Privacy policy
Last updated 3 November 2026.
This policy explains what personal data Ayahwise collects, why, how long we keep it and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018). Cookies are covered in more detail in our cookie policy.
Who we are
Ayahwise is run by Mohammad Umar, an individual based in the United Kingdom, who is the data controller for the personal data described here. In this policy, “we” and “us” mean Mohammad Umar.
Contact: [email protected].
The short version
- We collect what is needed to run your course: your name, email address, password (stored only as a one-way hash) and your learning record.
- Detailed usage analytics are collected only if you allow them, and are stored on our own server. There are no adverts and no third-party trackers.
- We never sell your data or share it for marketing.
- You can download a copy of your data or delete your account at any time in Settings.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Account details: your name, email address, a one-way hash of your password (never the password itself), when you joined and when you last signed in. | To create your account, sign you in and greet you by name. When you sign up we email you a code, so that only the owner of an address can open an account with it. | Contract: we need it to provide the course you signed up for. |
| Learning record: the words, phrases, sentences and verses you have studied, your answers (right or wrong, grade, time taken, whether you used a hint or the transliteration), your review schedule, lessons, milestones reached, surahs you are reading, the “Did you know?” notes you have seen, your automatic level and any difficulty adjustment. | To teach you: choosing what to review and when, matching exercises to your level, and showing your progress. | Contract. |
| Marking of meanings you type: the result of the marking (for example “Mostly understood” and which parts of the meaning you got), the grade suggested and the grade you accepted or chose. | To mark your answer and record your progress. Marking runs on our own server; nothing is sent to an outside AI service. | Contract. |
| Ayah Quest: daily quiz questions, answers, points and the days you played; your device's time zone offset (sent by your browser when a quiz starts, so “today” matches your day); in family games, each player's display name, answers and points. | To run the daily quiz, streaks and family games, and to pick questions that suit you. This is practice: it never changes your review schedule or level. | Contract for account holders. Legitimate interests for guests (letting a family play together). |
| Security data: your IP address, held in the server's memory for up to one hour to limit repeated requests; a one-way hash of your IP address and browser kept inside your sign-in cookie, used to spot a stolen sign-in. | To protect accounts and keep the service running for everyone. | Legitimate interests (security). |
| Analytics (only with your permission): see below. | To understand how the app is used and improve it. | Consent. |
| Cookie choices: a random identifier, whether you allowed analytics, the policy version and the date, linked to your account if you were signed in. | To remember your choice and show that consent was given. | Legal obligation (we must be able to show consent). |
We do not ask for your date of birth, address, phone number or payment details, and we do not ask about your religion or beliefs. People study Quranic Arabic for many reasons, and we never use your learning record to make assumptions about what you believe.
Analytics
If you choose “Allow analytics” in the cookie banner, we also record how you use the app: pages viewed, buttons and links used, exercises shown and answered, hints opened, difficulty changes, lessons, quizzes and games started and finished, screen and window size, browser and device type, language setting, the page you came from, page loading times and errors in the page. With the same permission we keep the text of meanings you type in your own words, so we can check and improve the marking.
Analytics are stored only on our own server, linked to your account if you are signed in. We never record your password, and the only typed text we keep is the meanings described above. Without your permission none of this is collected, and we do not keep the text you type.
You can change your mind at any time with . Collection stops straight away and the analytics cookie is deleted. Analytics already collected are deleted on the normal schedule below, or straight away if you delete your account.
Automatic marking and levels
Typed meanings are marked automatically by language models on our server, and your level is estimated from your answers. These only decide which exercises you see and how your answers are graded. You can always choose a different grade or adjust your level in Settings, and nothing about them has legal or similarly significant effects on you.
Children and family games
You must be 13 or older to create an account. Younger children are welcome to play a family game as a guest, with a grown-up who has an account. A guest gives only a display name and how well they know Quranic Arabic. We suggest a first name or nickname. A guest's name, answers and points are deleted with the game, 7 days after its last activity, and are not linked to anyone's account. If analytics are allowed in the browser being used, we record how the game is used, but not the guest's name.
If you believe a child under 13 has created an account, please contact us and we will delete it.
Who we share data with
We do not sell personal data or share it for advertising. The database is kept on our own server in the United Kingdom. Two organisations handle personal data for us. The first is Cloudflare, which sits in front of the site: it carries every request to our server (so it sees your IP address and the pages you request), protects the site against attacks and delivers the site's files quickly. Cloudflare acts on our behalf under its data processing agreement.
The second is Resend, an email delivery service, which sends the code that confirms your email address when you sign up. It receives only your email address and the code, and acts on our behalf under its data processing agreement.
We would disclose data only if the law required it.
Verse translations and word-by-word hints are fetched by our server from the Quran Foundation API. Only the verse or word is sent, never anything about you, and your browser does not contact them. Fonts, icons and images are all served from this site. Links to other sites, such as Quran.com for tafsir, take you to sites with their own privacy policies.
Cloudflare is based in the United States and may process requests in other countries. These transfers are protected by Cloudflare’s certification under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) and by the UK International Data Transfer Addendum in Cloudflare’s data processing addendum.
Where Resend handles data outside the United Kingdom, the transfer is protected by the standard contractual clauses, with the UK addendum, in its data processing addendum.
How long we keep data
| Data | Kept for |
|---|---|
| Account details and learning record, including daily quizzes and your answers in games | Until you delete your account. It is deleted straight away when you do. |
| A sign-up waiting for its email code (your name, email address and password hash) | Until the code is entered, when it becomes your account. A sign-up never confirmed is deleted within 24 hours. |
| Text of meanings you type (only with analytics permission) | 12 months, then removed. The marking result stays with your learning record. |
| Analytics events | 12 months |
| Records of cookie choices | 2 years. If you delete your account, the record stays but is no longer linked to you. |
| Family games, including guests' names and answers | 7 days after the game's last activity |
| IP addresses used to limit repeated requests | Up to one hour, in memory only |
| Backup copies of the database | Nightly, each deleted after 14 days. Deleting your account removes you from new backups straight away. |
| Request and sign-in logs | Our server keeps no access logs. Cloudflare keeps security logs for a limited period under its own policy. |
Your rights
You have the right to:
- get a copy of your data. Use “Download my data” in Settings, or ask us.
- take your data elsewhere in a machine-readable form. The download is a JSON file.
- have your data corrected. To change your name or email address, contact us.
- have your data deleted. Use “Delete my account” in Settings, or ask us.
- withdraw consent to analytics at any time, using cookie settings.
- object to or restrict how we use your data where we rely on legitimate interests.
Contact us at [email protected]. We will reply within one month. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.
Keeping data safe
Passwords are stored only as a one-way hash. Pages are served over an encrypted connection, every form is protected against forgery, sign-in attempts are limited, and the site loads no scripts from other companies. Your data stays on our own server and is only accessed to run and support the service.
Changes to this policy
When this policy changes we update the date at the top. If we change what analytics collect, the cookie banner asks for your choice again.