سياسة الخصوصية

1. Who we are

Ayaverse is provided by Optijara AI LLC, a company in the United Arab Emirates (“we”, “us”), which decides how this data is used. Contact: hamza.diaz@optijara.ai.

2. Reading without an account

You can read the Quran, tafsir, translation, adhkar and hadith without an account. Without an account, the app keeps only non-personal preferences on your device: UI language, theme, Arabic text size and a resume position for reading (no identity or reading history). Tracking, saves, notes, statistics and profiles require sign-in. Searches are sent to our server to find matching ayahs and are not saved. Nothing personal is kept by us.

When you press play, your device loads the recitation directly from EveryAyah (everyayah.com), which receives your network address and the file requested under its own terms. Links to source websites (such as HadeethEnc.com) open those sites.

Like any website, the servers and hosting provider that deliver Ayaverse process technical request data (network address, browser, requested page) to serve it and keep it secure.

When you start signing in, the browser briefly keeps small sign-in flags on your device: the page to return to after sign-in and whether a Google sign-in is in progress (for that tab only), and a random signal that tells your other open Ayaverse tabs to re-check who is signed in. They hold no personal data and are not sent to us.

3. With an account

Accounts are optional and are for ages 13 and up. If you create one we handle:

• Sign-in data: you sign in with Google or, where the app offers it, with Apple. Google shares your name, email address, profile picture link and a Google account id; Apple shares an Apple user id and an email address (which can be a private relay address you choose), and your name only if you choose to share it. They go to Firebase Authentication (Google), which keeps them in our project’s user record. Our community database does not copy your email address or name from the provider; you choose your own handle and display name. A sign-in cookie (HttpOnly, up to 14 days) keeps you signed in.
• Your profile: the handle, display name and short bio you choose, a randomly generated avatar pattern, whether your account is private, when you joined, and only a “13 or older: yes” eligibility flag with its confirmation time, never a birth date. New profiles are private by default.
• Recorded reading (on by default for new accounts; you can pause it): the ayahs credited in your current khatm cycle after timed on-screen reading, your completed khatms, this week’s count and total credited reading time, plus a short-lived reading session record (about 30 minutes). It is recorded activity, not a measure of worship or understanding.
• Community activity: the shares you make (always a reference to app-provided Quran, dhikr or hadith content, never your own text), who you follow and follow requests, who you block, circles you start or join (name, description, weekly goal, a hash of the invite code, and whether you show your count there), and reports you file (reason and optional note).
• Safety records: reports others file about your account, shares or circles, with a snapshot of what was reported (for example your handle, display name and bio at that time), and moderation decisions.
• Abuse limits: short-lived counters, stored under a hash of your account id or network address, that limit how often actions can be repeated. They are cleaned up after they expire.
• Your private account data: reading position and history, saved ayahs, notes, daily target, adhkar counters and personal settings are stored under your signed-in account in Cloudflare D1. On the first sign-in after the account-storage update, older device data for the account you sign in to, together with any pre-account legacy data, is uploaded once and merged into that account; existing server data wins on conflict. Those old copies are cleared only after the upload succeeds. Older partitions belonging to other accounts wait until their owner signs in.

What others can see: new profiles are private by default. Approved followers can see your profile and shares; making your profile public also makes its handle, display name, bio, avatar pattern, join month and follow counts visible to others. Leaderboard identities use only your handle and avatar, alongside recorded reading counts; private profiles are shown only to you and approved followers. Control visibility and recording in Account, and progress sharing in each circle. People you block, and who block you, do not see each other while signed in. Blocking also removes follows between you and each of you from the circles the other started; unblocking does not restore them.

4. Why we use it

• to provide your account, profile, follows, circles and the leaderboard you asked for;
• to keep the community safe: the word filter on names, bios and circle details, reports, blocking and moderation;
• to secure the service and prevent abuse.

We do not use your data for advertising, sell it, or share it for anyone else’s marketing.

5. Who processes it

• Google (Firebase Authentication) verifies your sign-in. Cloudflare (Workers and D1) processes and stores your account records.
• The hosting provider that serves the app processes technical request data.
• Google or Apple, for the sign-in you choose, under their own terms.

We may disclose information where the law requires it, or to protect people’s safety (see the Safety & Community Standards).

6. How long we keep it

• Your account, profile, recorded reading and community activity: until you delete them or your account.
• Reading session records: about 30 minutes. Abuse-limit counters: until their short window expires and they are swept.
• Reports you filed: kept as moderation history, but on account deletion they no longer point to you and your note is erased. Reports about you and their snapshots, and moderation decisions, are kept as safety records.
• Google may keep copies in its systems for a limited time under its own practices.

7. Deleting your account

In the app: Settings › Delete account, or Settings › Delete account. While signed in, you confirm once; deletion happens immediately and you are signed out. You can also email hamza.diaz@optijara.ai. Full details: Delete your account.

8. Your choices and rights

• Request a copy of your account data by emailing us.
• Correct your handle, name and bio in Edit profile; hide from the leaderboard, pause recording or make your account private at any time.
• Delete your account (section 7). Depending on where you live you may also object to or restrict processing, or complain to a data protection authority.

For any request, email hamza.diaz@optijara.ai. We may confirm the request comes from the account holder.

9. Security

Connections use HTTPS. Only our server reads or writes the database (direct access from browsers is denied), sign-in uses HttpOnly cookies with cross-site request protection, and account deletion uses your signed-in session with one confirmation. No service is perfectly secure.

10. Children

Ayaverse welcomes everyone, children included. Reading and listening need no account and collect no personal data for an Ayaverse account; technical request processing and direct audio-provider requests are explained in section 2. Accounts are for ages 13 and up. We do not knowingly collect personal data from anyone under 13 and delete it if we learn of it. Parents or guardians can contact hamza.diaz@optijara.ai to ask about or delete a child’s account.

The neutral age question stores only “13 or older: yes” and the time it was confirmed, never a birth date. If an answer is under 13, no Ayaverse account is created. A non-personal device flag delays another account attempt for 24 hours; it contains only the retry time and is not sent to us. Reading and listening remain available. See the Safety & Community Standards.

11. Changes

We will update this page and its effective date when our practices change, and give notice before a material change applies.