1 — How you sign in

• Email with a one-time code.
• Email and password. We never store or see your password; our cloud auth provider stores it hashed.
• Google account — we receive your email and Google identifier only.
• Apple account — we receive your Apple identifier, and your email if you allow it.
• Phone number via WhatsApp — you send a verification word from your WhatsApp to our bot number, so we receive your phone number. We send no marketing messages.
• As a guest, with no account — your work stays on your device.

2 — What we collect

• Account: email or phone (whichever door you used), display name, username, internal ID.
• Your content: plans and their Qur'anic range and schedule, circles, session records (rating, mistake count, notes), attendance.
• People you add: their name and optionally email, phone or avatar. You are responsible for obtaining their consent before entering their data. Members can be added with no contact details at all.
• Device: device name, type, platform, last-active time, and a random app-generated identifier — for sync and your linked-devices list. It is not an advertising identifier and is never used for tracking.
• Problem reports you send from inside the app, with your app version and device model.

3 — What we do not collect

• No location data.
• No access to contacts, camera, photos or microphone.
• No analytics or tracking tools, no ads, no advertising ID, no tracking pixels.

4 — Where your data is stored and who processes it

Your data lives on your device and in the cloud so sync can work. Three processors act on our behalf:

• Supabase — authentication, database and sync. Servers in Frankfurt, EU.
• Resend — delivers invitation emails. Receives only the recipient address and the invitation text.
• A WhatsApp Business provider — relays the verification message you send if you sign in by phone. WhatsApp's own policy applies as well.

5 — Sharing

• We do not sell your data, rent it, or share it with data brokers or advertisers.
• Data is shared only with people you explicitly invite to a plan or circle, and only as far as collaboration requires.
• We may disclose data where the law requires it, or to protect the service and its users.

6 — Deletion and retention

We keep your data while your account exists. You can delete it at any time, from inside the app or by emailing us.

Read the account deletion page: how to delete, and exactly what is removed →

7 — Guest mode

You may use the app without an account; your work stays on your device and collaboration features are disabled. If you later create an account on the same device, your work is carried over to it.

8 — Children's privacy

The app is not directed at children under 13, and we do not knowingly collect data from a child who signs up on their own. A teacher or guardian may enter a young student's name as a circle member — in that case the person entering the data is responsible for obtaining guardian consent. If you believe a child's data was entered without proper permission, email us and we will remove it.

9 — Security

Everything travels over encrypted connections (HTTPS/TLS), and row-level access rules govern who can read what. We take reasonable care, but no internet service can guarantee absolute security.

10 — Changes

We may update this policy from time to time and will publish the updated version at this address with a new effective date.