody who is reported or blocked learns by whom. If you leave a group, you appear in its earlier results without name and picture; you keep your trophies. The others also see whether you allow nudges. If you react to a member’s completed day or nudge them, only that member sees it, with your name; we store sender, recipient, day and the chosen word for five weeks. If you allow notifications in the app from the stores, we store an identifier of your device (push token) with the app’s language and time zone; notifications are delivered via Firebase Cloud Messaging (Google, USA) on Android and the Apple Push Notification service (Apple, USA) on iPhone. We delete the identifier when you sign out, when Google or Apple report it as invalid, and at the latest 270 days after it was last used. The legal basis for notifications is your consent (Art. 6(1)(a) GDPR), which you can withdraw in your phone’s settings or in the app under Reminders (“Allow nudges”). Legal basis: Art. 6(1)(a) GDPR (your consent by starting or joining a group, which you withdraw by leaving it), and for reports and the list of words that are not allowed Art. 6(1)(f) GDPR (our legitimate interest in respectful conduct in the app).

QuranH collects usage data in two tiers. — Without consent: pages visited, where the visit came from (referrer and campaign parameters), device type and browser name, whether you use the website or the Android or iOS app, your country (determined via GeoIP headers from the hosting provider), whether you are signed in, and a randomly generated session ID. That ID is held in memory only and disappears when the page reloads; no cookies are set for it and nothing is written to sessionStorage or localStorage. Because no access to your device takes place, § 25(1) TDDDG does not apply. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the application). No link to your account is made; only the country determined this way is stored once in your profile if you are signed in. — Only with consent: learning events (e.g. ayah learned, lesson finished or left early), measurements of loading times (see error tracking) and, if you are signed in, linking the data to a pseudonymous user ID. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time in the settings. — All data is stored in our own Supabase database and is not shared with third parties.

This website uses the fonts "Amiri" and "Inter". The fonts are hosted locally on our server (self-hosting). No connection to external font services such as Google Fonts is made. No data is transmitted to third parties.

We use Sentry (Functional Software Inc., USA) as a data processor for detecting and fixing technical errors. Basic error tracking (error type, stack trace, browser/device information, accessed page, pseudonymous user ID) is technically necessary and always active (legal basis: Art. 6(1)(f) GDPR). IP addresses are not stored with error reports. Only with your consent does Sentry also measure the app's loading times, for about 10% of page views (legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG). No email addresses or learning progress data is sent to Sentry.

The website is hosted via GitHub Pages (GitHub Inc. / Microsoft Corporation, USA). When accessing the site, server logs with your IP address, browser information, and access time are automatically created. This data is processed by GitHub and deleted after approximately 180 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website).

QuranH loads recitations and word audio from these services: verses.quran.com and audio.qurancdn.com (Quran Foundation, USA), audio-cdn.tarteel.ai (Tarteel, USA), and everyayah.com and mirrors.quranicaudio.com (via BunnyCDN, BunnyWay d.o.o., Slovenia). Which service is contacted depends on the reciter you choose. When retrieving this data, your IP address is transmitted to the respective service. Translations, word-by-word data and tajweed colours come from our own database or are delivered with the app. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing core functionality).

Some of the services we use are based in the USA (Supabase, Sentry, Resend, GitHub/Microsoft, Quran Foundation, Tarteel, OpenRouter and the language model provider selected there). Data transfers to the USA are based on the EU-US Data Privacy Framework (adequacy decision by the EU Commission pursuant to Art. 45 GDPR). Where recipients are not certified under the DPF, transfers are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Account data (email, display name): Deleted immediately upon account deletion. Learning progress and settings: Deleted upon account deletion; locally stored data can be cleared at any time via your browser settings. Device overview (with the log of sign-ins and sign-outs): Kept as long as your account exists and deleted with it. Groups: memberships until you leave the group; weekly results and trophies as long as your account exists; the times at which a learning day first arrived, five weeks; reactions and nudges five weeks; device identifiers for notifications until you sign out, at most 270 days after their last use; reports until the reporting or the reported person deletes their account. Usage analytics: We keep the individual entries for 12 months. After that, we combine them into daily counts and delete them. Each daily count records a single attribute, for example how many visits came from Germany on a given day. Values that occur fewer than three times on a day are counted together under “Other”. These counts cannot be linked to any person, and we keep them for statistics. If you delete your account, we remove the link between the entries and your account immediately. Error data (Sentry): Automatically deleted after 90 days. Server logs (GitHub Pages): Deleted after approximately 180 days.

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR). Where processing is based on your consent, you have the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). In particular, you may object to processing based on legitimate interests (Art. 6(1)(f)) at any time for reasons relating to your particular situation. To exercise your rights, please contact us by email at info@quranh.com. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, poststelle@ldi.nrw.de.

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The spaced repetition algorithm (FSRS) is used exclusively to optimally design your learning plan and has no legal or similarly significant effects.

We reserve the right to update this privacy policy as needed, for example in response to changes in the application or legal requirements.