Privacy Policy

What data we collect, and why

Account data: your email, a display name, your app language and your chosen reading (riwaya). Basis: performing our contract with you (running your account) and, for language/riwaya, our legitimate interest in showing you the right content.

Recitation sessions (recite_sessions): when and what you recited, session length, and summary results (accuracy, streaks). Basis: performing our contract with you — this is the feature you asked to use.

Mistakes and mastery (recitation_mistakes, word_mastery, hesitation_weak_spots): which words or rules you struggled with, so the app can build your review queue and weak-spot practice. Basis: performing our contract with you.

Referrals and entitlements (referrals, entitlements): who invited you or whom you invited, and what your account is entitled to (free allowance, any paid plan). Basis: performing our contract with you.

Payment data: handled entirely by Stripe. We store only what plan you have and whether it is active; we never see or store your card number. See our Terms of Use for how Stripe acts as merchant of record.

Support email: if you email support@minhajy.app, we keep that conversation to help you and to improve the app. Basis: our legitimate interest in providing support, and performing our contract with you where the message is about your account.

AI tutor launch list: if you ask us to notify you when the AI tutor launches, we keep the email address you provide for that single purpose, use it only to send that one message, and delete it whenever you ask. Basis: your consent, which you give by submitting the form and may withdraw at any time.

Your recitation audio

When you use live recitation checking, your microphone audio is streamed to our GPU recognition server for the sole purpose of comparing what you said to the text of the Quran, live, while your session is open.

We have checked the server code directly for this policy: audio is written only to short-lived temporary files that exist while a chunk is being recognised, and are deleted immediately after. We do not keep a copy of your recitation audio on our servers, and it is never used to train a model, sold, or shared with advertisers or data brokers.

The "hear your recitation" playback you can use right after a session comes from a recording your own browser keeps for that purpose (see "Reopen last session" below) — not from anything we store on our servers.

"Reopen last session" — what your browser stores

If you close a results screen by mistake, Minhajy can bring the last session back. To do this, your browser (not our servers) keeps the last session's report and its audio recording locally, using a technology called IndexedDB.

This stays on your device: it is not uploaded anywhere new, it is overwritten as soon as your next session finishes, and it disappears if you clear your browser's site data or use private/incognito browsing (in which case the feature is simply unavailable).

Where your data is processed

Our database and file storage run on Supabase; our web app runs on Vercel; live recitation recognition runs on GPU servers on Modal. PLACEHOLDER, pending confirmation: the exact data-center region for each of these is not yet pinned in our infrastructure configuration, so we cannot state a precise country here without guessing. We will confirm and publish it (expected: EU and/or US data centers) before this policy is finalised — see docs/PRIVACY_DRAFT_REVIEW.md.

Where any of these providers processes data outside the EU/UK, we rely on the safeguards they offer (such as the EU Standard Contractual Clauses) as part of their standard terms.

How long we keep your data

PLACEHOLDER, pending an owner decision: exact retention periods for each table are not yet fixed. Our working principle is to keep account and progress data for as long as your account is active, and to delete it within a reasonable period after you delete your account or ask us to. We will replace this paragraph with exact periods once decided — see docs/PRIVACY_DRAFT_REVIEW.md.

Recitation audio itself is never stored on our servers in the first place (see above), so there is nothing to retain or delete there.

The leaderboard

You appear on the weekly consistency board only if you choose to (it is off unless you turn it on). If you do, others see your initials (or the name or anonymous label you pick) and the number of days you recited this week, never your word count, minutes, accuracy, email or anything else about you. You can turn it off at any time from Settings. The page also shows anonymous totals for everyone who recited that week (how many people recited 1 to 7 days, and the total words), only when enough people took part that no one can be singled out.

You can also switch how you are shown (initials, a chosen display name, or fully anonymous) from the same Settings screen.

Children and parental consent

Minhajy is used by children as well as adults, often as part of family or classroom Quran study. In France, the GDPR sets 15 as the age at which a person can consent to an online service on their own; below that age, a parent or guardian's consent is required.

PLACEHOLDER, pending an owner decision: Minhajy does not currently ask for a birth date or route under-15 sign-ups through a parent's consent — this is a gap we are tracking, not a feature we are describing as if it existed. Until it is built, we ask a parent or guardian to create and supervise the account for a child under 15, or under the age of digital consent where you live. See docs/PRIVACY_DRAFT_REVIEW.md.

Your rights

Under the GDPR and similar laws, you can ask us to: give you a copy of your data (access), correct it, delete it, export it in a portable format, restrict or object to some processing, and withdraw consent where processing relies on it. You also have the right to complain to your local data protection authority (in France, the CNIL).

To use any of these rights, email support@minhajy.app from the address on your account. We will respond within a reasonable time and may need to verify it is really you before we act.

Deleting your account removes your profile, session history, mistake and mastery data, referral and entitlement records associated with it, other than what we must keep for legal or accounting reasons (for example, records of a payment).

To prevent abuse of free trials we keep an irreversible fingerprint of the email address (a keyed hash, not the address itself) for 24 months after the account is deleted; a new account made with the same address then receives no trial sessions or referral gifts. Basis: our legitimate interest in preventing fraud (GDPR Art. 6(1)(f)).

Cookies and local storage

We use a small number of cookies and browser storage items to keep you signed in, remember your language and reading preference, and — as described above — to let you reopen your last recitation session. We do not use advertising or cross-site tracking cookies, and we do not sell or share data with data brokers or ad networks.

We also count anonymous product usage on our own servers (which pages are opened, for how long, and how long the recitation server takes to be ready), using a random browser identifier that is turned into a daily-changing code before anything is stored, with no account id, IP address or audio, kept for 90 days; it is off when your browser sends Do Not Track or Global Privacy Control, and you can turn it off in Settings.

Who else processes your data (subprocessors)

Supabase (database, authentication and file storage), Vercel (web hosting), Modal (GPU servers for recitation recognition), Resend (transactional email, such as password resets and digests), and Stripe (payments, once enabled — Stripe is the merchant of record for any purchase, as explained in our Terms of Use). None of these providers is permitted to use your data for their own purposes.

Changes to this policy

If we make a material change to this policy, we will show a notice in the app before it takes effect. The "last updated" date above always reflects the latest version.

Contact

Questions about this policy or your data: support@minhajy.app