What Yabqa knows about you.

• Your route, your history and your settings live on your own device.
• If you create an account, the same information is also kept in your account so it survives a lost phone and reaches your other devices. Nobody else can read it.
• There is no advertising, no analytics and no tracking of any kind in Yabqa.
• You can export everything, and you can delete everything, from inside the app.

Your memorisation route, every completed sitting, the places you have marked as weak, your goals and schedule, your reading position, and your settings. This is stored by your browser under the name hifdh-companion-store-v1, along with a few small flags: whether you have agreed to the follower using your microphone, which first-use explanations you have already seen, and a cache of the last passage you opened so it reopens quickly.

Clearing your browser data, or your browser deciding to clear it for you, removes all of this. That is the main reason accounts exist.

Creating an account stores your email address and a copy of everything Yabqa holds on your device: your route, every sitting and the help you took in it, your goals, your reading place and your settings, the name you gave when Yabqa asked what it may call you (if you gave one), and whether you said at setup that you are under 13.

If you sign in with Apple or Google instead of an email code, they send your email address — with Apple you may choose a private address that forwards to yours — and your name, if you allow it; Google also sends a link to your profile picture. Supabase, the company that runs Yabqa's database and sign-in, keeps what the provider sends with your sign-in record, including whether the provider has confirmed your email address. Yabqa itself uses only your name and your email address.

It is protected so that only you can read or change it — every request is checked against your own account, and other people's requests for your data are refused by the database itself, not merely hidden by the app.

A few companies handle account information on Yabqa's behalf, and for nothing else: Supabase (the database and sign-in), Resend (which sends sign-in codes by email), Cloudflare (which stores a nightly backup of the database, kept privately), GitHub (which runs the nightly check that each backup can be restored), and RevenueCat and Apple (for purchases in the app). Sign-in logs, including the IP address a sign-in came from, are kept for a short time.

Voice recordings are never uploaded. If an old version of Yabqa saved a recording on your device, it stays on your device.

There are only four things, and three of them you control.

• Recitation audio. When you press play, Yabqa streams the recitation from mp3quran.net (from its audio host at cdn.mp3quran.net). That request tells them a device asked for a particular recitation. When each Ayah begins is Yabqa's own work, asked for from Yabqa's own server, content.yabqa.app, which keeps no record of who asked. The Tajweed colours and the Madani page words come through the same server from Quran Foundation, with Yabqa's registered keys. The Qur'an text is included in Yabqa itself — the Tanzil Project's Uthmani text — and no request is ever made to Tanzil for it.
• Your account. If you sign in, your route is sent to and from your account as described above. If you do not sign in, nothing is sent.
• The optional follower. See the next section — this one deserves its own.
• Paying, if you choose to. The revision route can be subscribed to. Apple takes the payment, under Apple's own privacy policy; Yabqa never sees your card or Apple ID. RevenueCat, a company that records App Store purchases for apps, tells Yabqa that a purchase succeeded, and Yabqa keeps which plan you chose and until when it runs. If the price is a problem, you can write to us, and your email is kept so it can be answered.

If you subscribe inside the iPhone app, the payment is taken by Apple on its own sheet — again, your card details are theirs and never Yabqa's. Whether that subscription is still running is checked for us by RevenueCat, a service that does nothing else. When the plans page opens in the app, it asks RevenueCat for the App Store's prices: if you are signed in, that request carries your Yabqa account number; if you are not, RevenueCat gives the phone an anonymous number of its own, which it may join to your account number when you sign in. If you subscribe, they are told which plan you bought and an identifier for your account, and receive the App Store's record of the transaction. Like any server, they also see ordinary network information: your IP address, the app and system version, and your App Store country. They are told nothing else about you — not your name, not your email address, and nothing whatever of your ḥifẓ. What Yabqa keeps is the same as for any other payment — which plan, until when, and that it is yours.

Yabqa contains no analytics, no advertising, no third-party trackers and no social media pixels. If you choose Sign in with Google in the iPhone app, Google's own sign-in kit does that step, and it may collect information about your device and how it was used, under Google's privacy policy. Yabqa itself runs no analytics.

There is one more thing, and it only happens when Yabqa breaks. If something goes wrong, Yabqa sends us a description of the fault: what the code did wrong, the shape of the screen it happened on — /quran/:n rather than the Surah you were reading — the make of your browser, and which build you were on. It carries no name, no account, no device or session identifier, and nothing that could be joined back to you. Before it is sent, your device removes any Arabic, any email address and every number, so a passage cannot travel inside an error message; the database refuses the report outright if any of that survives. Identical faults are counted together as one, so what we end up with is “this broke 412 times” and never a list of people. It goes to our own database, not to any reporting company. You can turn it off in You → Privacy, and if you do, nothing is sent at all.

There is one thing we count, and this is it. If you have an account, we ask our own database how many accounts revised on three or more days in a week. It is a single number — nobody's name, nobody's passages, nobody's dates — worked out from the route already in your account, and it is read by us and sent nowhere. If you never sign in, you are not in it at all.

The follower — the optional feature that keeps your place while you recite — is off until you turn it on, and asks before it uses the microphone the first time.

On the website, the follower uses your browser's own speech recognition, and on most browsers that means your browser sends the audio to its own provider's servers to be turned into words. That happens between you and your browser's maker under their privacy policy, not ours. Yabqa never receives the audio, never stores it, and keeps only the words while the sitting is open.

In the iPhone app, the follower turns your recitation into words on the phone itself, with a speech recogniser built into Yabqa. Nothing you say leaves the phone. If that recogniser cannot start, the app uses Apple's speech recognition instead, which may send the audio to Apple under Apple's privacy policy; the notice before the follower starts says which one your phone will use.

We put this plainly rather than in a footnote, because it is the one part of Yabqa where something you say can leave your device.

A record of Qur'an memorisation says something about your religious practice, which the law in many places treats with extra care. Yabqa is built accordingly: no advertising, no profiling, no sharing, and a delete that really deletes.

We keep your information because you asked us to: keeping your route is the service itself. Because it says something about your religious practice, we also ask for your clear agreement when you create an account. To take that agreement back, delete your account. The person responsible for your information is Uzmaan Azeem.

Your route is kept for as long as you keep it. Delete your account and it is removed — your saved route, your history and your email address — and this is not a flag marking you as deleted; the rows are gone.

An account that nobody opens is kept until you delete it. A ḥāfiẓ can come back after years, and Yabqa does not delete a route because it has been quiet. Your account is stored in Seoul, South Korea.

From the You screen you can export everything Yabqa holds as a single file you keep, and you can delete everything. Deleting asks you to confirm in words, because it cannot be undone.

If you would rather ask us to do it, write to salaam@yabqa.app. Depending on where you live you may also have the right to a copy of your information, to have it corrected, or to object to it being held at all.

Yabqa is for anyone memorising the Qur'an, including young people learning with a teacher or a parent. An account may be created from the age of 13. Yabqa asks a reader's age when it is set up; below that age it does not offer an account, and can still be used fully on a device without one. Support has a short note for parents.

The date at the top changes with it. If a change means something genuinely different happens to your information, Yabqa will say so in the app rather than quietly updating this page.