Quranlingo Privacy Policy

Last updated: September 2026

Introduction

Welcome to Quranlingo! This Privacy Policy explains how Quranlingo ("we", "us", or "our") collects, uses, and protects your personal information when you use our mobile application and website. Quranlingo provides an educational platform designed for learners of all ages, and we are committed to safeguarding user privacy in compliance with applicable laws in the European Union (EU) and the United States (US). By using Quranlingo, you agree to the practices described in this Privacy Policy, which forms part of our Terms and Conditions. We adhere to the General Data Protection Regulation (GDPR) in the EU and the California Consumer Privacy Act (CCPA) in California, as well as the Children’s Online Privacy Protection Act (COPPA) in the US for users under 13. We strive to present this policy in clear, plain English, so that both parents and users (including younger users) can understand how their data is handled. For information specific to children under 13, please also read our Child Privacy Policy.

Information We Collect

The information we collect depends on which part of Quranlingo you use. We describe collection separately for the mobile learning app and our websites, parent dashboard, and school LMS, as different processing applies in each environment.

Mobile Learning App

Account and Authentication Information: When you create a Quranlingo account, we collect your name or display name and email address. Passwords are stored as cryptographic hashes and never in readable form. You may also sign in via Google or Apple; in that case, we receive only the profile information those providers share with you (name, email, and profile photo as you have authorized). For Apple Sign-in, if you choose to hide your email, we receive an anonymous relay address instead.
Learning Progress Data: We store your completed lessons, chapters, stages, earned XP, points, streaks, league standings, and vocabulary progress. This information is necessary to provide the learning experience and allows you to resume where you left off.
Subscription Status: We process your subscription entitlement status through RevenueCat, our subscription management provider. Purchase transactions are handled by the Apple App Store or Google Play; we receive only the subscription outcome, not your payment card details.
Push Notification Token (optional): If you enable push notifications, Firebase Cloud Messaging (FCM) assigns your device a registration token used solely to deliver learning reminders and account alerts you have requested. You can withdraw this permission at any time through your device settings.
Recitation and Audio (optional): If you use recitation-practice features, your device microphone captures audio for real-time pronunciation analysis. Audio is processed to generate educational feedback and is not retained for model training unless you explicitly opt in through a separate settings toggle.
Technical and Crash Diagnostics: We use Sentry to capture crash reports and error information when the app encounters a problem. Reports contain technical data such as the error type, app version, OS version, and stack trace. We have configured Sentry to minimise transmission of personal identifiers. This is necessary to maintain app stability.

The mobile learning app does not use Google Analytics, Firebase Analytics, advertising SDKs, behavioral analytics, cross-app tracking, or any profiling for advertising or marketing purposes.

Websites, Parent Dashboard, and School LMS

Account and Profile Information: The same account data described above, plus any additional profile details you add (biography, display name, profile photo).
Web Analytics Data: On our websites and web-based dashboards, we use Google Analytics 4 to understand how visitors interact with our pages. This includes your IP address (anonymised), browser type, pages visited, time spent, and approximate geographic region. Analytics cookies are activated only after you grant consent via our cookie banner.
Marketing Measurement Data: On marketing pages and the parent dashboard, we use the Meta Pixel and TikTok Pixel (subject to your cookie consent) to measure advertising effectiveness. These tools send event signals — such as page views, registrations, and subscription purchases — to Meta and TikTok. They are not present in the native mobile app and do not process children's personal data.
School and Classroom Data (School LMS): If your institution uses Quranlingo's educational platform, teacher and student account data, class assignments, and institutional settings may be processed solely to deliver the school service.
Newsletter and Marketing Communications: If you subscribe to our newsletter, we collect your email address to send you updates. Each email includes an unsubscribe link. If you unsubscribe, we will stop sending you the newsletter.

How We Use Your Information

We use the collected information for the following purposes:

To Provide and Maintain Our Services: We use personal data to create your account, enable the app’s features, and allow you to interact with other users. For example, we use your sign-up information to log you in and your follow/unfollow data to manage your social feed. This use is necessary to perform our contract with you (providing the Quranlingo service).
To Facilitate Social Interaction: Your profile information (like name and photo) and user-generated content (such as comments or reactions) may be shared with other users of Quranlingo as part of the app’s normal functionality. For instance, when you comment on a post, other users can see your comment along with your display name and profile photo.
To Communicate with You: We use your contact information to send important account-related messages, such as verification emails, password reset links, or notifications about changes to our service. If you sign up for the newsletter or agree to receive marketing communications, we will send you those as well (you can unsubscribe at any time). Additionally, if you have enabled push notifications, we may send notifications via Firebase Cloud Messaging (FCM) to alert you about learning reminders, account activity, or important updates. You can control push notifications through your device settings or in-app preferences.
To Improve and Analyze Our Services: We are continuously working to make Quranlingo better. For the mobile app, we use Sentry to capture crash reports and technical errors, helping us diagnose and fix stability issues quickly. On our websites and web dashboards, we use Google Analytics 4 (subject to your consent) to understand traffic patterns and improve web content. The mobile learning app does not use behavioral analytics or tracking SDKs to profile usage patterns.
For Marketing and Advertising Measurement: Where you have granted cookie consent, we use the Meta Pixel and TikTok Pixel (on our marketing website and parent dashboard) to measure the effectiveness of our advertising campaigns and to run retargeting ads on Facebook, Instagram, and TikTok. This involves sending anonymized or hashed event signals (such as page views, subscription purchases, or lead form submissions) to Meta and TikTok so that we can understand which ads lead to meaningful actions and reach people who are likely to benefit from Quranlingo. This processing is based on your consent and you may withdraw it at any time via the cookie consent settings.
For Safety and Compliance: We may process personal information to enforce our Terms of Service, to ensure user safety, and to prevent fraud or misuse of Quranlingo. This includes using data to detect and address violations (such as inappropriate behavior or content). We also use personal data as required to comply with legal obligations, such as keeping records for regulatory compliance or responding to lawful requests by authorities.

We will only use your personal information for the purposes described above and will seek your consent if we need to use it for any other purpose. For users in the EEA, our legal bases for processing your data include: the necessity to perform a contract (for core features of Quranlingo), your consent (for optional features like marketing emails or, in the case of children, parental consent), compliance with legal obligations, and our legitimate interests in improving our services and ensuring the security of our platform (balanced against your rights).

Third-Party Services and Analytics

Quranlingo relies on trusted third-party service providers to deliver its services. These providers act as data processors under contractual obligations. We do not sell your personal data. Data shared with third parties is limited to what is necessary for their specific functions. The processing that occurs differs between the mobile app and our web properties.

Mobile App Providers

Firebase Authentication (Google): We use Firebase Authentication to securely manage user sign-in and account sessions. It processes your email and authentication tokens. It is not a behavioral analytics service and does not track your in-app activity or learning behavior. Data is subject to Google’s Privacy Policy.
Firebase Cloud Messaging / FCM (Google): When you enable push notifications, FCM delivers them to your device using a device registration token. We use the FCM registration token solely to route push notifications to the appropriate app installation. Quranlingo does not use FCM to collect or analyze your learning behavior or location. You can disable notifications at any time through your device settings. Data is subject to Google’s Privacy Policy.
RevenueCat (Subscription Management): We use RevenueCat to manage and verify in-app subscription entitlements. RevenueCat processes subscription status, purchase records, and associated device identifiers. Payment card data is handled by the Apple App Store or Google Play; RevenueCat and Quranlingo do not receive it. For more information, see the RevenueCat Privacy Policy.
Sentry (Mobile Crash Diagnostics): The mobile app uses Sentry to capture crash reports and error information. When a crash or technical error occurs, Sentry records data such as the error type, stack trace, app version, OS version, and device type. We have configured Sentry to minimise transmission of personal identifiers. This data is used only to diagnose and fix stability issues. Sentry may process data on servers in the US under contractual data-protection obligations.

Website, Dashboard & Backend Providers

Sentry (Backend Error Tracking): Our backend systems also use Sentry to log server-side errors and exceptions. Captured information includes the error message, stack trace, timestamp, and contextual data such as a user ID or the action that triggered the error. Sensitive personal data is excluded from error reports where possible.
Google Analytics GA4 (Website and Web Dashboards only): On our websites and web-based dashboards, we use Google Analytics 4 to understand how visitors use our web properties. Google Analytics collects data such as session information, IP address (anonymised), browser and device type, pages visited, and approximate location, via cookies such as _ga. This data is used only to improve web content and user experience. Google Analytics is activated only after you grant cookie consent and is not present in the native mobile app. Data is subject to Google’s Privacy Policy.
Meta Pixel / Facebook Pixel (Website and Parent Dashboard): We use the Meta Pixel on both quranlingo.com and our parent dashboard at parents.quranlingo.app. The pixel sets advertising cookies (such as _fbp) and sends event data to Meta (Facebook) to help us measure the effectiveness of our advertising campaigns and reach relevant audiences on Facebook and Instagram. Events tracked include page views, content views, account registration completion, subscription checkout initiation, subscription purchases (including the value and plan type), school and newsletter lead submissions, and app download button clicks. We have configured cross-domain tracking so that a marketing page visit and a subsequent action on the parent dashboard can be attributed together. The Meta Pixel is active only after you grant cookie consent. It is not used in our mobile app, and it does not process children’s personal data. You can read more in the Meta Cookies & Pixel Policy.
TikTok Pixel (Website and Parent Dashboard): We use the TikTok Pixel on both quranlingo.com and our parent dashboard at parents.quranlingo.app. It sends event data to TikTok to help us measure ad campaign effectiveness and reach relevant audiences on TikTok. Events tracked include page views, content views, account registration completion, subscription checkout initiation, subscription purchases, form submissions (school interest, newsletter, card game waitlist), and app download button clicks. The TikTok Pixel is active only after you grant cookie consent. It is not used in our mobile app, and it does not process children’s personal data. You can read more in the TikTok Privacy Policy.

Cookies (Website and Web Dashboards only): Our websites and parent dashboard use cookies and similar tracking technologies. Cookies are small data files placed on your device when you visit a web page. Analytics and advertising cookies are only activated after you grant consent via our cookie banner. The native mobile learning app does not use browser cookies or behavioral tracking technologies. For detailed information on the specific cookies used on our web properties, please see our Cookie Policy.

Children's Privacy

Protecting the privacy of young users is especially important to us. Quranlingo is designed for children’s education, and we comply with child privacy laws such as COPPA in the US and relevant provisions of the GDPR (and EU member state laws) for children. This section explains how we handle personal data for users under the age of 13 (or under the applicable age of digital consent in your region, which is 16 in some EU countries).

Parental Consent: If a user indicates that they are under the age of 13 (or the applicable age in their country) during the sign-up process, we will require verifiable parental consent before that account can be fully used. We have implemented a simple and legally compliant parental consent mechanism that minimizes impact on the user experience. In practice, this means we may ask the child user to provide a parent or guardian’s email address. We then contact the parent directly with information about Quranlingo’s data practices and request consent for the child’s use of our service. The parent can provide consent by responding to the email or clicking a verification link. We take an additional step to confirm the consent (for example, sending a follow-up confirmation email to the parent), in line with the "email plus" method recognized under COPPA . This method is permitted when a child’s personal information will only be used internally by us and not shared publicly or with unrelated third parties

If we do not receive the required parental consent within a reasonable time, we will not activate the child’s account (or we will suspend or delete any information collected from the child in the interim). We do not allow children under 13 to use Quranlingo without parental approval.

Limitations on Child Data Collection: We do not ask children to provide any more personal information than is reasonably necessary to use Quranlingo. For example, while an email address is needed (usually the parent’s email for children) to create an account, we do not require a physical address or phone number from a child user. Any profile information or content that a child provides is entirely optional and under parental supervision.

We also take measures to prevent a child from sharing personal information publicly. Quranlingo’s social features are designed with safety in mind – for instance, a child’s profile may only display a username or avatar, and we filter or moderate public content to avoid disclosure of sensitive info. We do not knowingly allow children to post personal contact details in public areas of the app.

Parental Rights and Controls: If you are a parent or legal guardian of a Quranlingo user under 13, you have special rights regarding your child’s information. At any time, parents can contact us to: (a) review the personal information we have collected about their child; (b) request correction or update of that information; (c) refuse further collection or use of the child’s information; and (d) request deletion of their child’s account or personal data . If you revoke consent or request deletion, we will promptly remove the child’s personal information from our records (except as needed to comply with legal obligations) and ensure it is deleted securely or anonymized. Note that even after deletion, it may take a short period to fully remove data from backups.

We will notify parents of any material changes to our practices regarding children’s data. If we make significant changes to how we collect or use children’s personal information, we will seek updated parental consent as required by law. Our goal is to give parents control while allowing children to benefit from Quranlingo’s educational content in a safe manner.

Your Rights Under GDPR (EU/EEA)

If you are located in the European Economic Area (EEA) or another jurisdiction with similar laws, you have certain rights over your personal data under the GDPR. These include:

Right of Access: You have the right to request a copy of the personal data we hold about you, as well as information on how we process it.
Right to Rectification: If any of your information is inaccurate or incomplete, you have the right to ask us to correct or update it.
Right to Erasure: You can request that we delete your personal data if, for example, it is no longer necessary for the purposes it was collected. This is also known as the "right to be forgotten." We will honor such requests to the extent required by law. (Please note we may retain some information if we have a legal obligation to do so or other lawful basis to keep it.)
Right to Restrict Processing: You have the right to ask us to limit the processing of your data in certain circumstances – for instance, while we address a concern about the accuracy of your data or an objection you have raised to our processing.
Right to Data Portability: You have the right to obtain your personal data from us in a structured, commonly used, machine-readable format, and to have that data transmitted to another service provider where technically feasible.
Right to Object: You may object to our processing of your personal information if we are processing it based on legitimate interests or for direct marketing. If you object, we will consider your request and stop or adjust processing unless we have compelling legitimate grounds to continue (or if the objection is to marketing, we will stop).
Right to Withdraw Consent: If we rely on your consent to process any of your data, you have the right to withdraw that consent at any time. For example, you can opt out of the newsletter or revoke consent for a child’s account, and we will stop the processing that was based on consent. Withdrawal of consent does not affect the lawfulness of any processing conducted prior to your withdrawal.

To exercise any of these rights, please contact us using the contact details in the “Contact Us” section below. We may need to verify your identity (to protect your privacy by ensuring it’s you making the request) and in the case of a parent exercising rights on behalf of a child, we may need additional verification of the relationship. We will respond to your request within one month, as required by GDPR, unless an extension is permitted. There is no fee for exercising your rights, unless requests become excessive or repetitive, in which case a reasonable fee may apply as allowed by law.

Additionally, if you believe we have infringed your data protection rights, you have the right to lodge a complaint with your local supervisory authority (Data Protection Authority) in the EU. We would, however, appreciate the chance to address your concerns directly, so we encourage you to contact us first with any complaint.

Your Rights Under CCPA (California)

If you are a California resident, you are protected by the California Consumer Privacy Act (CCPA) (as amended by the CPRA). In compliance with CCPA, we provide the following rights to California users:

Right to Know: You have the right to know what personal information we collect, use, disclose, and sell (please note, Quranlingo does not sell your personal information, as explained below). You can request that we disclose the categories of personal information we have collected about you, the categories of sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it. Much of this information is provided in this Privacy Policy. You also have the right to request a copy of the specific pieces of personal information we have collected about you in the 12 months preceding your request.
Right to Deletion: You have the right to request that we delete personal information we have collected from you (and direct our service providers to do the same). Upon a verified request, we will delete your personal data from our records, unless an exception applies. For example, we may retain information needed to complete a transaction you requested, detect security incidents, comply with legal obligations, or other reasons permitted by CCPA.
Right to Opt-Out of Sale: CCPA gives you the right to opt out of the “sale” of your personal information. As stated, Quranlingo does not sell personal data to third parties for monetary value. We also do not share personal information for behavioral advertising or targeted advertising in a way that would be considered a sale under CCPA. Therefore, there is no need for you to opt out – we simply do not sell your data. If in the future we ever considered sharing data in a way that CCPA defines as a “sale,” we would provide a clear opt-out mechanism (such as a “Do Not Sell My Info” link) and obtain any required consents, especially for minors.
Right to Correct: You have the right to request that we correct any inaccurate personal information we hold about you. If you have an account, you can also correct and update some of your information directly (for example, by editing your profile).
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you our services, charge you a different price, or provide a lesser quality of service because you exercised your rights. Quranlingo provides the same level of service and features to all users regardless of any privacy rights requests.

To make a CCPA request, you (or an authorized agent acting on your behalf) can contact us through the methods listed in the “Contact Us” section. Please specify that you are making a “CCPA request” and describe which right you are seeking to exercise (access/know, deletion, correction, etc.). We will need to verify your identity (or your agent’s authority) before fulfilling the request, which may involve asking you to provide additional information or to log in to your account. We will respond to verifiable requests within 45 days as required by CCPA (or notify you if we need more time).

Note that some information we collect is exempt from CCPA’s scope (for example, information governed by other privacy laws like COPPA or medical/financial information protected by other laws). However, our policy is to apply the same spirit of transparency and control to all users. If you have any questions about your California privacy rights, you can also contact us for further information.

Data Retention and Deletion

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations. This means that we keep your data for the duration of your account being active and for a period afterward only if needed for legal, accounting, or legitimate business purposes.

Account Data: If you have an account with Quranlingo, we will retain your account information and user content for as long as your account is active. If you choose to delete your account (or a parent withdraws consent for a child’s account), we will initiate deletion of personal data associated with that account. Account deletion will result in removal of your profile information and any personal data not required for our legal compliance. Some residual data (like comments you made on others’ posts) might remain visible to other users unless those users delete it, but we will disassociate it from your profile.
Interactions and Content: Content that you have posted (such as comments or reactions) may be retained as part of another user’s experience (for example, comments you made on a teacher’s post may remain visible to that teacher). However, we can anonymize or remove identifying information from such content upon request. If another user (e.g., a parent or teacher) deletes content that involved your data, it will be deleted from our systems according to that user’s request.
Analytics and Logs: Usage data, analytics records, and crash logs are generally retained for a shorter period. We might keep analytics data in aggregated form (which does not identify individuals) indefinitely to help us understand trends over time. Crash reports and technical logs are typically retained only long enough to analyze and fix issues, then they may be deleted or stored in aggregate form. For instance, Crashlytics and Sentry data are routinely purged after issues are resolved or after a set time frame, to reduce storage of unnecessary personal data.
Legal Retention Requirements: In some cases, we may need to retain certain information for longer periods if required by law. For example, records of parental consents, transactions, or communications might be kept to comply with COPPA or other regulatory requirements. If we are under a legal obligation to retain data (such as for tax, audit, or court order reasons), we will securely store the data for the required period and not use it for other purposes.

When we no longer have a legitimate need or legal obligation to keep your personal information, we will delete it or anonymize it. We use commercially reasonable and secure methods to delete data. For example, we may permanently erase data from our servers or overwrite it. In some cases, instead of outright deletion, we may anonymize the data so it can no longer be associated with you (for instance, converting event logs to statistical summaries). We follow industry best practices to ensure that deleted data is not accessible by unauthorized parties

Please note that when you delete the app from your device, it does not automatically delete your account or data. You will need to follow the in-app account deletion process or contact us to request deletion. We also want to highlight that removing data from backup systems may take additional time, but we will ensure it’s removed in the next backup cycle.

Data Security

We take the security of your personal information very seriously. Quranlingo implements appropriate technical and organizational measures to protect your data from unauthorized access, loss, misuse, or alteration. These measures include encryption of data in transit (e.g., using HTTPS for our website and secure communication for the app) and encryption of sensitive data at rest where applicable. We also restrict access to personal data to authorized personnel who need it to operate our service, and we ensure our staff and partners are subject to confidentiality obligations.

We continuously work to update and improve our security practices to adapt to new threats. However, please understand that no method of transmitting or storing data is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security of information transmitted through the internet or stored on our servers. You share and transmit data at your own risk, but rest assured we are using commercially reasonable efforts and industry standards to protect your data.

As a user, you also have a role in keeping your information secure. Please maintain the confidentiality of any account credentials (such as your password, if you have one) and be mindful of the information you share. If you believe that your account or personal data has been compromised, please contact us immediately so we can take appropriate action.

International Data Transfers

Quranlingo is accessible to users around the world. The data we collect from you may be transferred to, and stored on, servers located outside of your state, province, or country. In particular, if you are in the EU/EEA, be aware that your personal information may be transferred to and processed in the United States or other countries where some of our third-party service providers (such as Google, RevenueCat, and Sentry) are based. These countries may have data protection laws that are different from those in your jurisdiction and, in some cases, may not be deemed “adequate” by the European Commission.

Whenever we transfer personal data out of the EU/EEA, we take steps to ensure that appropriate safeguards are in place to protect your information. We rely on Standard Contractual Clauses (SCCs) – which are the European Commission’s approved model data protection clauses – as a legal mechanism for international data transfers . These SCCs contractually require the recipient of the data to protect it to EU privacy standards. In some cases, we may rely on other safeguards or exceptions permitted by the GDPR, such as when a transfer is necessary to perform our contract with you, or if you give us explicit consent after being informed of the possible risks.

By using Quranlingo, you understand that your information may be transferred to our facilities and those third parties with whom we share it as described in this policy. That said, we will always ensure such transfers are done in compliance with applicable privacy laws and that your data remains protected. If you would like more information about international data transfers or a copy of the SCCs we use, you can contact us using the information below.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. If we make material changes, we will notify you by means of a prominent notice within the app or on our website, or by sending you an email (if we have your email on file). We will indicate at the top of this Privacy Policy the date of the latest revision.

We encourage you to review this Privacy Policy periodically for any updates. Your continued use of Quranlingo after any changes to this Privacy Policy constitutes your acceptance of those changes, to the extent permitted by law. If you do not agree with any updates or changes, you should stop using the service and, if applicable, delete your account.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us. We are here to help and will respond as promptly as we can.

Contact Information:

Email: [email protected]

For privacy-specific concerns, please include "Privacy Inquiry" in the subject line of your email. If you are contacting us to exercise a privacy right (such as a GDPR or CCPA request), please describe your request with sufficient detail and include any information that will help us verify your identity. Additional company information is available at quranlingo.app/imprint.

Language of this Privacy Policy

Please note that this Privacy Policy is provided in English only and we currently do not offer translations in other languages. If you do use a translation tool to read this policy in another language, keep in mind that the English version is the official text.

Thank you for taking the time to read our Privacy Policy. We value your trust and are dedicated to protecting your privacy while you or your children engage with Quranlingo’s educational platform.