Draft — not yet reviewed by a lawyer.
Privacy Policy
Last updated September 27, 2026Version 0.2
In plain language
We collect only what we need to teach you: your settings and progress. We never store your recitation. We don't sell data or show ads. Analytics run only if you allow them. You can download or delete everything at any time.
Who we are
Ulamat ("we", "us") is a learning app for Muslims. The data controller is TODO: legal entity name, registered address and registration number. You can reach us through the contact form (topic "Privacy or data request") or at TODO: privacy email address.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Settings (language, madhab, script, daily goal, text size) | To show the app the way you chose | Contract |
| Learning progress, quiz answers, scores, streak, bookmarks | To teach you and remember where you are | Contract |
| Recitation results: score, which words were clear, letter codes such as "ح said as ه" | To show what to practise and calculate your Learning Score | Contract |
| Account: email address, and your name if you add one | To sign you in and sync across devices | Contract |
| Private check-ins (salah circles, iman check-in) and journal notes | Only to show them back to you | Contract |
| Questions you send to scholars | To answer them; never published with your name | Contract |
| Feedback, content reports, contact and volunteer messages | To reply and fix problems | Legitimate interests |
| Push subscription (a technical address from your browser) | To send reminders you turned on | Consent |
| Error reports with personal data removed | To find and fix bugs | Legitimate interests |
| Anonymous usage analytics | To see which features help people learn | Consent (off by default) |
Using Ulamat needs an account, so your settings and progress are stored with us and reach every device you sign in on. What we keep is listed in the table above.
Your voice
We never store your recitation. In Chrome, Edge and Safari, your browser's own speech service (provided by Google or Apple) may turn your recitation into text; that processing is governed by their privacy policies. In other browsers, audio is sent to our server, checked in memory and discarded when the check ends. Details are in the Voice Data Policy.
Who processes data for us
- Supabase — database and sign-in.
- Vercel — hosting of the app and website.
- Hugging Face — runs the speech model on our server's request; audio is processed and not kept.
- Quran Foundation — Quran text, translations and tafsir (our server asks for them; no personal data is sent).
- everyayah.com and Quran.com — recitation audio, loaded directly by your browser (they see your IP address like any website).
- PostHog (EU) — anonymous analytics, only if you allow them.
- Sentry — error reports, sent by our server after removing personal data (no IP address, email, tokens or form values).
- Google — only if you choose "Sign in with Google".
- Your browser's push service — only if you turn on reminders.
We do not sell your data and we do not show ads.
How long we keep data
- Account data: until you delete your account.
- Contact and volunteer messages: until resolved, then deleted within TODO: period.
- Error reports: TODO: confirm the retention period configured in Sentry.
- Analytics: TODO: confirm the retention period configured in PostHog.
Your rights
You can see and download your data (Profile → Settings → Download my data), correct it in Settings, delete your account and all data (Settings → Delete account and all data), withdraw consent at any time (cookie settings, reminders, analytics switch) and object to processing based on legitimate interests. You may also complain to your data protection authority.
International transfers
Our providers may process data outside your country, including in the EU and the United States. Where required, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses. TODO: confirm each provider's data region and safeguards.
Children
Ulamat is not directed at children under 13. A child may use it only with a parent or guardian, on the parent's device and account. See the Children's Privacy notice.
Changes
If we change this policy in a way that matters, we will show a notice in the app and update the date and version above.