Privacy policy

1. What we collect

IqraFlow collects only what it needs to work:

Account information - your email address, first name, surname, country and gender, given when you sign up. You can sign up with an email and password, or with Google or Apple.

Reading data - your reading progress, bookmarks and notes, daily reading streaks, hasanat counts and reading statistics, saved to your account so you can continue on any device.

Khatm data - the khatms you create or join.

Feedback - anything you send us through the in-app report or feedback form.

2. Shared khatms

If you join a shared khatm, the other members of that khatm can see your display name and your reading progress within it - the portion you have claimed and how much of it you have read. They never see your notes, your other khatms, or anything else about your account. Leave a khatm and your entry is removed from the group.

3. Where your data lives

Your account and its data are stored on Supabase (PostgreSQL), hosted in the EU (eu-west-1), protected by row-level security so that only you can read your own rows. Your password is never stored on our servers - authentication is handled by Supabase Auth.

If you turn on biometric quick sign-in, your sign-in details are kept only on your own device, in the operating system's secure keychain behind Face ID / Touch ID / your device unlock. They never leave the device, and they are erased when you sign out or switch accounts.

The Quran text, translations, transliteration and word-by-word meanings ship inside the app, so reading itself works with no connection at all.

4. Services we rely on

IqraFlow sends requests to a small number of third parties, only ever to deliver content you asked for:

Supabase - accounts, database and sync.
Quran.com API (api.quran.com) - extra translations, tafseer and recitation metadata.
EveryAyah and QuranicAudio - recitation audio files.

Those requests carry standard technical information such as your IP address and device type, used only to serve the files. We do not build profiles from them, and we do not sell your data to anyone.

5. Notifications

Reading reminders are scheduled locally on your device. We don't send marketing push notifications.

6. Analytics & tracking

No third-party advertising SDKs, no cross-app tracking, no selling of data - ever. If we add crash reporting or anonymous usage metrics in the future, they will be privacy-preserving, aggregated, and disclosed here first.

7. The launch waiting list

If you join the waiting list on this site, we store your email address for one purpose: telling you when IqraFlow launches. You can unsubscribe with one click, and we delete the list after launch.

8. Children

IqraFlow is not directed at children under 13, and we do not knowingly collect personal information from them. Shared khatm display names are visible to the other members of that khatm - we recommend families choose them together.

9. Your rights & contact

You can see, correct or delete your data at any time. Deleting your account from inside the app removes your account and everything attached to it. For anything else - questions, deletion requests, concerns - email [email protected]. We'll reply within 30 days.

10. Changes

If this policy changes, we'll update the date above and note material changes in the app's release notes before they take effect.