Privacy Policy

Last updated: April 19, 2026

Hifzly ("the App") is a Quran memorization tool. This policy explains what data we collect, why, how it's stored, and the choices you have. Plain language only — no legalese.

What we collect

• When you sign in with Google: your email address, display name, and profile picture URL. We request only theopenid email profilescopes — nothing else.
• While you use the App: your memorization progress (verses recited, passages saved, SRS review schedule, training session stats). This data lives first on your device(browser IndexedDB / app local storage) and only syncs to our server when you're signed in.
• Optional voice recordings: when you use the "AI Tajweed Check" feature, a short audio snippet is sent to our server, forwarded to Google Gemini for tajweed analysis, and then discarded. We never retain the audio after feedback is returned.
• Anonymous users: if you don't sign in, we generate a random anonymous ID stored only on your device. No personal info is collected.

How we use your data

• Authenticate you across devices when you sign in with Google.
• Save and sync your memorization progress so it's available on any device.
• Generate personalized tajweed feedback during "AI Tajweed Check".
• Operate and improve the App's core features (spaced-repetition scheduling, session history, daily verse).

We do not use your data for advertising, profiling, selling, or sharing with marketers.

Third-party services we use

• Google Sign-In (OAuth 2.0) — authenticates you. Google's privacy policy applies: policies.google.com/privacy
• Google Gemini API — analyzes your recitation audio to provide tajweed feedback. Audio is processed transiently; we do not retain it.
• Quran.com public Quran text — used for verse lookup and display. No user data is sent to Quran.com.

Where your data lives

Your memorization progress and account record are stored in our MongoDB database hosted on secure cloud infrastructure. Session cookies use HttpOnly, Secure, and SameSite=None flags.

Your rights

• Access: ask us for a copy of the data we hold about you.
• Delete: request full account deletion. All progress records and your user profile will be erased within 7 days.
• Sign out anytime: via Settings → Sign Out. This clears your session immediately.
• Revoke Google access: visit myaccount.google.com/permissions and remove Hifzly.

Children

Hifzly is suitable for all ages. We do not knowingly collect personal information from children under 13 without parental consent. If you believe a child has provided us personal info, please contact us and we'll delete it.

Changes to this policy

We may update this policy to reflect new features or legal requirements. The "Last updated" date at the top always reflects the current version. Material changes will be notified via the App.