Privacy policy
Your learning is your own.
Masar Quran has no ads, no analytics and no tracking. You do not need an account. What you learn is stored on your device.
Who we are
Masar Quran is a free app and website made by Shajarah Labs as a continuing charity (sadaqah jariyah). Shajarah Labs is responsible for the personal data described here. Write to us about anything on this page at privacy@shajarahlabs.com.
What stays on your device
These are kept only on the device or browser where you use the app. We cannot see them.
| What | How long | Your control |
|---|---|---|
| Profiles: name, language, chosen path and settings | Until you delete them | Edit or delete in Settings |
| Progress, sessions, stars and crescents | Until you delete them | Export or delete in Settings |
| Answers and mistakes, including typed answers | Details for 365 days, totals until you delete them | Export or delete in Settings |
| Saved word meanings from Quran.com | Up to 6 days | Removed automatically |
“Delete all data on this device” in Settings removes everything at once. This cannot be undone, and because we hold no copy we cannot restore it for you.
What leaves your device, and when
| What | When | Goes to |
|---|---|---|
| Which word or ayah is being looked up | When a meaning needs fetching | Quran.com |
| Which recitation is being played | When you tap to listen | Quran.com’s audio service or EveryAyah |
| The word’s location and your typed answer | Only if “Accept answers in your own words” is on, and where that feature is available. It is off by default. | Our checking service, hosted by Supabase, which asks Anthropic’s AI to compare it with the meaning |
None of these include your name, your profile or your progress. Typed answers are used for that one check and are not stored by us. As with any internet request, the services you connect to see your IP address. Where we run the service, logs holding it are kept for 30 days or less.
The app does not use location, contacts, photos, advertising identifiers, analytics or crash reporting. If you use a QR code feature, the camera image stays on your device.
This website
The website sets no cookies and has no analytics. It is hosted by Cloudflare, which processes your IP address to deliver the pages and protect them from abuse. The 3D scene on the home page loads two open-source libraries from jsDelivr, which also sees your IP address when it delivers them.
If you email us, we keep your message and address only as long as we need them to help you.
Family sharing, when it arrives
This is not switched on yet. Today there are no accounts, and no progress leaves your device. We will update this page before it changes. Here is how it is designed to work:
Without an account, your learning stays on your device, as it does now. If you choose to join a family Home, your name and avatar, 7-day review streak, words known, surahs completed, current surah and the juz you take are encrypted on your device and shared with your Home and its wall display, such as Bayti One. Our server stores only the encrypted data and cannot read it. It does see your email address, which accounts and devices belong to which Home, and when records change. Your mistakes and word-by-word history are never shared.
Children
Families use Masar together, and children may have a profile on a parent’s device. A profile needs no account, email address or contact details from a child, and a child’s profile stays on the device. We do not knowingly collect personal data from children. If you think we hold any, please write to us and we will delete it.
What we never do
- We do not sell personal data or share it for advertising.
- We do not show ads, now or later.
- We do not build profiles of you or your family.
Your rights
Almost everything is already in your hands, in Settings. For anything else, including asking what we hold, correcting it or deleting it, write to privacy@shajarahlabs.com. You may also complain to the data protection authority where you live.
Security
- The Quran text is protected. It is bundled exactly as published by its source and checked with a SHA-256 fingerprint when the app loads, so a changed copy is detected.
- Connections are encrypted. The app and this site use HTTPS only.
- The web app is locked down. A browser security policy allows it to talk only to itself and the services named above.
- Family sharing is end-to-end encrypted by design. When it arrives, shared records are encrypted and signed on your device, and the keys stay on your devices.
- The code is open. Masar is licensed under GNU GPL v3 or later.
Found a security problem?
Please tell us privately at security@shajarahlabs.com with enough detail for us to reproduce it, and give us a reasonable time to fix it before making it public. Please do not access other people’s data while testing.
Changes to this policy
If this policy changes, we will update this page and its date. For a change that affects what leaves your device, we will update this page before the change takes effect.