Privacy policy

Murāja‘ah ("the app") is a Qur'an revision aid provided by Hamza Abdul-Tawwaab as an Inheriting Islam project ("we"). It uses the Quran Foundation ("QF") APIs to show content from the ecosystem behind Quran.com and QuranReflect. It is an independent product, not an official application of Quran Foundation, Quran.com or QuranReflect.

1. What we collect and why

We have no accounts and no sign-in, set no cookies, and run no analytics or advertising code.

• Your review list, notes and reading preferences. The āyāt and pairs you save, the dates you added or revised them, the private notes you write on pairs, and your settings (translation, density, hide text). Where: only in your browser's local storage. Why: the Review page and your reading settings. We do not receive or keep this list.
• Verse references in requests. Pages and requests name āyāt in their addresses, for example /compare/2:48/2:123, and the Review page asks /api/verses?keys=2:48,2:123 (and /api/audio?key=2:48 when you press play). Why: to return the text and audio you asked for. The app uses them only to answer the request and does not store them.
• Technical request data. The app runs on Cloudflare Workers. Cloudflare processes each request (including your IP address, the requested address, which can contain the verse references above, and browser details) to deliver it and protect it from abuse, under its own privacy policy. The app's own logs (Workers Logs) are set to record errors only, not every request, and Cloudflare keeps them for 7 days on the Workers Paid plan (3 days on Free) (source). We do not use them for anything else, combine them with other data, or use them to identify you. How long Cloudflare keeps its own network logs is set out in Cloudflare's privacy policy, linked above.
• Qur'an content. Text, translation and audio references are fetched from QF's Content API by our server with an app credential. No personal data is sent to QF in that process. We keep that content in server memory for at most six days, as QF's terms require.

2. What we never do

• We do not use any data to build advertising profiles.
• We do not sell, rent, mine or repurpose any data beyond the features described here.
• We do not use anything you create or save to train AI models.

3. Religious information

Information about a person's religious practice is sensitive personal data under the GDPR and similar laws. Which āyāt you revise could reveal something about your practice, so the app keeps your list on your device and does not collect it. If we ever offer saving it to an account, we will ask for your explicit, opt-in consent first, separately from these terms.

4. Who else is involved (sub-processors)

• Cloudflare: hosts the app on Cloudflare Workers, keeps the error logs described above, and stores the cached Qur'an content (Workers KV, at most six days). Privacy policy: cloudflare.com/privacypolicy.
• Quran Foundation: provides the Content API. Your browser also loads the Qur'an font from QF's CDN (verses.quran.foundation) and, when you press play, the recitation from verses.quran.com. These services see your IP address and the file requested. Privacy policy: quran.com/privacy.

Our use of Cloudflare is covered by Cloudflare's customer terms and data processing addendum. Anyone we work with is required to respect Islamic content guidelines and must not misuse Qur'anic text from the QF platform.

5. Security

• All traffic is served over HTTPS (TLS). The app stores no user data on the server; Cloudflare holds its logs and KV data under its own security programme.
• Hamza Abdul-Tawwaab holds the app's Quran Foundation credential, which is rotated at least every 90 days. Access to the hosting account is limited to the Inheriting Islam team, and multi-factor authentication is used on the accounts that manage this app.
• The QF client secret lives only in server environment variables, is never sent to browsers, and is rotated at least every 90 days and immediately after any suspected exposure.
• We respond to security incidents within 24 hours and report any affecting QF data to Quran Foundation within 24 hours. We hold ourselves to QF's Security Rule 6.9, which QF's developer privacy requirements reference.
• Report a security issue to hamza@inheritingislam.com with "Security" in the subject.

6. Your rights and choices

• See and correct your data: your whole list is on the Review page; remove or re-add items there at any time.
• Delete your data: use the button below. It removes everything this app stored in this browser. To ask for log entries to be deleted, email us.
• Connected accounts: the app does not connect to your Quran.com or QF account and holds no OAuth tokens for you, so there is nothing to revoke. QF's token revocation endpoint is documented at api-docs.quran.foundation for apps that do.

7. How long we keep data

• Your list stays in your browser until you delete it.
• The server keeps no user data, so there is no account data to retain. Deleting a Quran.com or QF account does not affect this app, which holds none of that account's data.
• Error logs: 7 days on Workers Paid, 3 on Free (Cloudflare Workers Logs), then deleted by Cloudflare. On request, we delete log entries we can identify within 30 days, and any copies in backups within 90 days.

8. Children

The app is not directed at children under 13 and has no sign-up, so it collects no account information from anyone. Parents may wish to use it alongside their child's teacher.

9. International transfers

The app is available worldwide and runs on Cloudflare's global network: each request is served from a Cloudflare data center near you, and the cached Qur'an content is replicated across that network, so data may be processed outside your country. Where data such as access logs is transferred internationally, we rely on the EU Standard Contractual Clauses or an equivalent framework, and we comply with the data-protection and transfer laws that apply where our users live.

10. Changes and contact

If this policy changes materially, a notice will appear on the site and the effective date above will change. Privacy questions: hamza@inheritingislam.com. A postal address is available on request by email. We reply within 30 days.

See also the terms of use.