Privacy

Reading needs no account

The Quran text, its fonts and the tajweed colours are inside the app. Reading involves no network and no server.

Downloads (translations, tafsirs, recitations, mushaf fonts) come from our server. Each request carries an installation identifier: a random string created on first launch that names no person, account or device. It only serves to share the server fairly between installations. Uninstalling the app erases it.

Our web server keeps standard access logs (IP address, time, request) for fourteen days, to keep the service running and stop abuse.

If you create an account

An account holds:

• your name, used only to address you in emails;
• your email address, to confirm the account and reset the password;
• your password, stored hashed: nobody can read it, including us;
• the six-digit codes we email you, also hashed, valid fifteen minutes;
• your reading position, bookmarks, notes, memorised verses and settings;
• one session token per signed-in device.

We keep this because syncing it is the service you signed up for (GDPR article 6(1)(b)). It is never used for profiling and never sent anywhere but your own devices.

Crash and performance reports

Unhandled errors and their stack trace go to Sentry, on European servers, with a count of failed playbacks by kind of failure. For one session in ten, anonymous performance measurements go too: how long the app takes to start and its calls take to answer. Every number is removed before they leave, so no surah, verse, page or reciter is ever named. No IP address, request headers, session replay, or record of which verse was open. Our server reports its own errors and response times the same way.

Reporting a mistake

When you report a mistake in a translation or tafsir, we receive your message, the verse and edition concerned, and the app's language and version. No account is attached.

What the app never does

No advertising, advertising identifier, analytics kit, tracker or social network button. Recitations, timings, page images and fonts are served by us: the app only contacts kitaby.cc and the crash reporter above. No other company knows which surah you opened, in which voice, or when.

Who else handles it

• our server in Germany, where the database lives;
• Cloudflare, which carries the traffic;
• Resend, which delivers account emails and therefore sees the name and address in them;
• Sentry, European region, for crash reports.

Database backups are kept on our own hardware.

How long it is kept

• account data: until you delete the account;
• backups: nightly, the last fourteen kept;
• server access logs: fourteen days;
• crash reports: ninety days;
• mistake reports: until the correction is made.

Deleting your account

In the app: Settings → Account → Delete account. Without the app: https://kitaby.cc/account/delete.

Deletion is immediate and irreversible. The account, reading position, notes, memorised verses, settings and device tokens are erased, not flagged. Backups roll off within fourteen days.

What is stored on the device itself (downloads and your reading position) is removed by uninstalling the app.

Your rights

You may ask for a copy of your data, have it corrected or erased, or object to our holding it. Write to [email protected]; you will have an answer within a month. In the European Union you may also complain to your data protection authority.

Children

The app is not directed at children and asks nobody's age. It collects nothing from readers without an account.

Changes and contact

If any of this changes, this page and its date change with it. Questions go to [email protected].