Privacy policy

What Quran Living measures, what it never stores, and how to opt out.

The short version

The whole policy is below and it is worth reading. But the parts that matter most fit in five lines, and nobody should have to get through thirteen thousand characters to learn them. This is also the version written for a younger reader — the UK's code for children asks for information a child can actually use, and a wall of text is not that.

• You can read everything here without an account, and we will not know who you are. No sign-up, no cookie, no record of your address.
• An account is only for saving your own study — your highlights, your notes, your bookmarks. It never unlocks more of the text.
• If you make an account, we ask you separately before we save any of that, because what you highlight in the Qur'ān can say something about what you believe. You can say no and still read everything.
• You can take it all back. Download everything, or delete it, from your account page — no request, no waiting.
• You should be 16 to make an account (13 in the UK). If you are younger, read as much as you like — just do not sign up.
• We show no ads, we never sell anything about you, and nothing here decides anything about you.

Quran Living is reading-first and privacy-respecting. You can read the entire corpus without an account. An account only adds your personal study tools. We show no ads, we never sell data, and a strict Content-Security-Policy blocks external scripts.

Audience measurement

We measure how the site is used so we can improve it. This is done on our own servers, in a form designed not to identify you:

• No cookie is set and nothing is stored on your device for measurement.
• Your IP address is never recorded. Approximate location comes from your browser's time zone (for example "Asia/Karachi"), which is far less precise than an IP lookup.
• Page views from one browser tab are grouped by a random number our page holds in memory while that tab is open. It is never written to your device — closing the tab erases it — and it cannot link your visits across days, identify you, or follow you to any other website. If it is missing we fall back to a key derived from coarse signals with a secret that changes daily and is never written to disk.
• We record how long a page was open while its tab was actually visible, so we can tell which pages are read and which are passed over. Time in a background tab is not counted, and no measurement over thirty minutes is kept.
• We record: the page, the referring website's HOSTNAME only (never the full address, which could contain someone else's search terms), campaign tags on links we published, browser and operating system family, device type, a rounded screen width, and interface language.
• We record what is typed into this site's SEARCH BOX, to learn what readers are looking for and what our corpus fails to answer. Entries that look like an email address, a phone or card number, or a password are discarded rather than stored.
• Measurement data is deleted automatically after 400 days.

Your choice: we honour the *Do Not Track* and *Global Privacy Control* signals. If your browser sends either, nothing is collected at all — the request is not even sent. You can also switch measurement off for this device in Settings.

Third-party analytics — and how to refuse it

The site can also load Google Analytics, which is a third-party service, sets its own cookies in your browser, and is subject to Google's privacy terms rather than this policy. It is the only third party that measures anything here.

It is not loaded until it is allowed. Where the law requires consent before a non-essential cookie — the EEA, the United Kingdom and Switzerland — nothing is requested from Google and no cookie is set until you choose, and choosing “no” is offered as plainly as choosing “yes”. Elsewhere it loads by default. Either way you can change your mind at any time in Settings, and a Do Not Track or Global Privacy Control signal is treated as a “no” already given, so you are never asked at all.

Switching it off stops anything further being sent. Cookies Google has already set in your browser are Google's, not ours, and expire on their own schedule — your browser's site-data controls will clear them immediately if you want them gone now.

What we store

• Account: your email, a display name (optional), and your password stored only as a salted, peppered scrypt hash — never in readable form.
• Your study data: highlights, notes, bookmarks, reading positions, quiz attempts, mastery and spaced-repetition schedules. This is yours; it is never shared or sold.
• Sessions: a random session token (stored only as a hash) in an HttpOnly cookie, plus a CSRF cookie. Both are strictly necessary to keep you signed in and to prevent request forgery, so they need no consent. Our own audience measurement sets no cookie at all. Google Analytics sets its own, and only once you have allowed it — see above.
• Subscriptions: your plan, status and renewal dates, plus the Lemon Squeezy subscription and customer identifiers. Payment and card details are handled entirely by Lemon Squeezy (our merchant of record) and never touch our servers.
• Operational logs: request path, status and IP address for security and rate-limiting. Logs never contain your email, passwords, or the contents of your notes.

When you write to us

Two forms on this site collect more about you than anything else does, and neither of them needs an account — so this section is here whether or not you have one.

• Reporting a correction or sending feedback. We keep what you wrote, the page it concerned, and — only if you chose to give them — your name and email, so we can write back. We also record your IP address and browser string, for one reason: to stop the same machine flooding the form. That check looks back 24 hours, so the IP and browser string are erased after 7 days; the row stays, the identifier does not.
• Applying to be a reviewer. This one asks for a great deal: your name, email, position, institution, department, country, ORCID, website, areas of expertise, credentials, and whatever you write in support. We need it to judge an application to vouch for scholarly material, and we keep it while the application is live.

How long. Contact details on a correction are erased after 180 days — long enough to follow up, not long enough to become an archive. A reviewer application keeps its details while it is under consideration; once it has been decided, the identifying fields are stripped 180 days later. Anything scored as spam is deleted outright after 30 days: holding a spammer's address for a year protects nobody.

What we keep, and why. The substance of a correction outlives your details on purpose. If a page changed because you told us it was wrong, the record of that is the reason the page now says what it says — that is the provenance this whole site is built on. It is kept with you detached from it, not with you attached to it. If you would rather it went entirely, write to us and say so.

Who is responsible for your data

The controller of the personal data described here is the operator of Quran Living (not yet named here — see below). The same person is the individual accountable for this data under Canadian law (PIPEDA) and the *encarregado* under Brazilian law (LGPD) — one person, one address, three regimes, because splitting the role across three documents is how it ends up belonging to nobody. If you have a question about your data, or want to exercise any of the rights below, write to the address on the Support page and a person will answer you.

Why we are allowed to hold it. Your account, your saved work and any subscription are processed because they are necessary to provide the service you asked for — in the language of the GDPR, performance of a contract. Our own audience measurement rests on a legitimate interest in knowing which pages are read, which is why it is built to identify nobody and why you can switch it off. Google Analytics rests on your consent and on nothing else, and runs only if you give it. Security and anti-abuse logging rests on a legitimate interest in keeping the site standing.

Your study data, and why we ask separately for it

This is the part of the policy that matters most on a site like this one. Which verses you highlight, what you write beside them, what you bookmark and where you stopped reading — taken together, that can say something about what you believe. European law calls data revealing religious or philosophical beliefs a special category and starts from a prohibition on holding it at all, with only a short list of exceptions. Having an account with us is not on that list. Explicit consent is.

So we ask you, separately, in plain words, with nothing pre-ticked, and we record what you were shown and when. That consent is the only thing permitting us to store your study data. It is asked for on its own — not folded into agreeing to the Terms, and not bundled with the newsletter — because a consent that is bundled is not the explicit consent the law is asking for.

• You can withdraw it at any time, in Settings. It is one control, in the same place you would have given it.
• Withdrawing erases that data. Your highlights, notes, bookmarks and progress are deleted from our servers, because keeping them after you have withdrawn would leave us holding special-category data with nothing permitting it. Your account, your email and any membership are untouched.
• Take a copy first if you want one. The export is offered next to the control, and it is the same complete export described under your rights below.
• Withdrawing is not the same as deleting your account — it is the narrower of the two, and both are available.

If you would rather we never held any of it: read anonymously. The entire corpus — every āyah, every narration, the classical library, the lexicon — is open without an account, without a cookie, and without us knowing who you are. The account exists only to add the study tools, so the consent buys the tools, not the text.

Where your data is, and who else touches it

The servers are in the United States (Google Cloud, South Carolina region). If you are in the United Kingdom, the European Economic Area or Switzerland, your data is therefore transferred outside your own jurisdiction. We rely on the standard contractual clauses our hosting and service providers offer for that transfer.

These are the only other companies that ever see any of it, and each does one job:

• Google Cloud — hosting and storage. Everything on this site runs there.
• Postmark — sends the mail the site has to send: address verification, password resets, and receipts. It sees your email address and the message.
• Lemon Squeezy — takes payment, as merchant of record, and handles tax. Card details go to them and never touch our servers.
• Google Analytics — measurement, only if you have allowed it. See above.

Two things your browser fetches from elsewhere

The four companies above are the only ones we send anything to. But two features load files directly from someone else's server, and when your browser does that, that server sees your IP address — as it would for any website you visited. We are telling you because you cannot see it happening and because "no third party" would otherwise be an overstatement:

• Recitation audio comes from everyayah.com. It happens only when you play a recitation, and it carries nothing about you — no account, no name, no identifier from us.
• Map tiles, on the history map, come from CARTO's basemap servers. Same conditions: only when you open the map, and with nothing of yours attached.

Neither is sent anything by us, neither receives your account or your study data, and neither can connect a request to you as a person — but each does see the request. If you never play audio and never open the map, neither is ever contacted.

Your rights over your data

If you are in the UK, the EEA or Switzerland these are rights in law, and we extend the same handling to everyone else because drawing the line by nationality would be a strange thing to do on a site like this one.

• See it. Download everything we hold about you, in a machine-readable file, from your account page. No request, no waiting.
• Correct it. Change your display name and email from the same page.
• Delete it. Delete your account and your data goes with it — the account is scrubbed, sessions and tokens are destroyed, and your highlights, notes and bookmarks are erased.
• Take it elsewhere. The export is JSON and Markdown; it is yours to move.
• Object, or ask us to pause. Switch measurement off yourself, or write and ask.
• Complain. If you think we have handled your data badly, tell us — and you can also complain to your national data-protection authority, which in the UK is the ICO.
• Object to audience measurement at any time — send Do Not Track or Global Privacy Control, or switch it off in Settings. Because that data carries no identifier for you, we cannot single out past rows to delete; that is a consequence of collecting it without identifying anyone, and the whole log is erasable on request.

We do not sell data, we do not share it for advertising, and nothing here makes an automated decision that has any legal effect on you.

How long we keep things

• Your account and study data — for as long as the account exists. Delete the account and they go with it; withdraw consent and the study data goes while the account stays. We do not keep a dormant account alive on your behalf and we do not archive a copy after deletion.
• Audience measurement — deleted automatically after 400 days. It identifies nobody in the first place.
• Operational logs (request path, status, IP address, for security and rate-limiting) — held in a rolling buffer on the server and overwritten continuously as new entries arrive, within days rather than months. They are never backed up and never joined to your account. The one place an IP address is written to a database rather than a rolling log is the anti-flood check on the two forms described above, and it is erased there after 7 days.
• Corrections, feedback and reviewer applications — see When you write to us above: the anti-flood IP and browser string go after 7 days, contact details after 180, spam after 30, and the substance of a correction is kept as editorial provenance without you attached to it.
• Email records — the address and delivery outcome of mail we had to send you, kept while the account exists so we can tell you whether a verification actually arrived.
• Billing records — the plan, status and renewal dates, plus the subscription identifiers our payment provider gives us. These outlive the account deliberately: tax law requires a seller to keep a record of a sale, and that obligation is not ours to waive. Card details are never ours to keep — they go to Lemon Squeezy and never touch our servers.

Children

This site is for a general adult audience, and an account is not for children. You must be at least 16 to create one, or the age your own country sets for consenting to an online service where that is lower — in the United Kingdom that is 13. If you are below it, you are still welcome to read: the whole corpus is open with no account, no sign-in, and nothing stored about you.

We do not ask for a date of birth, because collecting a child's birthday to check whether we may hold a child's data would be a strange way to protect them. If you believe a child has made an account, write to us and we will delete it and everything attached to it.

Email

If the operator has configured email, we use your address only to verify your account and to send password-reset links you request. We never email you marketing.

Data isolation: your identity, annotations and study progress live in separate databases from the public corpus. Backups of personal data are access-controlled.

Questions about this policy? Reach us via the Support page.