Privacy Policy

1. Who is responsible for your data?

The data controller is the party identified in the controller card at the top of this page. For privacy questions or rights requests, contact support@muraja3a.com.

2. Data we process

• Account data: email address, account identifier, and account creation and update dates.
• Review data you provide: page numbers, review dates, recitation results, selected words, schedule settings, reading tasks, and quizzes.
• Notification data when enabled: time, language, delivery channel, and delivery status.
• Support and privacy correspondence when you contact us: sender and recipient email addresses, subject, message content, attachments, and technical delivery metadata.
• Technical data needed to operate and protect the service, including limited error logs and browser data handled by infrastructure providers. We do not use session replay or click heatmaps.

3. Why we process data

• To create your account and provide the schedules, reviews, and quizzes you request: performance of the service.
• To save preferences, synchronize devices, and protect accounts: performance of the service and our legitimate interest in operating it securely.
• To send email or push reminders: your consent, which you may withdraw in settings.
• To answer support inquiries and privacy requests, verify requests, and prevent abuse of the support channel: performance of the service, compliance with legal obligations, and our legitimate interest in operating a secure support channel.
• To prevent abuse, investigate failures, and improve reliability using aggregate measures: our legitimate interests, with data minimization.
• To process service data for a user under 16: after the dedicated guardian-consent flow is completed.

4. Service providers

We use processors to provide the service: Supabase for database hosting and authentication, and Vercel for web hosting. Where the related features are enabled, we may use Resend to send, receive, and forward email, Google (Gmail) to host the dedicated support mailbox, and Cloudflare Turnstile to prevent automated sign-ups. We do not sell data or share it for advertising.

5. International transfers

Providers may process data outside your country. We use available regional settings and contractual safeguards, including recognized transfer mechanisms where European data-protection law applies.

6. Retention

• Account and review data: until account deletion, unless limited retention is legally required.
• Notification delivery logs: up to 90 days.
• Support correspondence: Resend retains received email data for up to 30 days. We retain the copy in the dedicated support mailbox until the request is closed and necessary follow-up is complete, then delete it no later than 12 months after the last correspondence, unless a longer period is required by law or necessary to establish, exercise, or defend legal claims.
• Error summaries that do not contain user content: up to 30 days.
• Web performance measures: up to 90 days; aggregate daily counters: up to 13 months.
• A new account awaiting guardian consent and containing no usage data may be deleted after 14 days.

7. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent. You may also complain to the data-protection authority in your country. Withdrawing consent does not affect earlier lawful processing.

8. Children and guardian consent

We ask for an age band and do not collect a date of birth. A user who selects “under 16” must obtain guardian consent before accessing app features. The guardian receives a time-limited link explaining the data and purpose and may accept or reject the request.

9. Security

We use account-based access controls, HTTPS, backups, and monitoring appropriate to the service. No internet service can guarantee absolute security. Contact us promptly if you suspect a problem with your account.

10. Changes to this policy

We may update this policy when the service or legal requirements change. We will update the date and provide a clear notice when a change is material.