Thabat ثبات Quran Memorization Review
Privacy Policy

Your memory is yours.
Here is how we protect it.

This Privacy Policy explains how Thabat — Quran Memorization Review (“Thabat”, “we”, “us”, or “our”) collects, uses, and shares personal data when you use the Thabat mobile application and its related services (the “Service”). It should be read together with our Terms & Conditions.

Effective date: 30 June 2026

01Who We Are

We operate Thabat, a Qur’an-memorization (“Hifz”) practice app. For the purposes of applicable data-protection law, we are the controller of the personal data described here. You can reach us about privacy and your data at [email protected] or through the in-app support form.

02Data We Collect

2.1 Data you provide

  • Account and identity: your email address and, if you sign in with Google, the name and profile picture your Google account shares. These are managed by our authentication provider (see Section 4).
  • Date of birth: collected once, during onboarding, to confirm you meet our minimum age and to determine an age band. Your date of birth is stored privately and is not shown back to you or to other users.
  • Profile: a display name and an optional short bio that you choose.
  • Country: a country code you provide during onboarding.
  • Memorization and study data: which portions of the Qur’an you mark as memorized, your quiz sessions and individual answers (including what you type or select, timing, confidence, and correctness), your spaced-repetition review history, saved quiz settings, streaks, progress, and gamification data.
  • Streak-pause reasons and notes: if you pause your streak, the reason you select — which can include health-related reasons (such as illness or menstruation) or a religious-observance reason (such as i’tikaf) — and any free-text note you add.
  • Support and reports: the subject and message of any support request you send, the category you choose, content reports you submit, and reactions you give to in-app announcements.
  • Preferences: language, theme, font, reminder and notification settings, and similar choices.

2.2 Data collected automatically

  • Usage data: timestamps of your activity (such as when you were last active, daily logins, and streak dates) and records of the notifications we send you. These are used to run features like streaks, reminders, and your activity view, and in aggregate to understand overall app usage.
  • Device and app information (limited): when you contact support, the app attaches a technical snapshot — app version, platform (iOS/Android/web), operating-system version, locale, theme, and timezone — to help us troubleshoot. Your device’s timezone is also used to schedule reminders and calculate day boundaries. We do not collect your device’s precise model or advertising identifier.
  • Push notification token and device identifier: if you enable notifications, we store a push token and a randomly generated device identifier so we can deliver notifications to your device.
  • Diagnostics: if the app or server encounters an error, we collect crash and error reports through our diagnostics provider (see Section 4). We do not deliberately attach your identity to these reports.
  • On your device: the app stores your progress, settings, sync queue, and cached content locally on your device (including in secure device storage for your sign-in token and a device identifier).
We do not use third-party advertising or product-analytics tracking, and we do not store your IP address in our own logs. Our servers do not log request contents; authentication tokens and cookies are redacted from our logs.

2.3 Data from third parties

  • Authentication provider: your verified email, name, and profile picture as described above.
  • Subscriptions provider and app stores: if you subscribe, we receive your subscription status and related purchase events (such as product, store, renewal and expiry dates) so we can unlock paid features. We do not receive your full payment card details.

03Why We Use It

We use personal data to:

  • create and secure your Account and authenticate you;
  • provide the core Service — syncing your memorization progress across devices, generating and grading quizzes, scheduling spaced repetition, and showing your streaks, progress, and analytics;
  • send you the notifications you have enabled (study reminders, streak warnings, and announcements you have not opted out of);
  • verify your age and apply age-appropriate settings;
  • provide customer support and respond to your reports;
  • operate subscriptions and unlock paid features;
  • keep the Service secure, prevent abuse, diagnose problems, and improve reliability;
  • comply with legal obligations.
Depending on where you live, our legal bases for processing may include performing our contract with you, your consent (for example, for notifications and for sensitive data such as health-related streak reasons), our legitimate interests in operating and securing the Service, and compliance with legal obligations. Some of the data described above — such as date of birth, health-related streak reasons, religious-observance reasons, and the fact that you use a Qur’an-memorization app — may be treated as sensitive under some laws, and we rely on your consent to collect and use it for the features you choose to engage with.

04Who We Share It With

We do not sell your personal data. We share it only with service providers who process it on our behalf, and only as needed to run the Service:

Clerk
Our authentication and identity provider. It stores your sign-in credentials and identity (email, name, profile picture) and processes your sign-in, including Google sign-in. Your IP address is transmitted to Clerk as part of authentication.
RevenueCat, with the Apple App Store and Google Play
Our subscriptions provider. It processes purchases and sends us subscription-status events. Your account identifier and store purchase data are shared to manage your entitlement.
Sentry
Our crash- and error-reporting provider. It receives crash and error reports (error details, stack traces, device and app metadata, and limited performance data) to help us keep the Service stable. In some error cases an identifier may appear in an error message.
Expo push notification service
Receives your push token and the content of the notifications we send so it can deliver them to your device.
Anthropic
An artificial-intelligence provider used only by our reviewers to help draft quiz questions, distractors, word hints, and study notes from Qur’anic corpus text. Your personal data and your quiz answers are not sent to Anthropic; the app is designed to block personal data from these requests.
Replit and Neon
Our cloud hosting and database providers, where your data is stored.

We may also disclose personal data if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users, the public, or the Service — and in connection with a corporate transaction such as a merger or acquisition, subject to this policy.

05International Transfers

Our providers may process and store data in countries other than Jordan, including the United States, where several of them are based. Where data is transferred internationally, we rely on appropriate safeguards required by applicable law, such as standard contractual clauses or equivalent measures.

06Data Retention

We keep personal data for as long as your Account is active and as needed to provide the Service, and afterwards only as required for the purposes described in this policy or by law. When it is no longer needed for those purposes, we delete it.

  • You can request deletion of your Account and associated data as described in Section 8. When your Account is deleted, most of your data is removed from our systems.
  • Some limited records may be retained after deletion — for example, a support message you sent (with the email you used) and administrative records of moderation actions — where we have a legitimate or legal reason to keep them.
  • If you cancel a store Subscription, remember that you must do so in the App Store or Google Play; deleting the app or your Account does not cancel it.

07Security

We take reasonable technical and organizational measures to protect your data. These include transmitting data over encrypted connections (HTTPS), storing your sign-in token in your device’s secure storage, restricting administrative access to authorized staff through role-based controls, keeping an audit log of administrative actions, redacting authentication tokens from server logs, and designing our AI features so that personal data is not sent to the AI provider. Your password is handled by our authentication provider and is not stored by us.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

08Your Rights and How to Exercise Them

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to withdraw consent, and to data portability. You can exercise several of these directly in the app:

  • View and edit: you can view and update your display name, bio, and preferences in the app’s Settings.
  • Notifications: you can turn study reminders, streak warnings, and announcements on or off in Settings.
  • Delete your Account: you can request account deletion from Settings. You may also contact us to request deletion.
  • Other requests (including access to a copy of your data, correction of other data, portability, or objection): contact us using the details in Section 12, and we will respond as required by applicable law.

We will not discriminate against you for exercising your rights.

09Children’s Data

The Service is intended for users aged 13 and over, and registration by anyone under 13 is not permitted. We ask for date of birth during onboarding to enforce this.

Users between 13 and 17 (or the age of majority in their jurisdiction) should use the Service only with the consent and involvement of a parent or legal guardian. Because the Service may process data that can be sensitive for a minor — including date of birth, health-related and religious-observance streak reasons, and the fact of practicing Qur’an memorization — parental involvement is important.

If you believe a child under 13 has provided us personal data, contact us at [email protected] and we will delete it.

10Push Notifications and Your Choices

If you enable notifications, we send you study reminders, streak warnings, and occasional announcements. You can control these in the app’s Settings and in your device’s system settings. Announcements (marketing-style messages) can be turned off separately from functional reminders. Turning off notifications does not delete the push token already stored; it is removed when you sign out on the device or when the delivery service reports the token is no longer valid.

11Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and provide notice through the Service or by other reasonable means. Please review it periodically.

12Contact and Complaints

If you have questions or requests about this policy or your personal data, contact us at [email protected] or through the in-app support form. You also have the right to lodge a complaint with the competent personal-data-protection authority in Jordan or in your country of residence.