سياسة الخصوصية

Who we are and who the app is for

Evally is an app for memorising and revising the Quran with the Sullam Al-Abrar method. There is no open sign-up from inside the app.

Many of the people using the app are children. We collect what following memorisation needs and nothing for advertising. We show no ads and sell no data.

What we collect

• Account details: name, group, email address, and a password (stored hashed; nobody can read it). A profile picture and a phone number may be added.
• Memorisation records: pages and surahs recited, repetitions, marks and notes, daily programmes and goals — entered by the student or their teacher.
• Voice recordings: the recitation features record the reader’s voice and send it to our servers, where it is checked and followed automatically.
• Passkeys: if you enable them we store the public key and a device name only. Your fingerprint or face never leaves your device.
• Notification data: the device token needed to deliver push notifications, and a Telegram chat identifier if you link one.
• Security log: at sign-in and for sensitive actions we keep the IP address, the browser or device type, and the time.
• Usage data: which screens are opened and which buttons are pressed, and error messages, linked to the user’s name and group.
• Session recording in the app: the layout of the screen and how it is navigated may be recorded to diagnose problems. All text and images are masked, so a recording shows no name, mark or page.

What we do not collect

• No location, no contacts, no photos from the device.
• No advertising identifiers and no ads.
• We do not sell data or share it for marketing.

How long voice recordings are kept

• Checkpoint recordings are deleted after 14 days.
• Other recitation recordings are deleted after 90 days.

Who can see your data

• Your teachers and the app’s administrators see your records and marks, and can listen to your recordings while they are kept.
• Other users in your group see your name and progress in lists, leaderboards and the activity feed.
• Your phone number is shown only to you and to the teacher currently handling your checkpoint.

Services that process data for us

• Google Firebase Cloud Messaging, to deliver push notifications.
• PostHog (servers in the United States), for usage data, error reports and the masked session recordings.
• Telegram and WhatsApp, to deliver alerts — only if you link your account.

Deleting your account and data

You can close your account at /settings/delete-account on our website, after signing in. After that it can no longer sign in and your name leaves the lists.

Closing an account does not erase the memorisation records: they stay with us, and an administrator can reopen the account. To have your data erased permanently, ask through the contact below.

Children

A parent or guardian may ask us to see, correct or delete their child’s data.

Security

Data travels between the app and our servers over an encrypted connection (HTTPS), and passwords are stored hashed. No system is perfectly secure; if a breach affects your data we will tell you.

Changes to this policy

If what we collect or how we use it changes, this page and its date will be updated.

Contact

For any question or request about your data, contact us through the support channels in the app.