Privacy Policy

1. About this policy

This Privacy Policy explains how Naba (“Naba”, “we”, “us”) handles information when you use the Nabaapp and website (together, the “Service”) to read, listen to, memorise and share the Quran, take part in a halaqa, or publish in Qari. It describes what we collect, why, who it is shared with, how long it is kept, and the choices you have. It should be read together with our Terms of Service.

2. Information kept on your device

Much of what makes the Service yours never leaves your device. The following is stored only in your browser or app storage, is not sent to us, and is removed if you clear the app’s data or uninstall it:

• Your settings, bookmarks, reading position and khatmah progress
• Surahs, recitations and translations you download for offline use
• The location you choose for prayer times, and the times calculated from it
• A Qari recording you have made but not yet posted (a draft)

3. Information we collect

We collect only what is needed for the features you choose to use.

3.1 Your account

An account is optional. If you create one, we store your username (your public profile address), your display name, and your email address, which you sign in with and which we use only to send you a link to reset your password when you ask for one. Your password(or, for accounts made before passwords, your PIN) is kept in protected form only — salted and hashed so that it cannot be read back, even by us. If you sign in with Google, we receive and keep the account identifier and email address Google confirms; we never see your Google password. We also record failed sign-in attempts so that an account can be locked temporarily against guessing. We do not ask for a phone number, and we never use your email for marketing.

3.2 What you publish in Qari

If you post a recitation, we store:

• The audio recording, with its length and size
• The title, note and hashtags you add
• The room sound and background you choose, and the sheikh you imitate, if any
• The outline of the recording used to draw its waveform
• The ayat you marked while reading from the Mushaf, if you marked any, and when

If you post an ayah card from the Read screen, we store the picture of the card, the ayah it shows, and any note you add.

For every post we also store whether it is public or private, when it was posted, and how many times it has been played and liked.

3.3 Your activity in Qari

• The posts you like, so they appear in your Favourites
• The people you follow, and who follows you
• The people you block, so their posts and notifications stay out of sight
• Notifications about your posts and followers (for example, a new like or follower)
• Reports you make about a post: who made the report, which post it concerns, and the reason given, so that it can be reviewed

3.4 Your profile picture

If you add a profile picture, it is resized on your device and then stored so that others can see it on your profile and your posts.

3.5 Halaqas

If you start or join a halaqa, we store:

• The name you enter, which everyone in that halaqa can see
• The days you read — marked when you confirm you read, or when you read in the app while in a halaqa. Members see which days you read, never how much or what.
• The juz you take in a shared khatmah, and when you finish it
• The halaqa’s name, its schedule and its invite link

A halaqa needs no account. Your device keeps a random key that identifies you in your halaqas, and we store only a protected (hashed) copy of it.

3.6 Notifications

If you allow notifications, your browser gives us a delivery address for your device and the keys that encrypt what is sent to it, together with a description of the browser. We use these only to send the notifications you turned on, and delete them when they stop working or you turn notifications off.

3.7 Feedback

If you send us feedback, we store your message, your name or username, and any contact details you choose to include, so that we can read and respond to it.

3.8 Usage information

To keep the Service working and understand which parts are used, we record which screens are opened and how often, the last screen visited, and when the app was last used or last used offline. This is linked to your account if you have one, or otherwise to a random identifier. It is not used for advertising and is not shared with anyone.

4. Device permissions

• Microphone.Used only while you are recording in Qari or using voice search. Recordings are uploaded only when you choose to post them. Voice search uses your device’s own speech recognition, provided by your browser or phone (for example Google or Apple), which may process what you say on its own servers under its own privacy policy. We do not receive or keep it — only the words it recognises are used, to search the Quran on your device.
• Location. Used only to calculate prayer times and the qibla direction, on your device. Your location is not sent to us. You can enter a city instead.
• Notifications. Used only for the notifications you turn on, such as the adhan, halaqa reminders, and activity on your Qari posts.

You can withdraw any of these permissions at any time in your device or browser settings.

5. How we use information

We use the information described above to:

• Provide the features you use, such as your account, Qari, halaqas and notifications
• Show your posts to others in line with the visibility you choose
• Keep the Service secure, prevent abuse, and review reports
• Respond to feedback and requests
• Understand, maintain and improve the Service

We do not sell or rent personal information, we do not use it for advertising, and we do not build profiles of you for any purpose beyond running the Service.

6. Who can see what you publish

Publicposts, your username, display name and profile picture can be seen by anyone using the Service, and public posts can be liked, shared and saved by others — including as audio, video or picture files that can then be passed on outside the Service. A recitation that imitates a sheikh also appears on that sheikh’s page. Private posts are visible only to you. Your followers and the people you follow are visible on profiles.

Anyone with a halaqa’s invite link can see its name, how many people are in it and how many have read today, and can join it. The person who started a halaqa can renew its link, remove members, or delete it for everyone.

7. Services we rely on

We use a small number of service providers to run the Service. Like any website, each of them receives your device’s IP address and basic request information when the app contacts it.

• MongoDB Atlas— hosts our database and the files you post (recordings, ayah cards and profile pictures).
• Quran content providers— Quran.com and the Quran Foundation, AlQuran Cloud, EveryAyah, MP3Quran, QuranicAudio and Tarteel provide Quran text, fonts, translations, recitations and recitation timings.
• Cloudinary— serves the moving backgrounds used in Qari and in shared videos.
• Resend— delivers the password reset emails you ask for. It receives your email address and the message, and nothing else.
• Google— if you choose “Continue with Google”, Google confirms who you are and tells us your account identifier and email address.
• Anthropic, Groq and Hugging Face— when you share part of an ayah, the ayah’s Arabic words, their word-by-word meanings and its published translation may be sent to an AI model (Anthropic’s Claude, or an open model run by Groq or Hugging Face) to find the matching part of the translation. Nothing about you is included.
• Push servicesrun by your browser’s maker (for example Google, Apple or Mozilla) — deliver the notifications you turn on.

We may also disclose information where required by law, or where necessary to protect the rights, safety or property of our users, the public or the Service.

8. Where information is processed

Our service providers may store or process information in countries other than your own. Where they do, we rely on providers that apply recognised safeguards to protect it.

9. How long we keep information

• Account information, for as long as the account exists
• A post, its likes and its reports, until the post or the account is deleted
• Halaqa information, while the halaqa exists; your reading days are deleted once you are no longer in any halaqa
• Notification delivery details, until they stop working or notifications are turned off
• Feedback, for as long as needed to deal with it

Deleted information is removed from our live systems straight away, and from backups within a short period after that.

10. Security

Connections to the Service are encrypted. Passwords, PINs and halaqa keys are stored only as salted hashes, password reset links work once and expire after 30 minutes, and repeated failed sign-ins lock an account temporarily. No method of transmission or storage is completely secure, so while we work to protect your information, we cannot guarantee its absolute security.

11. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to have it deleted, to object to or restrict how it is used, and to receive a copy of it. To exercise any of these rights, contact us at the address below. You can also act directly in the app:

• Delete your accountin Settings → Delete account. This permanently removes your account, every post you published with its audio or picture, your profile picture, your likes, follows and notifications, and reports you made or that concern your posts. It cannot be undone. If you can’t open the app, see how to ask us to delete it.
• Delete or hide a post from its menu, by deleting it or making it private.
• Leave a halaqa from within it.
• Turn off notifications in the app or in your device settings.

You also have the right to complain to the data-protection authority where you live.

12. Children

Naba can be used by people of any age to read and listen to the Quran without an account. Creating an account and publishing in Qari makes a username and what is published visible to others, so children should do so only with the knowledge and permission of a parent or guardian. If you believe a child has given us personal information without that permission, please contact us and we will remove it.

13. Changes to this policy

We will update this policy if the Service changes how it handles information — for example, if it begins to collect something new — and change the date at the top of this page. Where a change is significant, we will also make it known in the app. Continuing to use the Service after a change takes effect means you accept the updated policy.

14. Contact us

For questions about this policy, or to make a request about your information, contact us at [email protected].