Alpha Muslim: Quran & Dhikr

Privacy Policy

Last updated 15 October 2026.

Who is responsible

The data controller is M Arslan Munir. Contact: alphamuslimapp@gmail.com. Write to that address for any privacy request. No separate postal address is published with this policy.

Religious data and consent

Alpha Muslim is a Quran reader and worship companion. It does not show ads and it does not include a tracking or advertising SDK. Using it can show that you are engaging with Islamic worship. That is religious data. The lawful basis is your explicit consent, under UK GDPR Article 6(1)(a) and Article 9(2)(a). You can read the bundled Quran, calculate prayer times, and use dhikr without an account. Creating an account, turning on notifications, sending feedback, posting a lesson question, or searching with a live translation is optional. You can withdraw consent by deleting the account, turning those features off, or emailing us.

On this device

Bookmarks, notes, collections, reading progress, streaks, goals, tasbih counts, prayer settings, and downloads stay on this phone until you create an account and sync. Prayer times and the Qibla direction are calculated on this device. If you use your current location, the coordinates are sent once to Open-Meteo to look up the city name (see Location). They are not stored by us. Android backup of the app data is turned off. A profile photo, if you add one, stays on the phone and is not uploaded. Photos are not collected.

Account

Name, email, and our user id are collected only if you create an account. Sign-up is optional. A course certificate also includes the student name you set. Email, Google, or Apple (when Apple sign-in is enabled) is handled by Supabase Auth. Passwords are not stored in the app. A password must be at least 8 characters and include a letter and a number.

App activity

If you sign in, the app syncs reading days, goals, course enrolments, lesson progress, quiz answers, and settings such as the prayer city id, calculation method, reciter, and translation. GPS coordinates are not synced.

Lesson questions and course reviews

A signed-in reader who can open a lesson may post a question. Other readers who can open that lesson can see the question text and a display name. They cannot see your account id. You can delete your own question or answer in the app. Anyone who can see a question or answer can report it, and can block it so it stays hidden on their phone. A report is sent to the feedback inbox. An approved course review (a rating and the text) is visible to anyone who can see the course. Reviews do not show an account id. Reviews can also be reported and blocked.

Notes, feedback, and search

Notes, collections, bookmarks, feedback, and report text are collected when you create them. A guest can send feedback without an email address. When a live translation is selected, the search text is sent to Quran.com / Quran Foundation through our proxy. It is not stored as a search history. The request can appear in host logs for that host's retention window, then it is dropped. Bundled translations are searched on the device. There is no Quran Foundation account connection in the app, and a Supabase sign-in token is not sent to Quran Foundation.

Location

Approximate location is the prayer city you choose. That city id is synced only for a signed-in account. Precise location and background location are not collected. When you choose "use my location", the app sends the coordinates once to the Open-Meteo geocoding service to find your city name and time zone. Open-Meteo returns the city; we do not store or sync the coordinates.

Device identifiers

Shorebird sends a per-install id on every update check. Firebase Cloud Messaging creates an installation id and a token only after you turn on notifications, prayer alerts, or announcements. The token is stored only while at least one of those is on, and the stored row is deleted when all of them are off. A token row that is not refreshed is deleted after 90 days. We do not collect an advertising ID. Nothing here is shared. Supabase, Firebase, Shorebird, and the other providers below process data for us. In Google Play's terms that is not sharing.

Where data is stored and who processes it

Supabase stores the account, the synced library, and edge-function traffic in the Tokyo region (ap-northeast-1). Google and Firebase (sign-in and Cloud Messaging), Shorebird (update checks), and Resend (account email, such as confirmation and password reset) process data in the United States. Cloudflare delivers the public site. Quran Foundation / Quran.com serves Quran content, and search text only when a live translation is selected. These are international transfers from the UK or Pakistan to Japan and the United States. We use providers that cover those transfers with the UK extension to the EU-US Data Privacy Framework, where the provider is certified, or with standard contractual clauses.

Third-party sources and services

These are the outside sources and services the app uses, and how:

Quran.com / Quran Foundation API: Quran text, translations, tafsirs and recitation audio, used with written permission. Downloaded content is kept on your device. Search text goes to them only when a live translation is selected.

Sunnah.com API: hadith collections (Arabic and English), used with permission. We download the hadith to our own database (Supabase) and refresh it monthly; the app reads hadith from our database, not from Sunnah.com, so your use of the hadith section is not sent to Sunnah.com.

Open-Meteo: city lookup from your GPS position, only when you use your location. The coordinates are sent once and are not stored by us.

Prayer times: calculated on your phone with the open-source adhan library. No prayer-time service receives your location.

Recitation and adhkar audio: streamed from EveryAyah.com, the Quran.com audio CDN, hisnmuslim.com, and Tarteel QUL files hosted on Wasabi storage. These hosts see a normal web request (IP address), not your account.

Supabase: accounts, sign-in, synced library, course enrolments, lesson progress, assignments, quiz answers, feedback and the cached hadith database.

Firebase Cloud Messaging (Google): delivers notifications, only after you turn them on.

Shorebird: delivers app updates; sends a per-install id on update checks.

Google and Apple sign-in: only if you choose them to sign in.

Have I Been Pwned (Pwned Passwords): when you set a password, the app checks it against known breached passwords using only the first five characters of its hash; your password is never sent.

Resend: sends account emails such as confirmation and password reset. Cloudflare: delivers this website.

The public website

Pages on alphamuslim.app may record a page view so the site host can see that a page was opened. That beacon is not in the Android or iOS app. To ask for deletion without the app, use admin.alphamuslim.app/delete-account.

How long we keep it

The account, synced library, course progress, quiz attempts, reviews, and lesson questions are kept until you delete the account, or until we complete a deletion request. Feedback is deleted with the account when the address matches, or on request. Device notification tokens are deleted when you turn notifications off, and automatically if the row is not refreshed for 90 days. Search text is not stored as a history. Certificate records stay so a public certificate id can be checked, until the account is deleted.

Your rights

You can ask for access, a copy, correction, deletion, or restriction, and you can object or withdraw consent. In the app, Account and Settings include Delete account. That removes the sign-in and the cloud rows for that account, then wipes the library on that phone. If you cannot open the app, email alphamuslimapp@gmail.com. We aim to answer within 30 days. You may also complain to the Information Commissioner's Office in the UK, or to the supervisory authority where you live.

Children

Alpha Muslim is for people aged 13 and over. It is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has an account, email us and we will delete it.

What we do not collect

Alpha Muslim does not collect crash logs, diagnostics, photos, audio files, financial information, or an advertising ID. This version is free. It does not sell digital goods and it does not ask for payment.

Contact

M Arslan Munir, alphamuslimapp@gmail.com.