Privacy Policy

1. Information we collect

• Account details: your name, email address, password (stored only in scrambled, one-way form; we can never see it), language, and, if you choose to give them, your phone number and gender.
• If you sign in with Google: your name, email address and Google account ID, from Google. We never see your Google password.
• Confirmations: that you are 15 or older, that you agree classes are recorded, and that you agree to our Terms and this policy, with the date you confirmed.
• Your learning profile: your goal (for example, memorizing or receiving an ijazah), how much time you have each day, what you have memorized before, where you want to start (for example, a particular surah), the riwayah you memorize in, your age range and your country. We suggest your country from the rough location of your internet connection; you can change it.
• Children’s profiles (added by a parent or guardian): the child’s name, gender and age range, and their learning profile. A child’s profile has no email address or password of its own.
• Bookings and payments: what you bought (single classes and subscriptions), prices, classes used and left, pauses, plan changes, cancellations and refunds. Card payments are handled by our payment provider, Stripe; when you subscribe, Stripe keeps your card for the next payments. We see only the card type, its last 4 digits and its expiry date, and never see or store your full card number.
• Your classes: dates and times, who joined and for how long (from our video provider), progress cards written by your teacher, and any no-show reports with the notes you add.
• Class recordings: the video and audio of every class (see section 2).
• Your daily wird: what you mark as done each day, your streaks, and the reciter you choose to listen to.
• Your calendar link, if you make one: a private link that lets a calendar app show your classes (see section 5).
• Teachers: profile details (name in English and Arabic, biography, credentials, ijazah, the qira’at they hold an ijazah in, gender so students can choose a male or female teacher, photo), availability, time away, classes taught and payout information.
• Technical information: your sign-in session, language and which profile you are using are saved on your device. We keep your time zone, so class times are shown and emailed in your own time. Our servers keep short-term logs (such as IP address and requests) for security and troubleshooting, and send us reports of errors without passwords or the content of your requests.

2. Class recordings

Every Ihfaz class is recorded. Recording starts automatically when the teacher (or an Ihfaz moderator) joins, and it cannot be turned off. Agreeing to recording is a condition of creating an account, for students, parents (on behalf of their children), teachers and staff alike. We record classes:

• to keep everyone safe, especially children;
• to resolve disputes fairly, such as a missed class or a complaint about conduct;
• so students can review their recitation and teachers can follow their progress.

Who can watch a recording: the student (or, for a child, their parent or guardian), the teacher of that class, and authorized Ihfaz staff (administrators and our head of instructors). Recordings are never made public, never sold and never used for advertising.

How long we keep them: the student and teacher can watch a recording for 3 months after the class. After that it is kept in a restricted archive that only Ihfaz administrators can open, for 24 months, and then deleted. We may delete a recording sooner, or keep one longer if it is needed for an open dispute or a legal obligation.

Recordings are stored in private cloud storage and played through links that expire after a short time.

An Ihfaz staff member may join a class as “Ihfaz Moderator”, for example when a teacher cannot attend. They appear in the class like any other participant.

3. Children

You must be 15 or older to have your own Ihfaz account. Learners aged 4 to 14 take part through a child’s profile that a parent or guardian adds under their own account. The parent or guardian:

• gives the child’s details and consents to their classes being recorded;
• books, pays for and joins the classes, and receives all emails about them;
• can edit the child’s profile at any time, remove it while nothing has been booked for it, or ask us to delete the child’s information (see section 9).

A child’s teacher sees the child’s name, age range, learning profile and progress, and that the classes were booked by their parent. We collect only what is needed to teach the child. If we learn that someone under 15 has created their own account, we may close it.

4. How we use your information

• to run your account and the service: finding a teacher, booking and moving classes, holding video classes, recordings and progress cards;
• to take payments (including a subscription’s payment every 4 weeks), give refunds under our cancellation rules, and pay teachers;
• to send you emails about your account and classes: confirmations, reminders, progress cards, password links and similar messages;
• to show your classes in your own calendar, if you add your calendar link;
• to keep the service safe and fair: checking attendance, reviewing no-show reports and complaints, and preventing fraud and misuse;
• to understand and improve Ihfaz, using totals and statistics rather than individual profiles;
• to meet our legal obligations, such as keeping accounting records.

Where data-protection laws such as the GDPR apply, we rely on: performing our contract with you (running your account and classes); our legitimate interests (safety, preventing fraud, improving the service); your consent where we ask for it; and legal obligations.

5. Who we share it with

• Your teacher, and for teachers their students: only what is needed for your classes (for example, a teacher never sees your payment details).
• Service providers who run parts of Ihfaz for us and may only use your information to do so: Stripe (payments), Zoom (video classes and recording), Cloudflare (our websites and recording storage), Render (our servers, in Frankfurt, Germany), Neon (our database), Brevo (email), Infobip (verification codes by WhatsApp or SMS, if you use a phone number), Microsoft Clarity (website and app usage analytics, only if you allow it), Google (sign-in with Google, if you use it, and fonts on our website), Sentry (reports of errors in our servers, without passwords or the content of your requests) and EveryAyah (the Quran recitation in the daily wird, played straight from everyayah.com, which sees your device’s IP address).
• Calendar apps you choose: if you add your calendar link to Google Calendar, Apple Calendar, Outlook or another calendar, that service reads your class times, names (yours or your child’s, and your teacher’s) and the class link, and handles them under its own privacy policy. Making a new link in Settings stops the old one working.
• Authorities or others, when the law requires it or when it is needed to protect someone’s safety.
• A buyer or successor, if Ihfaz is ever sold or merged, under this policy.

We do not sell your personal information, and we do not show advertising.

6. International transfers

Our providers may store or process information outside your country, including in the European Union and the United States. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

7. How long we keep information

• Account and learning profile: while your account is open, and for a short time after you close it.
• Bookings, payments and refunds: 5 years, as accounting and tax rules require.
• Class recordings: as described in section 2.
• Server logs and error reports: for a short period, for security and troubleshooting.
• Your calendar link: until you make a new one or close your account.

When we no longer need information, we delete it or make it anonymous.

8. Security

We protect your information with encrypted connections, passwords stored only in one-way form, private storage with expiring links for recordings, and access limited by role (for example, a teacher sees only their own students). No system is perfectly secure; if you notice anything suspicious, please tell us.

9. Your rights and choices

Depending on where you live, you may have the right to:

• see the personal information we hold about you and get a copy of it;
• correct it (most of it you can change yourself in Settings);
• ask us to delete it, or to close your account;
• object to or restrict some uses of it;
• withdraw a consent you gave;
• complain to your data-protection authority.

To use any of these rights, email us at [email protected]. We reply within 30 days, and may need to confirm who you are first. Because recording is required for every class, withdrawing your consent to recording means we cannot hold classes for you, and we will close your account; past recordings follow the periods in section 2.

10. Cookies and similar technology

We do not use advertising cookies. The Ihfaz app saves a few things on your device so it works: your sign-in, your language, and which profile (yours or a child’s) you are using. You can clear them by signing out or clearing your browser data. If you use Continue with Google, Google’s sign-in window uses Google’s own cookies.

With your permission, we also use Microsoft Clarity to see how people use our website and app (which pages and screens they visit, where they tap and scroll), so we can make them easier to use. Clarity sets its own cookies and records your visit, including pictures of the app’s screens. Screens with your account, family, payments, classes or recordings are never recorded. We ask before turning it on, and you can change your answer at any time under Cookie settings at the bottom of our website, or in Settings in the app.

11. Changes to this policy

We may update this policy. If the changes are significant, we will tell you by email or in the app before they take effect. The date at the top shows when it last changed.

12. Contact us

Questions or requests about your privacy: [email protected].