Privacy Policy

What stays on your device

Qaari saves the following in your browser or app storage. It is not transmitted anywhere unless you turn on cloud sync, and we cannot read it:

• Your last-read ayah, reading streak, daily goal, and ayahs completed.
• Quran and hadith bookmarks.
• Your chosen translation edition and reciter.
• Prayer time offsets, calculation method, and Hijri calendar offset.
• Senior reader mode and other display preferences.
• Any content packs you download for offline use.

Clearing your browser data, or deleting the app, erases all of it. There is no copy on our side to fall back on.

Your location

Prayer times and the qibla compass need to know roughly where you are. Your device asks your permission, and the calculation then runs entirely on your device using the standard astronomical method you selected. Your coordinates are not sent to us for this, and refusing the permission simply means entering a city by hand instead.

The single exception is prayer alerts, described next, because a notification that has to arrive while your phone is asleep cannot be computed on a device that is asleep.

Prayer alerts, if you enable them

Turning on prayer notifications sends the following to our notification server, which runs on Cloudflare:

• The push endpoint your browser or phone issues, together with the encryption keys that let only your device open the message.
• Your coordinates, rounded to two decimal places. That is a grid of about 1.1 kilometres, which is precise enough for a prayer time and too coarse to identify a home.
• Your timezone, calculation method, madhab for Asr, which prayers you chose, and how many minutes of warning you want.

The record is filed under a one-way hash of your push endpoint. It holds no name, no email address, and no device identifier, and there is no way for us to work backwards from it to you. It exists so the server knows when to wake your phone, and nothing else. Turning alerts off, or using the deletion page, removes the record.

Cloud sync, if you enable it

Cloud sync is off by default. It exists so your bookmarks survive a new phone. There are two routes, and they differ in an important way.

Google Drive. Signing in with Google asks for three permissions: your basic profile, your email address, and access to the hidden application folder in your own Google Drive. Your synced file is written into that folder, inside your own Drive account. It does not pass through our servers and we cannot open it. The application folder is invisible in the normal Drive interface and is reachable only by Qaari. Revoking Qaari at your Google account permissions cuts that access off at any time.

Sign in with Apple. This route stores the same small bundle of bookmarks and settings on our Cloudflare storage instead, filed under a one-way hash of the anonymous identifier Apple issues for you. We never receive your real email address on this route, and the stored bundle contains preferences and positions, nothing more.

Either way the payload is the short list under cloud sync: bookmarks, last-read position, offsets, and display preferences. No reading history is profiled, and nothing is analysed.

When you write to us

The contact form relays your name, your email address, and your message to our inbox as an email. It is not written to a database and it is not added to a mailing list. We keep the correspondence for as long as it takes to deal with it, in the same way any email is kept, and you can ask us to delete the thread.

Audio, video, and the pages themselves

Recitation audio and the live streams from Makkah and Madinah are fetched through qaari.org rather than directly from the upstream provider. The practical effect is that the upstream sees a request from our servers, not from you.

The site is served by Cloudflare, which acts as our processor and handles ordinary web request logs, including IP addresses, for the purposes of delivering the page and absorbing attacks. Browser reports of blocked content, which we use to keep the security policy tight, may also be logged. These are operational records, not a profile of you, and they are not joined to anything else in this policy.

Children

Qaari is written for a general audience and is entirely suitable for children, but it is not directed at them as a product, and it does not knowingly gather personal information from anyone. Since there are no accounts and no profiles, there is nothing to gather.

Deleting your data

You can remove everything yourself, in under a minute, without asking anyone. The data deletion page clears the alert subscription, the synced copy, and everything stored on your device, and reports exactly what it managed to remove. The same control sits inside the app on the cloud sync screen. If any part of it fails, write to [email protected] and a person will finish it by hand.

Your rights

Where the GDPR, the UK GDPR, India's Digital Personal Data Protection Act, or a comparable law applies to you, you have the right to ask what we hold, to have it corrected, to have it deleted, and to object to how it is used. Because Qaari holds so little, most of those requests are answered by the deletion page above, immediately and without our involvement. For anything else, write to us and we will answer within thirty days.

Changes

If this policy changes in a way that affects what we collect, the date at the top will change and the app will carry the new version. We have no mailing list to announce it on, which is itself the point.

Who we are

Qaari is built and operated by Rolvard, an independent studio. Write to [email protected] for anything in this policy, including a deletion request you would rather we carried out for you.