Privacy Policy

This Privacy Policy explains how Qiraa collects, uses, stores, shares, and protects personal data when you use the Qiraa mobile application, qiraa.io, related websites, account and family features, Qur’an reading and memorization tools, recitation and pronunciation features, customer support, subscriptions, and other services that link to this Policy (together, the “Services”).

“Qiraa,” “we,” “us,” and “our” mean the Qiraa operator identified in the applicable app-store listing, purchase confirmation, or other service notice. Qiraa is the controller of personal data used for our own purposes. Some providers process data for us under contract, while Apple, Google, Microsoft, content providers, and payment platforms may also process data under their own terms.

This Policy applies to account holders, guest learners, household members, parents and guardians, website visitors, and people who contact us. It does not govern a third-party service you choose to open outside Qiraa.

Qiraa is designed so that meaningful learning can happen with limited data collection. Much of your progress, settings, downloaded content, and ordinary practice data can remain on your device. An account is used for sign-in, entitlements, family features, and optional cross-device services.

• We do not sell personal data.
• We do not use third-party advertising or cross-app behavioral tracking.
• We do not use your voice to identify you or create a biometric identity template.
• Ordinary on-device recognition does not send the recording to Qiraa.
• Server recitation features process audio to return feedback and do not retain the recording by default.
• Detailed Microsoft Azure pronunciation scoring is optional and requires a separate cloud-scoring choice.
• Keeping recitations to improve future Qiraa models is a separate, off-by-default contribution choice.
• You can manage privacy choices, recording retention, cloud backup, family sharing, and account deletion in the app.

Depending on how you use Qiraa, you may provide:

• account information, such as your email address, display name, password, and sign-in provider;
• household and learner-profile information, such as a learner name or nickname, age or age range, avatar choice, learning level, goals, preferred practice time, and parent or guardian role;
• preferences and choices, including language, reciter, translation, accessibility, notification, audio-processing, contribution, backup, and family-sharing settings;
• support, contact, early-access, survey, or feedback messages and any information you include in them;
• purchase, promotion, or redemption information needed to verify an entitlement; and
• recitation audio when you deliberately use a recording, server-feedback, cloud-scoring, or contribution feature.

Please avoid including unnecessary personal information in free-text support messages or voice recordings. Do not record another person unless you are authorized to do so.

For email accounts, Qiraa stores the email address, display name if supplied, a one-way password hash, account identifier, account provider, creation time, and recent account activity. We do not store your readable password.

If you choose Sign in with Google or Sign in with Apple, the provider and Firebase Authentication process the sign-in request and return an identity token to Qiraa. Depending on your provider settings, Qiraa may receive your name, email address, provider identifier, and an indication that the token is valid. Apple may provide a private relay email address, and it normally provides a name only on the first authorization.

Qiraa issues its own session token after sign-in. The app stores the session and basic account profile on the device so you can remain signed in. You can sign out or delete the account from the app.

A household may create more than one learner profile. A profile can contain a name or nickname, age, learning level, learning goal, avatar, daily target, reminder preference, parent status, and controls for recitation checking, audio contribution, progress backup, and progress sharing.

Family plan features may connect accounts through an invitation link. We process the family-group identifier, inviting and accepting account identifiers, invitation status and expiry, membership, plan sharing, and the member’s progress-sharing choice. A family owner may see the learning information that a member has chosen or been validly authorized to share.

Parent PINs and device biometric checks are local access controls. Qiraa does not receive your fingerprint, Face ID image, or biometric template; authentication is performed by the device operating system. A local PIN is a convenience gate, not a substitute for device security.

Qiraa can create learning records such as reading position, bookmarks and marks, selected translations and reciters, completed lessons, letter and concept mastery, practice history, streaks, goals, memorization plans, review schedules, recitation results, mistake words, pronunciation scores, generated feedback, progress reports, and feature preferences.

Most of this information is stored locally. If you are signed in, eligible for cloud sync, and cloud backup is enabled for the active learner, selected learning stores are sent to Qiraa’s server so progress can merge across devices. Synced stores can include habit, activity, reading, mastery, curriculum, memorization, mistake, recitation-history, reading-plan, hifz-plan, Qur’an-mark, and family-connect data.

Qiraa uses these records to remember your place, recommend a useful next step, produce progress views, enforce learner and family settings, and restore or synchronize learning. We do not use learning performance to make decisions that produce legal or similarly significant effects.

Qiraa asks for microphone permission only when a voice feature needs it. The interface should show when recording is active. You can deny or revoke microphone permission in device settings, although voice features will then be unavailable.

For ordinary local practice, recognition can run on the device and the audio does not leave it. Qiraa may save a WAV recording locally so you can replay a recitation or review a mistake. Local review recordings are normally retained for the period selected in the app—30 days, 90 days by default, or indefinitely—and can be removed through Qiraa’s data controls, profile deletion, account deletion, or device storage controls.

Local data may still be included in a device backup controlled by Apple, Google, your operating system, or your backup settings. Qiraa does not control those independent backups.

When you use an enabled AI Tutor, live-following, verification, hifz-review, letter-checking, or similar server feature, Qiraa may transmit the recorded audio, the expected Qur’anic text or exercise, learner and session identifiers, consent version, app/device class, and technical request data to Qiraa’s server and, when needed, a contracted private compute worker.

The audio is decoded and analyzed to return matching, timing, pronunciation, tajweed, or progress feedback. Normal verification and live processing are designed to occur in memory and not to save the raw recording on Qiraa’s server. We may retain non-audio results and operational records such as the expected passage, outcome, score, detected issue, usage count, request digest, session state, latency, and error category to deliver the feature, prevent duplicate billing, enforce quotas, secure the service, and improve reliability.

AI and speech recognition can be wrong, especially with background noise, uncommon accents, young voices, microphone differences, or difficult passages. Feedback is educational assistance, not an authoritative religious ruling or certification.

If you affirmatively enable detailed cloud pronunciation scoring, Qiraa sends the relevant recording and reference text through Qiraa’s server to Microsoft Azure Speech for a score and related feedback. Qiraa keeps the Azure credential on its server and does not place it in the app.

Microsoft states that real-time speech-to-text and pronunciation-assessment inputs are not retained by Microsoft after the request. Qiraa may cache the returned score, transcript or “heard” text, feedback, and a cryptographic audio hash so repeated identical requests can be answered efficiently; the raw audio is not stored in that assessment cache.

Cloud scoring is separate from on-device practice. You can refuse or withdraw the cloud-scoring choice without losing ordinary local learning features. Withdrawal stops new cloud-scoring requests but does not undo processing already completed.

Qiraa may invite you to contribute completed recitation clips for evaluation, research, and improvement of future speech and learning models. This is separate from live feedback, off by default, and should require an affirmative contribution choice plus any applicable parent or guardian authorization.

When enabled, Qiraa may retain the audio clip together with the expected passage, surah and ayah, timestamp, consent version, app and model version, broad device class, duration, automated verdict, processing method, and quality flags. We use this material to review errors, evaluate recognition across voices and accents, create training or test datasets, and improve Qiraa models.

You may withdraw the contribution setting at any time to stop future contributions. Contact us if you want us to locate and delete a previously contributed identifiable clip. Once information has been irreversibly de-identified, aggregated, or incorporated into a trained model in a manner that cannot reasonably be linked back to you or extracted, deletion may not be technically possible. Qiraa does not sell contributed recordings or license them for advertising.

Apple App Store or Google Play normally processes the payment method and full billing details. Qiraa generally receives product identifier, purchase or transaction identifier, store source, receipt or verification token, purchase status, restore status, plan, trial timing, renewal or expiry information, and limited error information needed to verify and provide the subscription.

We use this data to activate Premium or Family access, restore purchases, prevent fraud and duplicate redemption, apply trials or promotional offers, provide support, and satisfy accounting or legal obligations. Qiraa does not receive your full payment-card number from an app-store purchase.

The app store controls its own payment and purchase-history data under its privacy terms. Cancelling an account does not necessarily cancel an app-store subscription; cancellation must also be completed through the applicable store.

Qiraa may process a randomly generated per-install identifier for guest AI quotas. It is not a hardware identifier or advertising identifier. Signed-in requests use an account identifier. Requests also inherently provide network and technical information such as IP address, time, endpoint, app version, operating-system or broad device class, language, response status, session identifiers, usage counts, and security or error records.

The website may use essential storage or cookies for language selection, security, content-management administration, and session operation. We currently do not use third-party advertising cookies or behavioral advertising trackers. If that changes, we will update this Policy and provide any consent controls required by law.

When the app streams Qur’an recitation audio, opens a video, or follows an external link, the relevant content host or CDN may receive IP address and ordinary request metadata. Qiraa does not request precise GPS location, contacts, camera access, or an advertising identifier for the features described in this Policy.

We use personal data only for defined purposes, including:

• providing accounts, guest access, lessons, reading, memorization, recitation, family, support, and synchronization features;
• personalizing the learning path, remembering choices, calculating progress, and generating feedback;
• processing explicit audio requests and honoring audio, backup, contribution, and sharing controls;
• verifying subscriptions, applying entitlements, administering trials and promotions, and supporting purchases;
• protecting learners, authenticating users, enforcing permissions and quotas, preventing fraud or abuse, and diagnosing failures;
• communicating service, security, account, legal, support, or—where permitted—marketing messages;
• measuring reliability and improving content, models, accessibility, and product design using proportionate information; and
• complying with law, enforcing agreements, and establishing, exercising, or defending legal claims.

We do not use personal data for unrelated advertising or data-broker purposes.

Where European or UK data-protection law applies, our legal basis depends on the activity:

• Contract: to create and operate an account, deliver requested learning and family features, synchronize eligible progress, verify purchases, and provide support.
• Consent: for optional cloud scoring, contributed recordings, optional marketing, and other processing for which the app requests a choice. Consent can be withdrawn for future processing.
• Legitimate interests: to secure and maintain the Services, prevent fraud and misuse, understand failures, improve reliability, protect our rights, and make proportionate product improvements, after considering user rights and expectations.
• Legal obligation: to keep records, respond to lawful requests, protect rights, and comply with tax, accounting, consumer, or regulatory requirements.

Using a Qur’an-learning service may reveal or allow an inference about religious or philosophical beliefs. We do not create an advertising faith profile. To the extent applicable law treats relevant data as a special category, we apply additional safeguards and rely on explicit consent or another condition permitted by law. Audio is not processed for biometric identification.

We share only what is reasonably necessary with:

• Qiraa personnel and authorized contractors who need access for support, security, operations, content, or model review;
• infrastructure, hosting, storage, email, security, and private-compute providers acting for Qiraa;
• Google Firebase, Google Sign-In, and Apple Sign-In when you choose social authentication;
• Microsoft Azure Speech when you separately enable cloud pronunciation scoring;
• Apple App Store and Google Play for products, purchases, subscriptions, and restoration;
• Qur’an text, recitation-audio, translation, video, and content hosts when your device requests their material;
• the family owner or connected household members, but only for family information and progress sharing enabled for that relationship;
• professional advisers, auditors, insurers, investors, or a successor in a merger, financing, restructuring, or sale, subject to appropriate confidentiality and legal safeguards; and
• courts, regulators, law enforcement, or other parties when required by law or reasonably necessary to protect people, the Services, or legal rights.

Providers may change as the product evolves. We require service providers handling personal data for us to use it only for contracted purposes and apply appropriate safeguards.

Qiraa does not sell personal data for money. We do not share personal data for cross-context behavioral advertising, use third-party advertising SDKs, or track your activity across unrelated companies’ apps and websites for targeted ads.

We do not knowingly use data from children for targeted advertising, profiling for commercial persuasion, or data-broker activity. If Qiraa introduces advertising or a practice that qualifies as “sale” or “sharing” under an applicable law, we will update this Policy before the practice begins and provide the required opt-out or consent control.

Qiraa is digital and may use providers or infrastructure located outside your country. Personal data can therefore be processed in countries whose laws differ from those where you live.

Where required, we use a recognized transfer mechanism such as an adequacy decision, contractual data-protection clauses, provider data-protection terms, or another lawful safeguard. We also assess the data and provider, limit what is transferred, use encryption in transit, and apply access controls. You may contact us for more information about safeguards relevant to your data.

We keep personal data only while reasonably necessary for the purpose described, subject to legal, security, dispute, and backup requirements.

• Account and synchronized learning data are generally kept while the account is active and deleted when the account-deletion process completes, unless a limited record must be retained by law or to protect legal rights.
• Local review recordings follow the 30-day, 90-day default, or “forever” choice on the device and can be deleted earlier.
• Normal server verification and live-recitation audio are not retained as recordings by default.
• Cloud-scoring results and operational caches are kept only as needed for delivery, efficiency, security, quality, and quota administration.
• Purchase, tax, fraud, consent, security, and transaction records may be retained for the period required by law or reasonably necessary to resolve disputes.
• Family invitations expire, while membership records last until the relationship, group, or account is removed.
• Opt-in contribution clips may be retained for research and model improvement until no longer needed, consent is validly withdrawn and the clip can be identified, or applicable law requires deletion.
• De-identified or aggregate information that can no longer reasonably identify a person may be retained for research, statistics, safety, and improvement.

Deletion from active systems may not immediately remove data from encrypted disaster-recovery backups; isolated backup copies are protected, not used for ordinary purposes, and expire through the backup cycle.

Qiraa uses safeguards appropriate to the nature of the information, including encrypted network transport, password hashing, signed sessions, scoped authorization, consent checks, limited administrative access, separate private worker credentials, quota and abuse controls, and deletion tools. We seek to minimize recording retention and keep ordinary recognition on-device where practical.

No app, transmission, or storage system is guaranteed to be completely secure. Protect your device, account email, app-store account, and password; use a unique password; keep software updated; and tell us promptly if you suspect unauthorized access.

If a personal-data incident occurs, we will investigate and provide notices to users or authorities when applicable law requires it.

The app provides controls for microphone permission, server audio processing, cloud pronunciation scoring, recording contribution, recording-retention period, learner cloud backup, family progress sharing, reminders, learner deletion, local progress reset, sign-out, and account deletion.

Depending on where you live, you may have rights to know or access personal data, receive a copy, correct inaccurate data, delete data, restrict processing, object to certain uses, withdraw consent, obtain portable data, appeal a refusal, and complain to a privacy regulator. California residents may also request the categories, sources, purposes, and recipients of covered information and receive equal service when exercising applicable rights. Because Qiraa does not sell or share data for targeted advertising, there is no such sale or sharing to opt out of under our current practices.

We may need to verify identity and authority before fulfilling a request, especially for a child or household member. Authorized agents may be required to show authority. Rights can have legal exceptions, and we will explain a material refusal where required.

Qiraa is a learning service that may be used by children only with appropriate parent or guardian involvement. A child below the age at which they may independently consent to online data processing must not create or manage an independent account. A parent or guardian should create or control the household, choose the child’s settings, and authorize any collection that requires parental consent.

Parents and guardians can review learner profiles and shared progress, disable recitation checking or backup, turn off contribution, remove a learner, reset local learning data, delete recordings, and request access to or deletion of a child’s personal information. Qiraa should not require a child to provide more personal information than reasonably necessary for the activity.

If we learn that personal data was collected from a child without required authorization, we will take reasonable steps to delete it or obtain valid authorization. Contact us if you believe a child is using Qiraa without appropriate permission. Qiraa contains no behavioral advertising and does not sell children’s information.

Qiraa models may infer whether audio matches expected text, where a reading may differ, what needs review, and which learning step may be useful next. These outputs are probabilistic educational suggestions.

Qiraa does not use these systems to establish identity, determine eligibility for employment, credit, housing, insurance, healthcare, or government services, or make a solely automated decision that produces legal or similarly significant effects. A learner can repeat an exercise, use on-device alternatives, turn off optional processing, or seek guidance from a qualified teacher.

We may use de-identified, aggregate, simulated, licensed, or expressly contributed material to evaluate and improve models. We do not train general advertising profiles on your Qur’an learning activity.

We may update this Policy when Qiraa’s features, providers, legal obligations, or data practices change. We will post the revised version with a new effective date. If a change is material, we will provide additional notice in the app, on the website, by email, or through another appropriate channel.

Where consent is legally required for a new purpose, an update to this text alone is not consent; Qiraa will request the necessary choice. Previous versions may be retained for legal and audit purposes.

For privacy questions, parent requests, access, correction, export, deletion, withdrawal of an audio contribution, or a complaint, contact Qiraa at the address below. Please do not email passwords, raw identity documents, or sensitive recordings unless we specifically request a secure method.

To help us respond, state the account email, the nature of the request, the relevant learner if applicable, and your country or region. We may ask for proportionate verification. You may also complain to the data-protection or consumer-privacy authority where you live.