Contents
1. Who is responsible
Learn-Quran.co (“we”) is responsible for personal data handled by the Learn Quran applications and AI Feedback service. For privacy questions and to exercise your rights, write to [email protected].
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | Email address, display name, the sign-in method you used (Google, Apple, or email code), a Learn Quran account identifier | You, or Google/Apple when you choose that sign-in |
| Recitation audio | The short recording you submit for AI Feedback | You, when you tap send |
| Feedback results | Detected mistakes, explanations, score, verdict, the āyah or lesson item, the language you asked for feedback in | Generated by the service |
| Purchase and balance | Store product bought, store transaction identifier, settlement status, credit grants and consumption, the platform the purchase was made on, and lifecycle details for an existing subscription where applicable | Apple App Store / Google Play, and our ledger |
| Technical and diagnostic | App version, platform (iOS/Android), device model class, coarse timestamps, error and performance logs, IP address at the time of a request | Automatically, from your app |
| Support correspondence | What you write to us and our replies | You |
We do not collect precise location, contacts, photos, health data, biometric identifiers used to identify you, or advertising identifiers for cross-app tracking. We do not sell personal data and we do not share it for cross-context behavioural advertising.
3. Your recitation audio, specifically
This is the most personal thing the service touches, so we describe it precisely.
- Recording happens on your device. Nothing leaves your device until you tap send. Recording and re-recording are free and local.
- When you send, the audio is uploaded over TLS, converted to a standard 16 kHz mono format, and passed to the AI model that produces your feedback.
- The audio and its result are stored against your account so that your history works across your devices and after a reinstall.
- We do not intentionally submit your audio for a provider’s general model training. The processors, product settings, and contractual safeguards used for AI Feedback are reviewed before a production release and are described in section 6.
- Deleting an item from your history deletes both the stored audio and the result.
Voice recordings can be treated as sensitive personal data in some jurisdictions. We treat this audio as sensitive regardless of whether the law where you live requires it.
3.1 Language suggestion on public legal pages
When you open a public AI Credits legal page, your browser may make a direct request to Learn Quran’s country-level location endpoint to suggest one of the languages already available in the Learn Quran Tajwid apps. The page script uses only the returned country code to make that suggestion; it does not use precise location, send the result through the AI Feedback API, or save the country. A language you choose yourself is saved only in your browser so that public legal pages can remember that preference. The selected language may also be included in a public legal-page URL while you navigate; it is not a country or precise-location value. You can change it at any time.
4. Why we use it, and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6 / PDP Law Art. 20) |
|---|---|---|
| Produce the AI Feedback you asked for | Recitation audio, āyah/lesson context, language | Performance of a contract |
| Keep your history available to you | Audio, results, account id | Performance of a contract |
| Create the account and sign you in | Email, sign-in method, one-time codes | Performance of a contract |
| Grant and account for AI Credits, honour refunds | Store transaction identifiers, ledger entries | Performance of a contract; legal obligation (tax/records) |
| Prevent fraud and abuse of purchases | Transaction identifiers, IP, device signals | Legitimate interests (protecting the service and honest users) |
| Diagnose faults, keep the service reliable | Technical and diagnostic data | Legitimate interests |
| Answer your support requests | Correspondence, account identity | Performance of a contract; legitimate interests |
Where the law of your country requires consent instead of legitimate interests — including for the processing of voice data as sensitive data under Indonesia’s PDP Law No. 27 of 2022 — we ask for that consent in the app before the first submission, and you may withdraw it at any time by stopping use of AI Feedback and deleting your history.
5. Email sign-in codes
If you sign in with your email address, we send a numeric one-time code to it. To do that we process your email address and send it through our email delivery provider.
- The code is stored only as a cryptographic hash, is valid for a short period, may be used once, and is invalidated after a small number of incorrect attempts.
- We record the attempt for security purposes (time, coarse network origin, outcome) so that we can detect and stop abuse of the sign-in system.
- We deliberately return the same response whether or not an account exists for an address, so that the sign-in screen cannot be used to discover who has an account.
- We do not use your email address for marketing unless you separately opt in.
6. Who else processes it
| Processor | What they see | Why |
|---|---|---|
| Google Cloud / Vertex AI (and equivalent AI providers) | Recitation audio and the evaluation prompt | Produce the tajweed assessment under the provider product and contractual terms selected for the service. |
| Cloud hosting and object storage providers | Stored audio, results, account records | Run the service and hold your history |
| Apple App Store / Google Play | Purchase and subscription events, transaction identifiers | They are the merchant of record; we verify purchases with them |
| Email delivery provider | Your email address and the message containing your one-time code | Deliver sign-in codes and service notices |
| Firebase / analytics and crash reporting | Technical, diagnostic and app-event data tied to a pseudonymous identifier | Diagnose faults and understand feature usage |
We use processor terms and safeguards appropriate to the role and the law that applies to the processing. We also disclose data where legally required, and to protect rights and safety. If our business is transferred, we will provide notice where the law requires it.
7. International transfers
We are based in Indonesia and may use providers with facilities in Asia, the European Economic Area and the United States. Before making an international transfer, we apply the transfer mechanism and safeguards required for the specific data, processor, and jurisdiction. Where applicable, that can include recognised adequacy decisions, contractual clauses, and supplementary technical safeguards. Transfers out of Indonesia are handled in accordance with applicable Indonesian PDP requirements.
8. How long we keep it
| Data | Retention |
|---|---|
| Recitation audio and results | While needed to provide your history, until you delete the item, or until a reviewed retention process removes it |
| Account identity | While the account exists, then as needed to complete a verified deletion request and meet legal obligations |
| Credit ledger and purchase records | For the period required for accounting, tax, fraud prevention, refunds, and legal obligations, in a minimised form where possible |
| One-time sign-in codes | Only for their short validity period; the stored verifier is a hash and is invalidated after use or expiry |
| Diagnostic logs and support correspondence | For a limited period appropriate to security, support, and legal obligations |
After a verified deletion request we remove or irreversibly anonymise personal data within the period required by applicable law, except where we must retain a financial, fraud-prevention, or other legal record. We minimise retained records to what that purpose requires.
9. Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you, and get a copy;
- Correct anything inaccurate;
- Delete your account and data;
- Export your data in a portable, machine-readable format;
- Restrict or object to processing based on legitimate interests, including the use of de-identified samples for accuracy measurement;
- Withdraw consent where we relied on it, without affecting past processing;
- Complain to your supervisory authority — in Indonesia the authority designated under PDP Law No. 27 of 2022; in the EEA your national DPA; in the UK the ICO.
Write to [email protected] from the email address on the account, or use account deletion inside the app. We respond within the period required by applicable law and do not charge for a first request where the law gives that right.
We can only act on a request we can verify. Because your email address is the account key, a request must come from an address that currently controls the account. If you have lost access to that mailbox we will not be able to verify you, and we will not disclose, transfer or delete the account on the strength of an unverifiable claim — doing so is exactly how accounts get stolen. See section 3 of the Terms. Regain access with your email provider first.
10. Regional notices
European Economic Area and United Kingdom
Legal bases are listed in section 4. You have the rights in Articles 15–22 GDPR. AI Feedback is not a decision producing legal or similarly significant effects, so Article 22 does not apply to it; a score in a learning app does not determine anything about your rights or your access to services.
California (CCPA/CPRA)
In the last 12 months we collected the categories described in section 2, including audio recordings (Cal. Civ. Code §1798.140(v)(1)(K)) and, where you sign in with email, an identifier. We have not sold personal information and have not shared it for cross-context behavioural advertising, including for consumers under 16. You may exercise rights to know, delete, correct, and limit the use of sensitive personal information by writing to us; we do not discriminate against you for doing so. You may use an authorised agent.
Indonesia (UU PDP 27/2022)
We process personal data as Pengendali Data Pribadi. Voice recordings are treated as specific personal data and are processed on the basis of your consent, which you may withdraw. You have the rights of access, correction, erasure, withdrawal of consent, objection to automated processing, and to claim compensation for a breach, under Articles 5–15.
Other regions
Where Brazil’s LGPD, Canada’s PIPEDA, Australia’s Privacy Act, or another comparable law applies to you, we honour the equivalent rights on request.
11. Children
AI Feedback is not directed at children under 13, and we do not knowingly collect personal data from them. Where a child uses the app with a parent or guardian, the adult is responsible for the account and for any purchase. If you believe a child has provided personal data to us without the involvement of a parent or guardian, write to us and we will delete it.
12. Security
We use encrypted transport, hashed one-time codes, signed short-lived session tokens, rate limits, and access controls designed to limit access to service data. Purchase verification is performed server-side against Apple and Google directly — a client cannot grant itself credits.
No system is perfectly secure. If a breach is likely to result in a high risk to your rights, we will notify you and the relevant authority within the deadlines the law sets (72 hours under GDPR, 3×24 hours under Indonesia’s PDP Law).
13. Changes
We will post a new version here and, for material changes, notify you in the app or by email before the change takes effect. The version and effective date at the top always identify the operative version.
14. Contact
Learn-Quran.co
For privacy, account, or support requests, email [email protected].