Privacy Policy

1. Who we are

HifzMate is a Qur'an memorization and revision app developed and operated by Noor AI, an independent software studio. For the purposes of the GDPR and comparable laws, we are the controller of the limited personal data described below. You can reach us at privacy@hifzmate.app.

2. What we collect

HifzMate is built to keep data on your device. Two things can leave it, and only when you ask: a recording you submit for a recitation check, and — if you switch on cloud backup — a copy of your progress. In practice there are five categories:

If you do not sign in, we do not collect your name or email address at all. If you do sign in, we receive only the name, email address and account identifier that Google or Apple provides — never your phone number or contacts. We do not use advertising identifiers for tracking, and we do not build advertising profiles.

3. How the recitation check works

When you record yourself reciting and ask for feedback, the recording is sent over an encrypted connection to our processing service, and from there to the speech providers listed below, which return a transcript or a phoneme-level analysis. That result is compared against the verified Qur'anic text on your device to mark each word as correct, wrong or skipped.

• Word-level check — runs automatically after a recording in a memorization session.
• Tajweed (phoneme) check — a separate, optional check you start yourself, on one verse at a time.

If you are offline, or you never use the voice check, no audio leaves your device at all — reading, memorizing and revising work entirely offline.

4. Where your data lives

Your progress, revision schedule, notes, bookmarks and settings are stored in the app's local storage on your device. The app is fully usable this way — signing in is optional and so is backup.

If you sign in and switch on Cloud backup, a copy of that data is also stored on our servers (Supabase, United States — Ohio), so you can restore it on a new device. Until you switch backup on, nothing about your progress is transmitted to us and we cannot see it.

Without backup, uninstalling the app removes the data — if you delete the app or lose the device, it is gone. That is exactly what backup is there to prevent.

5. Accounts and cloud backup

An account is optional. The whole app — reading the mushaf, memorizing, revising — works without one. If you sign in with Google or Apple we receive your name, email address and account identifier and store them with our authentication provider (Supabase, United States) so we can recognise you on your next visit. We never post anything to your Google or Apple account and we do not read your contacts.

Signing in with Apple. Apple lets you hide your email address. If you do, we never see your real address — only the relay address Apple generates for you (@privaterelay.appleid.com), which forwards to you without revealing it to us. Apple also sends your name only the first time you authorise the app, so it can be missing on later sign-ins. When you delete your account we also revoke the app’s authorisation with Apple, so HifzMate disappears from your Apple ID settings.

Cloud backup is separate from signing in, and it is off until you turn it on (Profile → Account). When it is on, we store the following against your account:

• Memorization progress and per-page/per-verse completion.
• Revision cards (your spaced-repetition schedule).
• Bookmarks, "hard spot" marks and notes.
• The days you practised, so your streak survives a device change.
• App settings and onboarding answers (goal, level, daily time).

Your voice recordings are never backed up. They stay on your device; the only time audio leaves it is the recitation check described in section 3, and that audio is not retained.

You can switch backup off at any time. When you do, we ask whether the copy already in the cloud should be deleted as well — your account and the data on your device are kept either way. Backing up and restoring is free; using several devices at the same time is a paid feature.

6. Third-party processors

We use a small number of providers to run the recitation check and this website. They process data on our instructions and only for the purposes below.

Most of these providers are outside the EEA: our servers, the account provider and the speech providers are all in the United States. Where your data is processed there, the transfer is necessary to provide the feature you asked for and is covered by the providers' standard contractual clauses. Crash reports stay inside the European Union. Child profiles never reach the speech providers, because the cloud voice check is disabled for them.

7. Crash reports

When the app crashes or hits an unexpected error, it sends a diagnostic report to Sentry so we can find and fix the fault. Alongside crash reports, the app can send usage statistics — see section 8. There is no advertising or marketing tracking and no profiling.

• What a report contains — the technical error trace, your device model, operating system version and app version.
• What it never contains — your name, email address, account, memorization progress or recordings. We ask Sentry not to record your IP address.
• Screenshots and screen contents are switched off, and the app's own log messages are stripped before a report is sent, so Qur'an text and your practice history cannot leave your device this way.
• Where it goes — Sentry's European Union (Germany) region.
• How long it is kept — a limited period, about 90 days, after which it is deleted automatically.

Crash reporting is active in the released app and is used only to fix faults. It is not used to build a profile of you and it is not shared with anyone else.

8. Usage statistics

Unless you switch it off, the app records how it is used and sends a daily summary to our own servers. We use this to see which features are actually used and where people get stuck. There is no third-party analytics service involved and nothing is sold or shared.

• What we record — the names of the screens you open, how long you actively spend on each, how many times you open the app and the hour of day, a small set of feature events (for example completing a lesson, running a recitation check, opening or leaving the premium screen), and coarse setup choices such as your goal, level, daily minutes and how many juz you marked as already known.
• What it never contains — page, juz, surah or verse numbers, any Qur’an text or words, your memorization progress or mistakes, your name, your email address or your IP address.
• How it is identified — by a random identifier created inside the app, separate from the identifier used for cloud backup. If you are signed in, your account identifier is stored alongside these rows, so that deleting your account also deletes them.
• How to switch it off — Privacy & data in the app. Switching it off stops all collection, deletes what has already been sent from this device, and issues a new identifier.
• How long it is kept — 13 months, then deleted automatically.

Only whole, completed days are sent, at most once a day, and never while you are still using the app that day. Development builds send nothing at all.

9. Rewarded ads

HifzMate shows no banners and no ads inside the mushaf. The only advertising is a reward video you choose to watch in order to earn one extra AI recitation check when your free daily allowance runs out. If you never start one, no advertising request is ever made.

• What AdMob receives — your device's advertising ID, approximate region and technical device details, so the video can be served and counted, together with interaction and performance signals from that ad session (for example whether the video played to the end), which Google also uses for measurement and fraud prevention.
• What it never receives — your recordings, your memorization progress, your notes or your account details.
• Non-personalised only — we request non-personalised ads, and we cap ad content at the general-audience rating so that categories such as gambling or dating are not served next to Qur'an study.
• In the EU and UK we ask for your consent first. If you decline, no ad is requested, you simply do not earn the extra check, and nothing else in the app changes or locks.
• You can reset your advertising ID at any time in your device's system settings.

10. Subscriptions and payments

HifzMate is free to use, with an optional premium subscription. The payment itself is handled entirely by the app store (Google Play, or the App Store on iOS) — we never see your card number, billing address or any other payment details, and no payment data reaches our servers.

To confirm that a subscription is genuine and to keep your premium status correct across your devices, we use RevenueCat (United States) as our subscription processor.

• What RevenueCat receives — the purchase and receipt details the store provides (which plan, when it renews, whether it is active), your device and app version, and, if you are signed in, your account identifier, so the subscription can be attached to your account rather than to one device.
• What it never receives — your recordings, your memorization progress, your notes or your email address.
• If you never subscribe, there is nothing to process and no purchase data is created.
• Restoring — you can restore an existing subscription on a new device from the premium screen; this asks the store what you already own.
• Managing or cancelling — subscriptions are managed and cancelled in your Google Play or App Store account, not by us, and the store's own refund rules apply.

11. Age

HifzMate is for people aged 13 and over. The app does not ask for your date of birth and does not create child-specific profiles or modes. If a family shares a subscription, deciding who uses the app and supervising younger members is up to the family.

• We do not collect a date of birth or any age information.
• Recordings are kept minimal and can be deleted in one tap from the app's Privacy screen.
• A family plan owner sees only seat status — never another member's progress, recordings or notes.

We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe a child under 13 has used the app and provided personal data, contact privacy@hifzmate.app and we will delete it promptly.

12. Legal bases (EEA/UK)

• Performance of a contract — processing your recording to give you the recitation feedback you requested; and, if you subscribe, processing your purchase so we can give you the premium features you paid for.
• Legitimate interests — daily request counters keyed to your IP address, to prevent abuse and control the cost of a service we pay for per use; crash reports, to keep the app working; and usage statistics, to understand which features are used and improve the app. You can object to the usage statistics at any time by switching them off in the app. None of these are used to profile you or to make decisions about you.
• Consent — the optional tajweed analysis, which you start explicitly; the reward videos, for which we ask separately in the EEA and UK before any ad is requested; and parental consent for users aged 13–17.

Voice recordings analysed for recitation feedback are used to assess your reading, not to identify you, and we do not use them for biometric identification.

13. Retention

• Recordings — not retained on our servers; processed and discarded. Copies on your device remain until you delete them or uninstall the app.
• Progress, notes, settings — kept on your device until you delete them in the app or uninstall.
• Cloud backup copy (only if you switched backup on) — kept until you delete it from the app or delete your account. Switching backup off offers to delete it immediately.
• Account record (name, email, Google or Apple identifier) — kept until you delete your account.
• Request counters — a per-day count against an IP address, kept only for abuse prevention and not linked to any profile or recording.
• Crash reports — kept by our provider for a limited period, about 90 days, then deleted automatically.
• Usage statistics — kept for 13 months, then deleted automatically. Deleted immediately when you switch them off, delete all of your data in the app, or delete your account.
• Subscription records (only if you subscribe) — the purchase and renewal history is kept by our subscription processor for as long as the subscription exists and for the period the app stores and tax rules require afterwards.

14. Your rights and controls

The app's Privacy & data screen (Profile → Privacy) gives you direct control:

• Export my data — saves everything on this device to a JSON file you can keep or move elsewhere. Voice recordings are not included; they stay on your device.
• Delete your voice recordings.
• Delete downloaded recitation audio.
• Switch usage statistics off, which also deletes the statistics already sent from this device.
• Delete all of your data on this device, which resets the app to first-time setup. This also turns cloud backup off, so the wipe is not undone by the next sync, and deletes the usage statistics sent from this device; a backup copy already in the cloud is kept until you delete it.

If you use cloud backup, the app offers two further deletions in Profile → Account: turning backup off lets you delete the cloud copy on its own while keeping your account, and Delete my account removes the account together with its backup from our servers.

These in-app controls are the fastest way to exercise deletion and portability. If you are in the EEA, the UK or another region with comparable law, you also have the right to access, correct, delete, restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority. Write to privacy@hifzmate.app and we will respond within 30 days.

15. This website

hifzmate.app is a static page. It sets no cookies, embeds no third-party scripts and runs no analytics or advertising trackers. As with any website, our host (Cloudflare) processes standard request data such as IP address for security and to serve the page.

16. Changes and contact

We may update this policy as the app develops — for example when a feature starts handling data differently, or when we add a provider. The current version always appears on this page with its date, and material changes will also be surfaced in the app.

Questions, requests or concerns: privacy@hifzmate.app. General enquiries: hello@hifzmate.app.