Privacy Policy

Effective July 10, 2026

The Hifz Project is a free Quran memorization app. We collect the minimum data needed to run the service, we don't show ads, and we don't sell your data. This page explains exactly what we store, who processes it, and how to erase it.

What we collect

• Account details. Your email address and display name, stored with our authentication provider, Supabase.
• Learning progress. Your cards, review history, preferences, and known surahs — the data that powers spaced repetition scheduling.
• Subscription status. If you subscribe to the voice add-on, we store your Stripe customer and subscription IDs so we know your plan is active. Your payment card details are held by Stripe and never touch our servers.

Voice recitation

When you tap the microphone, your recording is sent to DeepInfra (running the whisper-large-v3 model) for transcription. The audio is not stored by the app — it is transcribed and discarded. We log the timestamp of each transcription request (nothing else) for rate limiting.

Classrooms

If you join a classroom with a teacher's invite code, that teacher can see your display name, email address, and learning progress (words learned, review counts, accuracy, last active) while you're a member. Leave the class at any time from the Classroom page and that visibility ends immediately. Teachers: your students see your class name only.

Announcement emails

We occasionally send announcement emails about the service to the email address on your account. These are delivered through Resend, which processes your email address for that purpose. Every announcement email includes an unsubscribe link — click it and we'll stop sending them. Opting out does not affect account or billing emails.

Analytics

We use Vercel Web Analytics, which is anonymous and does not use cookies. It cannot identify you or track you across sites.

Quran content

Quran text and audio come from the quran.com and alquran.cloud APIs. These requests fetch public Quran content only — no personal data is sent to them.

Third-party processors

These are the only services that process data on our behalf:

• Supabase — authentication and database (account and progress data).
• Stripe — payments and subscription billing.
• DeepInfra — voice transcription (audio processed, not stored).
• Resend — delivery of announcement emails (processes your email address).
• Cloudflare — bot protection (Turnstile) on the signup and password-reset forms.
• Vercel — hosting and anonymous analytics.

Deleting your data

You can delete your account at any time from Settings → Danger Zone. Deletion cancels any active subscription and permanently erases your account and all associated data. This cannot be undone.

One narrow exception: if your account used the free voice trial, we keep a minimal record of that (a normalized form of the email address and the trial dates — no name, no learning data) after deletion. It exists only so the one-per-person trial can't be reset by deleting and re-creating an account.

Changes

If we change this policy, we'll update this page and the effective date above.

Contact

Email us at support@thehifzproject.com — for privacy or data requests, include the email address on your account.