Privacy Policy

1. Controller and scope

Mr.Fulani (Iqro-Forum project) operates Quran Platform and is the data controller. Contact: fulani.dev@gmail.com. Postal address: Staging environment; not a public legal notice.

This policy covers the web app, mobile apps, Telegram Mini App, and other official clients using the same API.

2. Data we process

The data depends on the features you use.

• installation and device identifiers, app version, language, time zone, sessions, and security events;
• email and verification state for one-time-code sign-in;
• reading position, daily goal, after-prayer reading plan and check-ins, reading sessions, progress and reading-day streak, bookmarks, reminders, prayer settings, and sync state; when notifications are enabled, the browser push endpoint and public subscription keys; after separate location permission, device coordinates used only to calculate prayer notifications;
• support ticket subject, messages, and history;
• IP address, request ID, and minimal request logs for security, diagnostics, and abuse prevention.

3. Purposes and legal bases

We process data to provide requested features, synchronize clients, authenticate users, provide support, secure the service, prevent abuse, and meet legal duties.

Depending on the activity and applicable law, the basis is performance of the terms or steps you request, legitimate interests in a secure and reliable service, a legal obligation, or consent where required. The operator must confirm the exact basis for the launch jurisdiction.

4. Cookies and local storage

Necessary HttpOnly cookies hold the refresh session and installation key; a locale cookie remembers language. localStorage holds the sync queue, a bounded queue of unsent reading sessions, operational state, and the last prayer-calculation location, method, and Asr school selected on this device, while sessionStorage holds temporary return paths and notices. These mechanisms support requested functionality and are not used for advertising profiles.

5. Recipients and transfers

Access is limited to authorized staff and necessary infrastructure, hosting, email, monitoring, and support providers. Audio may load from a rights holder's external source, which receives your IP address and technical request headers.

Current providers, their roles, and direct privacy links are published on Providers and external services. Every new provider, processing country, and lawful international-transfer safeguard must be reviewed before enabling the related production feature.

6. Retention and deletion

Email challenges are normally removed after 24 hours, inactive auth sessions after 90 days, and sync change/operation logs after 180 days. Bookmark and reminder tombstones outlive the offline-sync window so old devices cannot resurrect deleted records.

Account deletion is requested in the profile after fresh email verification and has a seven-day cancellation period. The working copy of personal data is then deleted or irreversibly de-identified within 30 days, and residual copies age out of rotating backups within 90 days, except narrowly retained data required by law or security.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Email fulani.dev@gmail.com; we may verify identity to protect the account. You may also complain to the competent supervisory authority.

8. Children, security, and changes

The service is not intended for children below the age at which they may independently provide personal data under applicable law; a parent or guardian should assist them. We use access controls, transport encryption, bounded retention, and security logging, but no service can promise absolute security.

If processing changes materially, we will update the date and provide additional notice where required.

9. Quran.Foundation and use restrictions

Iqro is an independent service that uses the Quran.Foundation Content API and references Quran.com; it is not an official Quran.Foundation app. Quran.Foundation sign-in and user-account access are not currently used.

We do not sell personal data, build advertising profiles from religious behavior, mine it for unrelated inferences, or train AI models on user content without separate explicit consent.