Quran Memorizer

Open app
Buka aplikasi

Privacy Policy

Last updated: November 2, 2026

Quran Memorizer is operated by the brand Al Hidayah Apps, in New York, United States. This policy covers the iOS app, app.quranmemorizer.com and quranmemorizer.com. Contact [email protected] with privacy questions or requests.

Information we use

  • Account information: your email address, account and sign-in identifiers, username, selected avatar, and basic profile details supplied by your sign-in provider. We use these to create and secure your account, recognize you across devices and provide support.
  • Learning records: memorized ayahs, memorization dates, highlights, reading positions, answers and practice totals, review history and scheduling information. These support synchronization, personalized practice, review and progress displays. These records can reveal information about your religious practice.
  • Settings and usage: preferences, app-generated installation identifiers and usage counters needed to remember settings, synchronize changes and apply feature limits.
  • Purchases: payment-provider identifiers, subscription products, transaction identifiers, billing periods, renewal preferences and entitlement status. These let us verify purchases, provide Premium and resolve billing issues. Apple or Stripe processes payment details; we do not store your complete card details. An app-account identifier is sent to Apple with an in-app purchase to associate it with the correct account.
  • Technical and security information: IP addresses, browser or device information, session records and authentication or error logs used to deliver the service, secure accounts and investigate failures or abuse.
  • Support: messages, contact details and attachments you choose to send us. Do not send passwords, verification codes or payment-card details.

What the app does not access

Our iOS and web application code does not request device location or calculate your location from an IP address. We do not request microphone, contact-list or photo-library access. Listening to recitation does not record your voice. We do not request access to your Gmail messages, Google Drive files or calendar.

Services that handle online connections receive IP addresses. Google and website security and payment providers may process IP-related information, including general location, under their own privacy notices. This is separate from granting the app access to your device location. Version 1.1 of the iOS app uses browser-based Google sign-in and no longer includes the native Google Sign-In SDK. Earlier app versions may still use that SDK until you update.

We do not use your learning records for targeted advertising or to train AI models. We do not sell or rent personal information or provide it to data brokers.

Signing in

Google: If you choose Google, we receive your account identifier, email and basic profile information such as a name or profile-image link where available. We use these for authentication and account support. Version 1.1 of the iOS app opens Google’s sign-in page in Apple’s system authentication browser and requests only OpenID, email and basic profile scopes. We do not receive your Google password or access to your Gmail messages, Google Drive files or calendar. Google processes information about your use of its sign-in service under Google’s Privacy Policy.

Earlier iOS versions use the native Google Sign-In SDK. Google declares that SDK’s collection of name, email address, phone number, approximate location, user and device identifiers, other usage data and other data for authentication/app functionality and analytics, depending on the category. These SDK practices are separate from the basic profile information we receive in our own account database. Our app does not ask you to enter a phone number. See Google’s native sign-in privacy information.

Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable. Removing access in your Google Account settings does not itself delete your Quran Memorizer account.

Apple: If you choose Apple, we receive an account identifier, email address and your name when provided. Apple lets you edit the name you share. We do not receive your Apple password, device passcode, biometric information or access to your iCloud files.

If you choose Hide My Email, we receive Apple’s relay address rather than your personal inbox address, unless you separately share your personal address with us. The relay address remains linked to your learning and purchase records. Forwarding depends on Apple’s relay settings and supported sender configuration. Turning off forwarding may stop account emails reaching you.

Use the same Quran Memorizer account on each device to access the same synchronized records. Another account does not automatically inherit them.

Providers and sharing

We use service providers for the following functions:

  • Supabase: authentication, account and learning databases, file storage and backend operations. Our primary database is in the United States.
  • Apple and Google: the sign-in method you choose. Apple also handles App Store purchases.
  • Stripe: website subscriptions, checkout and billing administration. Stripe receives your email and an app-account identifier when a customer record is created.
  • Postmark: account-email delivery, including recipient details and message content. Message content and activity data have a 45-day retention setting. Aggregate statistics and suppression records can remain longer.
  • Hosting and security services: delivery and protection of our websites. Cloudflare handles website delivery and security. Wordfence provides security protection on the public WordPress website.
  • Google Fonts: font delivery on the web app. Font requests disclose technical connection information, including the IP address and browser request details.
  • Google Analytics: measurement of how visitors use quranmemorizer.com and app.quranmemorizer.com, such as pages viewed, links clicked, and when someone signs up, logs in or starts a Premium checkout. Google receives device, browser and connection information, including your IP address, and may derive approximate location for aggregate reports. We use these reports to understand which content and features help people and to improve the service. We do not send your name, email address or learning records to Google Analytics, and we have turned off optional data sharing with Google for its own products, benchmarking and recommendations.
  • Recitation content providers: Tarteel, QuranCDN and QuranicAudio deliver requested recitations. They receive connection information when audio is loaded.

Providers may process information outside your country. Apple, Google and payment providers also process information under their own privacy notices for services they provide directly to you. We may disclose information when legally required or necessary to investigate abuse and protect the service or its users.

Browser storage, cookies and the public website

The web app uses browser storage to maintain your sign-in session, remember preferences and cache supported activity. Cloudflare may set a security cookie to help distinguish legitimate traffic from automated requests. The public website uses WordPress session and security mechanisms for administration and protection.

Both websites use Google Analytics, which sets first-party cookies (such as _ga) to distinguish visits and measure usage. You can block or delete these cookies in your browser settings, or use Google’s Google Analytics opt-out browser add-on. Blocking them does not affect your use of the app.

If you visit from the EU, the UK or Switzerland, the website asks before it sets analytics cookies. Choose “Accept all” and Google Analytics works as described above. Choose “Necessary only” and no analytics or advertising cookies are set; Google Analytics still receives basic visit signals without cookies or identifiers (Google’s consent mode), which Google uses to estimate overall traffic. Visitors from other countries get analytics cookies by default. Your choice is saved for 180 days in a cookie named qm_consent, and you can change it at any time from “Cookie settings” at the bottom of every page.

When analytics is allowed, the website also stores a cookie named qm_attr on quranmemorizer.com and its subdomains. It records how you first and most recently arrived: the page you landed on, the website that sent you, and any campaign tags or ad click IDs in the link. It does not hold your name or email. We use it to understand which guides and campaigns bring people to the app, and it is removed if you choose “Necessary only”.

Website security tools may record suspicious requests, IP addresses and browser details. The Wordfence Live Traffic log is configured for security events only, with a 30-day maximum and a 2,000-entry limit. This limit applies to that traffic log, not to every provider or security record.

You can contact support by email. Information you send is used to respond to your request.

Local storage, reminders and test diagnostics

The iOS app keeps settings, a secure sign-in session, cached learning information and pending changes on your device. Clearing storage or uninstalling may remove changes that have not synchronized; it does not delete your server account.

Practice reminders are optional local notifications. You can turn them off in the app or iOS settings.

Internal and selected beta builds may offer diagnostic recording. Logs stay on the device unless you choose to share them. Shared reports can include technical events, purchase transaction identifiers and expiry dates. They are designed to omit passwords and sign-in tokens. Review a report before sharing it. Diagnostic recording is disabled in the public release configuration.

Resetting and deleting your information

Open Profile → Your data – Manage to use the data controls.

  • Reset highlights: removes saved highlights. Internal deletion identifiers prevent them from returning through synchronization. Memorization and practice history remain.
  • Reset practice history: removes practice statistics, review evidence and review state, including associated legacy statistics backups. Memorization, highlights and review preferences remain.
  • Reset memorization: removes memorization marks, dates and associated review enrollment. Highlights and practice history remain.
  • Delete account: removes the sign-in account, profile, learning records, stored files and associated records covered by account deletion, including legacy learning archives. For Apple sign-in accounts, the flow asks you to authenticate with Apple so authorization can be revoked before deletion completes.

These actions require an internet connection. We keep limited operation records to recognize completed requests and avoid applying the same request twice.

Account deletion attempts to cancel an associated active website subscription. It does not cancel App Store billing. Manage or cancel an Apple subscription through Apple’s subscription settings. Cancelling renewal preserves eligible access until the subscription expires.

Information retained after deletion

  • Limited Apple purchase-ownership and renewal records used to verify entitlement, prevent misuse and handle billing disputes.
  • A completion receipt for account deletion with the account-owner identifier removed.
  • Authentication security logs under the retention arrangements described below.
  • Payment records held by Apple or Stripe. Cancelling a website subscription does not itself delete Stripe’s customer record, which can include your email and account identifier.
  • Support correspondence where needed to complete your request or meet applicable obligations.

Retention

Account and learning records remain while your account exists unless you reset or delete them. Purchase and dispute records can have different retention requirements from learning records.

Authentication audit logs currently have no automatic expiry and are not automatically erased when an app account is deleted. They are retained for security and investigation. You can contact us about a specific retained record. Sign-in session records are separate and are removed with the authentication account.

Our support-mail retention policy is 12 months after the last exchange for ordinary correspondence. Records needed for unresolved disputes, security investigations or legal obligations may be retained longer. This applies to support correspondence, not separate records held by payment or email-delivery providers.

We do not keep separate manual database backups outside this project. Provider-managed recovery copies and temporary operational exports, where present, are distinct from the live database; we do not promise that deleting a live record immediately erases every recovery copy. We have not established a verified maximum retention period for those copies.

Children and availability

Quran Memorizer is not intended for children under 13. We do not knowingly collect their personal information. If you believe a child under 13 has provided information, contact us so we can investigate and remove it.

The service is operated from the United States. Availability may change over time. Your applicable privacy rights are not limited by the country from which we operate.

Your choices and contact

You can update supported profile details, reset your learning records, delete your account, turn off reminders and remove sign-in access in your provider’s settings. You may contact us to request access, correction, a copy or deletion of your information and exercise other applicable privacy rights. We may need to verify account ownership first.

We will update the policy date when it changes and provide additional notice or obtain consent where required for material changes.

Al Hidayah Apps
New York, United States
[email protected]