Privacy policy

1. Who we are

Tibyan is a non-profit project in service of the Holy Quran. It covers the Tibyan app, the altibyan.app website and the recitation model training platform, train.altibyan.app. The data described here is controlled by the project's owner (Tibyan), who can be reached at info@altibyan.app.

2. What stays on your device

The app works without an account. The following is stored on your device only and is never sent to us:

• Your settings: language, appearance, mushaf and riwaya, reciter and player settings, what shows under the verse.
• Your reading position, bookmarks and marks.
• Your reflection (tadabbur) notes.
• Khatmas, their log and reminders, and your reading and listening reports.
• Memorisation and review progress, and recitation checking results as text only (verses, words, mistakes), never audio.
• Tasbih counts and the adhkar you add.
• Your search history.
• The mushaf pages, recitations, tafsir and recitation models you download.

This data is removed when you delete the app or clear its data in your device settings.

3. Backups

• Manual backup: from the settings you can export one file with your data and settings, which you save or share yourself through your device's share sheet. The file never passes through our servers.
• Android: if Google's automatic backup is on for your device, it covers your database and settings only, not content that can be downloaded again. That backup is run by Google under your account settings.
• iPhone, iPad and Mac: your database and settings are part of your iCloud or device backup; mushaf pages, recitations and recitation models are excluded because they can be downloaded again.
• Sync (optional, off by default): if you turn it on, a copy of your bookmarks, khatmas and their progress, misbaha, hifz record and some look and reciter settings is kept in your own account: iCloud on Apple devices, or the app's private folder in Google Drive on Android. It never passes through our servers, you have no account with us, and Tibyan cannot access it. You can stop it and delete its cloud data from the settings.

4. Microphone and recitation checking

The app asks for the microphone only when you use recitation checking. Your voice is turned into text on your device by the recognition model you downloaded; the audio is not saved to a file and is not sent to any server. Only the result, as text, stays on your device. You can withdraw the permission at any time in your device settings.

5. Internet use and downloads

The app goes online to download content when you ask for it or when you turn on automatic updates: mushaf pages, recitations, timing files, recitation models and content packs. These files come from the project's server (tibyan.ahmedhelal.dev) and from their original sources, such as mp3quran.net, GitHub and Quran.com's files.

As with any internet connection, the server sending a file sees your device's IP address. We do not use it to track you or tie it to any identity, and the app sends no device or account identifier with these requests.

6. Crash reports (optional)

Crash reports are off by default. If you turn them on in the settings, the app sends a technical report when it crashes (error details, app version, device type and OS) through Sentry. The app is set up to send no personal data: no user identity, no screenshots, no navigation trail and no request data. You can turn them off at any time and sending stops at once.

7. Report a problem

If you send a report or suggestion from inside the app, it goes to altibyan.app with: the report type, your description, your phone number and email if you enter them (both optional), the app version, and your OS and its version. You see this before sending.

• We use it only to understand the problem and reply to you.
• If it cannot be sent (for example while offline) it waits on your device and is sent later; it is removed from the device as soon as it is sent, or after 14 days if it never could be.
• On the server we keep a one-way, keyed hash of your IP address, only to stop repeated submissions.
• We keep a report until it is handled, and delete it within 12 months of receiving it at most. You can ask us to delete it sooner.

8. Notifications and other permissions

• Notifications: to show download progress, control playback and deliver the khatma reminders you set. All are created on your device; we send no notifications from our servers to the app.
• Home-screen widgets: show the verse of the day, your khatma and the tasbih counter from data stored on your device.
• Volume buttons: if you turn on counting with them, they count tasbih only while the counter is open.
• Photos: when you save a verse image, the app asks to add it to your photo library, for that purpose only.

9. The altibyan.app website

The «Notify me at launch» and «Join the beta test» forms collect your email address, the devices you choose in the beta form, and the page language. We send you a confirmation email, and the project team gets an alert about the sign-up.

• We use your email only to tell you about the launch, or to add you as a tester on Google Play or Apple's TestFlight (which means sharing your email with them for that purpose only).
• To unsubscribe or have your email deleted, write to info@altibyan.app and we will delete it.
• The site uses strictly necessary cookies only: a session cookie (to protect forms against forged requests) and a language preference. No advertising or analytics cookies, and fonts are served from our own servers.
• Our servers keep temporary technical logs (including IP addresses) for security and operation only.

Group khatma

It works without an account: the organizer shares the khatma's link, and whoever opens it claims a part under a name they type themselves. Our server keeps only: the khatma's random id, its title and organizer name if given, the number of parts and target date, the names you type when claiming (at most 40 characters), and each part's state with the times it was claimed and finished.

• We ask for no email, phone number or login, and we do not store IP addresses with khatma data. IP addresses are used briefly in memory only to limit repeated requests.
• The codes for managing and finishing parts stay on your device; the server keeps only their hashed fingerprint.
• Everyone with the link sees the name you type, so type one you are happy to show.
• A khatma is deleted completely and automatically 30 days after it is completed, or 180 days after its last activity. Its organizer can delete it at any time, and any participant can release their part, which removes their name.

10. The training platform, train.altibyan.app

The platform is separate from the app and collects volunteers' recitations to train the recitation model. Taking part is optional and needs an account.

• What we collect: your email, your password (hashed), your birth year only to verify age, and your licence consent. With each recording: the surah, verses and duration, plus optional details that improve training (gender, age bracket, dialect, native language, recording environment, pace).
• Under 18: a parent or guardian's consent is required at sign-up.
• How recordings are used: volunteers review every recording; accepted ones, after processing, are made available to train recitation recognition models under CC BY 4.0, which allows reuse with attribution. Raw files are kept outside the public site and are never offered for public download.
• Deletion: you can delete any recording from your account and it is removed at once, or ask for your recordings or your whole account to be deleted on the «How we use your voice» page. Anything released before deletion is removed from later releases of the training data, but copies others obtained earlier cannot be recalled.
• Cookies: a session cookie (for signing in and protection against forged requests) and a language preference only. If you turn on browser notifications, we store the subscription address your browser gives us to send them; you can turn them off at any time.
• Contact messages: what you send from the contact page (name, email, message) is used only to reply, and deleted within 12 months.

11. Sharing with others

We never sell your data or share it for advertising or marketing. We only rely on what running the service needs: our hosting provider, an email provider to send messages, Sentry for crash reports if you turn them on, and Google Play and TestFlight to add testers. We may disclose data if the law requires us to.

12. Your rights

The app's data is on your device and fully under your control. For anything we received from you (a report, an email address, a training platform account), you can ask to see, correct or delete it by writing to info@altibyan.app from the same address; we will reply within 30 days.

13. Children

The app is suitable for all ages; it needs no account and collects no personal data from anyone. The training platform requires a parent or guardian's consent for anyone under 18. If you learn that a child sent us data without consent, write to us and we will delete it.

14. Changes to this policy

We may update this policy as the project grows, and will change the «Last updated» date at the top. No new feature that sends data from the app (such as optional account sync) will be switched on before this policy is updated to describe it.

15. Contact

For any privacy question or request: info@altibyan.app.