Privacy Notice

Quraan Journey is an independent Qur’an reading and source-navigation service operated by Quraan Journey Administration. It uses the Quran Foundation Content APIs and links to the wider Quran.com and QuranReflect ecosystem. Quran Foundation does not operate Quraan Journey.

Account

Name, email address, one-way password hash, role, account dates, age confirmation, terms acceptance, and consent timestamps. Used to create, secure, and manage your account.

Religious reading activity

Only after separate explicit consent: bookmarks, last-read ayah or Mushaf page, reading goal, and activity dates. This is sensitive religious data and powers only your private reading tools.

Trust and correspondence records

Discussion status; private content-concern details; and contact-form name, reply email, category, subject, message, status, and resolution records. Used to answer requests, moderate community areas, and protect religious-content integrity.

Security records

Short-lived request-limit counters based on a one-way network identifier and limited server security logs. Used to prevent abuse, protect accounts, and investigate incidents.

Prayer-time location

Country and city suggestions are searched in Quraan Journey’s locally hosted GeoNames extract. The city, country, calculation method, and Asr convention you submit are then sent to AlAdhan to produce a timetable. They are not linked to your account by the application.

Source Guide input

Your question and a small set of approved source candidates may be sent to OpenAI only when the optional routing service is configured. Do not include names, health details, contact details, or other private information.

Qibla location

Precise coordinates used by the Qibla Finder remain in browser memory only. They are not submitted to Quraan Journey, linked to your account, written to storage, or sent to a third-party API.

Quran Foundation Content API requests are made by our server using chapter and ayah references, not your name, email, bookmarks, progress, or account identity. Quraan Journey uses the content-only client-credentials flow and does not request, receive, or store Quran Foundation user OAuth tokens.

We use account data to provide the service you request, sensitive reading data only on the basis of your explicit consent, and limited security data for legitimate service protection. We do not sell personal data, mine religious activity, or use your reading activity to target ads. No advertising is shown on the site at present, and no advertising provider receives anything from it. We do not use your content to train Quraan Journey AI models. OpenAI states that API customer content is not used to improve its models unless the customer explicitly opts in; Quraan Journey does not opt in.

You may read the Qur’an and public learning material without an account. Inside My Journey, you can correct your name or email, download a machine-readable copy of your data, withdraw sensitive reading-data consent, delete reading activity, or permanently delete an ordinary member account. Withdrawal does not affect prior lawful processing.

Verified requests for access, correction, deletion, restriction, objection, or portability may also be submitted through the private contact form. We respond within 30 days unless applicable law permits an extension. OAuth-token revocation is not applicable because Quraan Journey does not use Quran Foundation user OAuth.

We disclose only the data necessary for a provider to perform its function. Each provider is engaged under its published binding service terms and, where personal data is processed, an applicable data-protection agreement. Providers must respect Quraan Journey’s Islamic content boundaries and are prohibited from misusing, altering, mining, or repurposing Qur’an or Quran Foundation content. Apart from the advertising measurement tag described under Advertising below — which receives only page-level browsing data, and only with your consent — we do not permit providers to use Quraan Journey data for advertising profiles.

Quraan Journey is not showing advertising at present. No advertising network is loaded, no advertising measurement tag is requested, and no advertising cookie is set. Because nothing advertising-related runs, the site asks for no advertising consent and sets no cookie for it.

If advertising is introduced again, this notice will be updated before the first advert appears, and it will say which provider serves it and what that provider receives. Adverts would never be placed before a sūrah, between āyāt, inside the Qur'an reader or the muṣḥaf, or anywhere on the children's pages.

We use HTTPS and HSTS, one-way password hashing, CSRF protection, request limiting, least-privilege account roles, server-side provider credentials, and restricted administrative areas. Hostinger documents encryption at rest and access-control measures in its DPA. Provider secrets are reviewed and rotated at least every 90 days and immediately after suspected exposure.

If a security incident affects Quran Foundation data or systems, we will contain and investigate it and notify Quran Foundation within 24 hours as required by its Developer Terms and Security Rule 6.9. Where law requires, affected people and authorities will also be notified.

Account and consent records are kept while the account is active.

The in-account delete control removes ordinary member account data from the live database immediately. Verified assisted requests are completed as soon as practical and no later than 30 days.

Deleted data may remain in encrypted, access-restricted backups for up to 90 days before automatic expiry.

Quran Foundation provider responses are cached for no more than six hours and expired cache files are removed automatically—well inside the provider’s one-week maximum.

Prayer-time results are cached for no more than 30 minutes and expired location caches are removed automatically.

Qibla coordinates are not retained by Quraan Journey and disappear from the tool when the page is reloaded or closed.

Open contact messages are kept while a request is being handled. Closed correspondence and spam classifications are removed from the live database after 12 months; one-way contact-form abuse hashes are cleared after 24 hours.

Request-limit counters expire with their short abuse-prevention window. Limited server logs are retained only as long as necessary for security and operations.

Quraan Journey accounts are independent from Quran Foundation accounts, so the application has no QF account identifier with which to associate or retain data after a QF account is deleted. If QF OAuth or user APIs are introduced in the future, linked app data will be deleted when the connected QF account is deleted.

Accounts are for people aged 13 or older, and registration requires age confirmation. Children under 13 may use the public, read-only material with a parent or guardian and without creating an account or storing reading activity. If you believe a child created an account, contact us for prompt deletion.

Providers may process data outside your country. Where required, transfers rely on contractual protections such as Standard Contractual Clauses or equivalent safeguards described in the applicable data-processing agreements.

Material changes will be shown through a prominent website or account notice before they take effect and, when appropriate, sent by email. A new explicit choice will be requested before any materially different use of sensitive religious data.

Privacy contact: Quraan Journey Administration
Secure channel: Private contact form
Administrative mailbox: admin@quraanjourney.com
Postal address: Lebanon, Beirut
Website: quraanjourney.com