Privacy

Reading without an account

Reading the Quran and the Hadees library never requires an account, and nothing on those pages changes if you do not have one.

Preferences, bookmarks, loved and saved ayahs, your read-later list, reading plans, reflections, recent searches and optional location coordinates are stored in this browser using versioned localStorage keys. Anyone with access to this browser can read them, and localStorage is not encryption.

Geolocation is requested only after you choose “Use my location.” A denied permission is not requested again automatically. Coordinates are never sent to this project’s servers.

If you create an account

An account exists for one reason: so the things you save follow you between devices. It stores your name, your email address, a hash of your password (if you set one), and the items you choose to save — bookmarks, loved and saved ayahs, your read-later list, reading history, reading position, synchronised settings, and any notes or collections you create.

Your password is never stored. What is stored is an Argon2id hash, from which the password cannot be recovered. Sign-in tokens are stored only as keyed hashes, and are held in HttpOnly cookies that no script on this site can read.

Your saved items are stored as references — “2:255”, a hadith number — rather than as copies of the text. The Quran and Hadees libraries are public and read-only, and nothing you do can change them.

What is deliberately not collected

No third-party analytics or advertising scripts are bundled here. Your reading history records what you opened and when — not your IP address, not a device fingerprint, and not a referrer.

IP addresses are used transiently to rate-limit sign-in attempts, and are kept only as a keyed hash on your own session records so you can recognise a device in your settings. They are never stored in the clear.

Religious reminders are never sent unless you explicitly turn them on.

Your data is yours

From account settings you can download everything stored about you as a JSON file, sign individual devices out, and delete your account. Deleting an account removes every personal row attached to it. Clearing device data uses this site’s reset controls or your browser settings.