Privacy policy

What Quran Living measures, what it never stores, and how to opt out.

The short version

The whole policy is below and it is worth reading. But the parts that matter most fit in five lines, and nobody should have to get through thirteen thousand characters to learn them. This is also the version written for a younger reader — the UK's code for children asks for information a child can actually use, and a wall of text is not that.

• Quran Living is in private beta, so reading it needs an account for now. That is a temporary state and not the plan: when the beta ends, the whole corpus goes back to being readable with no sign-up, no cookie and no record of your address.
• An account is only for saving your own study — your highlights, your notes, your bookmarks. It never unlocks more of the text.
• If you make an account, we ask you separately before we save any of that, because what you highlight in the Qur'ān can say something about what you believe. You can say no and still read everything.
• You can take it all back. Download everything, or delete it, from your account page — no request, no waiting.
• You should be 16 to make an account (13 in the UK). If you are younger, read as much as you like — just do not sign up.
• We show no ads, we never sell anything about you, and nothing here decides anything about you.

Quran Living is reading-first and privacy-respecting. The site is in private beta, so an account is needed to read it at present; an account otherwise only adds your personal study tools, and never unlocks more of the text. We show no ads, we never sell data, and a strict Content-Security-Policy blocks external scripts.

Where you are

Some parts of the site can be limited to, or withheld from, particular countries — where a licence, a law or a decision of ours requires it. When such a limit exists, and only then, we look up the country of the network address your request arrived from, in a database that sits in our own server's memory (GeoLite2, from MaxMind). The answer is used for that one request and then dropped: we do not store the country, we do not store the address for this purpose, and no third party is asked. It is a country, never a city or a position, and a VPN moves it.

If your connection gives no answer, we fall back to the country you may have told us on your account — an optional field you can set, change or clear on the account page, with an explicit “prefer not to say”. If neither is known, a “not available in these countries” limit lets you through and an “available only in these countries” limit does not. Nothing about where you are is written into any record, shown to anyone, or used for anything except that limit. The Geolocation permission of your browser stays switched off at our end regardless.

This product includes GeoLite2 data created by MaxMind, available from maxmind.com.

Audience measurement

We measure how the site is used so we can improve it. This is done on our own servers, in a form designed not to identify you:

• No cookie is set and nothing is stored on your device for measurement.
• Your IP address is never recorded. Approximate location comes from your browser's time zone (for example "Asia/Karachi"), which is far less precise than an IP lookup.
• Page views from one browser tab are grouped by a random number our page holds in memory while that tab is open. It is never written to your device — closing the tab erases it — and it cannot link your visits across days, identify you, or follow you to any other website. If it is missing we fall back to a key derived from coarse signals with a secret that changes daily and is never written to disk.
• We record how long a page was open while its tab was actually visible, so we can tell which pages are read and which are passed over. Time in a background tab is not counted, and no measurement over thirty minutes is kept.
• We record: the page, the referring website's HOSTNAME only (never the full address, which could contain someone else's search terms), campaign tags on links we published, browser and operating system family, device type, a rounded screen width, and interface language.
• We record what is typed into this site's SEARCH BOX, to learn what readers are looking for and what our corpus fails to answer. Entries that look like an email address, a phone or card number, or a password are discarded rather than stored.
• Measurement data is deleted automatically after 400 days.

Your choice: we honour the *Do Not Track* and *Global Privacy Control* signals. If your browser sends either, nothing is collected at all — the request is not even sent. You can also switch measurement off for this device in Settings.

Third-party analytics — and how to refuse it

The site can also load Google Analytics, which is a third-party service, sets its own cookies in your browser, and is subject to Google's privacy terms rather than this policy. It is the only third party that measures anything here.

It is not loaded until it is allowed. Where the law requires consent before a non-essential cookie — the EEA, the United Kingdom and Switzerland — nothing is requested from Google and no cookie is set until you choose, and choosing “no” is offered as plainly as choosing “yes”. Elsewhere it loads by default. Either way you can change your mind at any time in Settings, and a Do Not Track or Global Privacy Control signal is treated as a “no” already given, so you are never asked at all.

Switching it off stops anything further being sent. Cookies Google has already set in your browser are Google's, not ours, and expire on their own schedule — your browser's site-data controls will clear them immediately if you want them gone now.

What we store

• Account: your email, a display name (optional), and your password stored only as a salted, peppered scrypt hash — never in readable form.
• Your study data: highlights, notes, bookmarks, reading positions, quiz attempts, mastery and spaced-repetition schedules. This is yours; it is never shared or sold.
• Sessions: a random session token (stored only as a hash) in an HttpOnly cookie, plus a CSRF cookie. Both are strictly necessary to keep you signed in and to prevent request forgery, so they need no consent. Our own audience measurement sets no cookie at all. Google Analytics sets its own, and only once you have allowed it — see above.
• Subscriptions: your plan, status and renewal dates, plus the Lemon Squeezy subscription and customer identifiers. Payment and card details are handled entirely by Lemon Squeezy (our merchant of record) and never touch our servers.
• Operational logs: request path, status and IP address for security and rate-limiting. Logs never contain your email, passwords, or the contents of your notes.

When you write to us

Two forms on this site collect more about you than anything else does, and neither of them needs an account — so this section is here whether or not you have one.

• Reporting a correction or sending feedback. We keep what you wrote, the page it concerned, and — only if you chose to give them — your name and email, so we can write back. We also record your IP address and browser string, for one reason: to stop the same machine flooding the form. That check looks back 24 hours, so the IP and browser string are erased after 7 days; the row stays, the identifier does not.
• Applying to be a reviewer. This one asks for a great deal: your name, email, position, institution, department, country, ORCID, website, areas of expertise, credentials, and whatever you write in support. We need it to judge an application to vouch for scholarly material, and we keep it while the application is live.

How long. Contact details on a correction are erased after 180 days — long enough to follow up, not long enough to become an archive. A reviewer application keeps its details while it is under consideration; once it has been decided, the identifying fields are stripped 180 days later. Anything scored as spam is deleted outright after 30 days: holding a spammer's address for a year protects nobody.

What we keep, and why. The substance of a correction outlives your details on purpose. If a page changed because you told us it was wrong, the record of that is the reason the page now says what it says — that is the provenance this whole site is built on. It is kept with you detached from it, not with you attached to it. If you would rather it went entirely, write to us and say so.

Asking for a place in the beta

While Quran Living is in private beta the library is open to invited readers, and the form on the front page is how you ask for a place. It is the only thing on this site that collects anything from someone who is not a member, so it gets its own section.

• What we take. Your email address, and — only if you choose to give them — your name and a line about what you would use the site for. Nothing else: no date of birth, no IP address stored against your entry, no record of how you arrived.
• What we do with it. One thing. We write to you when a place opens. That message is the answer to the request you made, so it is not marketing and there is no list to unsubscribe from — if you would rather not hear from us, tell us and we will delete the entry.
• What we do not do with it. It is not added to the newsletter, it is not used to advertise to you, and it is not shared with anyone. Asking for a place is not consent to be marketed to, and we do not treat it as one.
• Who sees it. The operators of this site, in the console where the queue is managed, so that places can be opened in an order that makes sense. Notes an operator writes about an entry are internal and are never shown to you — if you want to know what we hold about you, ask, and we will tell you.

How long. Your entry is kept until you are invited and create an account, or until you ask us to remove it, or until the beta ends and the queue is deleted. An invitation is a single-use link that expires. If you later create an account and then delete it, your waitlist entry and any invitations go with it — erased in the same operation, not left behind because they happen to be filed under your address rather than your account.

Why we are allowed to hold it. Because you asked us to: taking steps at your request before entering into a contract (GDPR Art 6(1)(b)). Holding your address in order to tell you when a place opens IS the request, not something extra we decided to do with it.

Who is responsible for your data

The controller of the personal data described here is the operator of Quran Living (not yet named here — see below). The same person is the individual accountable for this data under Canadian law (PIPEDA) and the *encarregado* under Brazilian law (LGPD) — one person, one address, three regimes, because splitting the role across three documents is how it ends up belonging to nobody. If you have a question about your data, or want to exercise any of the rights below, write to the address on the Support page and a person will answer you.

Why we are allowed to hold it. Your account, your saved work and any subscription are processed because they are necessary to provide the service you asked for — in the language of the GDPR, performance of a contract. Our own audience measurement rests on a legitimate interest in knowing which pages are read, which is why it is built to identify nobody and why you can switch it off. Google Analytics rests on your consent and on nothing else, and runs only if you give it. Security and anti-abuse logging rests on a legitimate interest in keeping the site standing.

Your study data, and why we ask separately for it

This is the part of the policy that matters most on a site like this one. Which verses you highlight, what you write beside them, what you bookmark and where you stopped reading — taken together, that can say something about what you believe. European law calls data revealing religious or philosophical beliefs a special category and starts from a prohibition on holding it at all, with only a short list of exceptions. Having an account with us is not on that list. Explicit consent is.

So we ask you, separately, in plain words, with nothing pre-ticked, and we record what you were shown and when. That consent is the only thing permitting us to store your study data. It is asked for on its own — not folded into agreeing to the Terms, and not bundled with the newsletter — because a consent that is bundled is not the explicit consent the law is asking for.

• You can withdraw it at any time, in Settings. It is one control, in the same place you would have given it.
• Withdrawing erases that data. Your highlights, notes, bookmarks and progress are deleted from our servers, because keeping them after you have withdrawn would leave us holding special-category data with nothing permitting it. Your account, your email and any membership are untouched.
• Take a copy first if you want one. The export is offered next to the control, and it is the same complete export described under your rights below.
• Withdrawing is not the same as deleting your account — it is the narrower of the two, and both are available.

If you would rather we never held any of it: do not give this consent. Every āyah, every narration, the classical library and the lexicon are all readable without it — the consent buys the study tools, not the text. Reading anonymously, with no account at all, is how this site normally works and how it will work again once the private beta ends.

Where your data is, and who else touches it

The servers are in the United States (Google Cloud, South Carolina region). If you are in the United Kingdom, the European Economic Area or Switzerland, your data is therefore transferred outside your own jurisdiction. We rely on the standard contractual clauses our hosting and service providers offer for that transfer.

These are the only other companies that ever see any of it, and each does one job:

• Google Cloud — hosting and storage. Everything on this site runs there.
• Resend — sends the mail the site has to send: address verification, password resets, and receipts. It sees your email address and the message.
• Lemon Squeezy — takes payment, as merchant of record, and handles tax. Card details go to them and never touch our servers.
• Google Analytics — measurement, only if you have allowed it. See above.

Two things your browser fetches from elsewhere

The four companies above are the only ones we send anything to. But two features load files directly from someone else's server, and when your browser does that, that server sees your IP address — as it would for any website you visited. We are telling you because you cannot see it happening and because "no third party" would otherwise be an overstatement:

• Recitation audio comes from everyayah.com. It happens only when you play a recitation, and it carries nothing about you — no account, no name, no identifier from us.
• Map tiles, on the history map, come from CARTO's basemap servers. Same conditions: only when you open the map, and with nothing of yours attached.

Neither is sent anything by us, neither receives your account or your study data, and neither can connect a request to you as a person — but each does see the request. If you never play audio and never open the map, neither is ever contacted.

Your rights over your data

If you are in the UK, the EEA or Switzerland these are rights in law, and we extend the same handling to everyone else because drawing the line by nationality would be a strange thing to do on a site like this one.

• See it. Download everything we hold about you, in a machine-readable file, from your account page. No request, no waiting.
• Correct it. Change your display name and email from the same page.
• Delete it. Delete your account and your data goes with it — the account is scrubbed, sessions and tokens are destroyed, and your highlights, notes and bookmarks are erased.
• Take it elsewhere. The export is JSON and Markdown; it is yours to move.
• Object, or ask us to pause. Switch measurement off yourself, or write and ask.
• Complain. If you think we have handled your data badly, tell us — and you can also complain to your national data-protection authority, which in the UK is the ICO.
• Object to audience measurement at any time — send Do Not Track or Global Privacy Control, or switch it off in Settings. Because that data carries no identifier for you, we cannot single out past rows to delete; that is a consequence of collecting it without identifying anyone, and the whole log is erasable on request.

We do not sell data, we do not share it for advertising, and nothing here makes an automated decision that has any legal effect on you.

How long we keep things

• The days your account was used — for members only: the calendar day on which your account was active and how many times you signed in that day, kept for 30 days so the operator can see how many members are using the site. Not the pages you read, not your address, not a time finer than the day. It goes with the account if you delete it.
• Your account and study data — for as long as the account exists. Delete the account and they go with it; withdraw consent and the study data goes while the account stays. We do not keep a dormant account alive on your behalf and we do not archive a copy after deletion.
• Audience measurement — deleted automatically after 400 days. It identifies nobody in the first place.
• Operational logs (request path, status, IP address, for security and rate-limiting) — held in a rolling buffer on the server and overwritten continuously as new entries arrive, within days rather than months. They are never backed up and never joined to your account. The one place an IP address is written to a database rather than a rolling log is the anti-flood check on the two forms described above, and it is erased there after 7 days.
• Where you are — nothing. The country of a request is looked up in memory when a country limit applies and is not kept; the country on your account, if you set one, lives and dies with the account.
• Corrections, feedback and reviewer applications — see When you write to us above: the anti-flood IP and browser string go after 7 days, contact details after 180, spam after 30, and the substance of a correction is kept as editorial provenance without you attached to it.
• A waitlist entry — kept until you are invited and create an account, until you ask us to remove it, or until the beta ends and the queue is deleted. Deleting an account erases its waitlist entry and any invitations in the same operation.
• Email records — the address and delivery outcome of mail we had to send you, kept while the account exists so we can tell you whether a verification actually arrived.
• Billing records — the plan, status and renewal dates, plus the subscription identifiers our payment provider gives us. These outlive the account deliberately: tax law requires a seller to keep a record of a sale, and that obligation is not ours to waive. Card details are never ours to keep — they go to Lemon Squeezy and never touch our servers.

Children

This site is for a general adult audience, and an account is not for children. You must be at least 16 to create one, or the age your own country sets for consenting to an online service where that is lower — in the United Kingdom that is 13. If you are below it, please wait until you are old enough before asking for a place. While the site is in private beta, reading it needs an account, and we will not knowingly open one for a child. When the beta ends, the whole corpus will again be readable with no account, no sign-in and nothing stored about you.

We do not ask for a date of birth, because collecting a child's birthday to check whether we may hold a child's data would be a strange way to protect them. If you believe a child has made an account, write to us and we will delete it and everything attached to it.

Email

If the operator has configured email, we use your address only to verify your account and to send password-reset links you request. We never email you marketing.

Data isolation: your identity, annotations and study progress live in separate databases from the public corpus. Backups of personal data are access-controlled.

Questions about this policy? Reach us via the Support page.