Privacy policy
Last updated 3 November 2026
Qoreen is an app for building a daily Quran reading habit, on Android and iOS. This policy explains what personal data Qoreen (“we”, “us”) collects through the app and the qoreen.com website, why, where it is kept, who else handles it, and what you can do about it. It is written to meet Malaysia’s Personal Data Protection Act 2010 (PDPA).
The short version
- You can read the Quran in Qoreen without an account. If you do, we store no personal data about you on our server.
- Signing in is optional. It is only for reading circles and keeping your progress across devices. If you sign in, we keep your name, email address and the reading records those features need.
- We don’t use analytics, crash reporting, advertising IDs or location. We don’t show ads, and we don’t sell or rent your data.
- You can delete your account at any time in the app’s Settings, or by emailing us.
What we collect
If you read without an account
When the app first opens, it asks our server for a random install token. The token is not linked to you, your device’s identifiers or any account, and our server does not keep a list of tokens. The app sends it with each request so our server can tell real installs from abuse.
These stay on your phone and are never sent to us:
- your settings: theme, language, when to download the rest of a juz, and the tab and page you were last on
- the Quran text and mushaf fonts the app downloads, so you can read offline
- the days you rested in uzur mode (paused days), whether uzur mode is on, and the days you made up later (qada)
- a log of habit events, such as setting a goal or reading on a day, which the app keeps for itself and doesn’t send anywhere
Your daily goal and how much you have read today, in pages and minutes, are also kept on your phone. The app counts these itself, from the pages you have open in the reader.
Uninstalling the app removes all of these. If your phone backs up apps to your own Google or iCloud account, these files may be included in that backup. We can’t see it.
If you sign in
You can sign in with Google. Sign in with Apple will be offered later. When you sign in, we store:
- your name and email address, and whether the provider says the email is verified
- the provider’s name and the ID it uses for your account, so we can recognise you next time
- sign-in sessions, so you stay signed in. A session lasts 7 days and is extended while you use the app
When you use circles (group khatam reading) or progress across devices, we also store:
- reading sessions: when you started and stopped, how long, and which pages or verses
- your daily goal: pages, minutes or juz a day, and its start and end dates
- the days you read: the date and nothing else. Paused days and qada days stay on your phone and are never sent to us
- the circles you create or join, when you joined, and which juz you have taken and finished
Your sign-in session is kept in your phone’s secure storage. Uninstalling the app does not delete your account. See Deleting your account.
What we never store
- Your profile picture. It is removed before anything is saved.
- Google or Apple access tokens. We don’t call Google or Apple on your behalf after you sign in.
- Your IP address or device details (user agent) with your account or sessions.
- Phone numbers, contacts, location or advertising IDs.
- Paused or qada days, or why a day was paused. They stay on your phone, and there is no place anywhere to record a reason.
Paused days
A pattern of paused days could hint at things such as health or menstruation. So paused days never leave your phone: even if you sign in, our server learns only which days you read. There is no place to record a reason, and paused days are never shown to circle members or anyone else. Circle members see only juz progress.
If you join the waitlist
The qoreen.com homepage lets you leave your email address to hear when Qoreen launches. We store your email address, when you signed up, which version of the sign-up wording you agreed to, and that you signed up on the website. We don’t store your IP address or browser details with it. We use it only to send you launch news and updates by email.
If you email us
If you write to us, we keep your message and email address so we can reply, and for as long as we need them to deal with what you asked.
Why we use it and how long we keep it
| Data | Why | Where | How long |
|---|---|---|---|
| Settings, last page, install token, downloaded Quran text and fonts, paused and qada days, the habit event log | Make the app work, including offline | Your phone only | Until you uninstall the app |
| Name, email address, verified flag, provider and provider account ID | Identify your account. Your name is shown to members of circles you join | Our server | Until you delete your account |
| Sign-in sessions | Keep you signed in | Our server, and your phone’s secure storage | Until you sign out or delete your account. A session stops working after 7 days without use |
| Reading sessions, goals, the days you read | Show your progress and goals, and keep them across devices | Our server | Until you delete your account |
| Circle memberships and juz taken | Run group khatam reading | Our server | Until you leave or delete your account. A circle you created stays for its other members, without your name on it |
| Waitlist email, sign-up time, wording version | Send launch news and updates | Our server | Until you ask us to remove it |
| Emails you send us | Reply to you | Our email (Google Workspace) | As long as needed to deal with your request |
| Encrypted database backups | Recover from a failure | Cloudflare R2 (Asia-Pacific), and the most recent week on our server | 14 days, then deleted |
Reading in Qoreen never requires an account, so giving us your name and email is not obligatory. If you don’t, you can still read, but you can’t use circles or keep progress across devices. The waitlist needs an email address, and nothing else.
Google user data
If you choose to sign in with Google, we ask Google only for the openid, email and profile permissions.
What we access
Google gives us your name, email address, whether the email is verified, your Google account ID and a link to your profile picture.
How we use it
Only to create your Qoreen account, sign you in, and show your name to members of circles you join. We don’t use it for advertising, we don’t sell it, and we don’t use it to train AI models.
How we store it
Your name, email address, verified flag and Google account ID are stored in our database, on our server in France. The picture link is discarded before saving. Google’s access and refresh tokens are discarded too: we don’t call any Google API after sign-in. Deleting your account deletes all of this.
How we share it
Your name is shown to the other members of any circle you join. We don’t share Google user data with anyone else, except the service providers below that host our server and database, or where the law requires it.
Qoreen’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Where your data comes from
- From you, when you use the app, join the waitlist or email us.
- From Google (and later Apple) when you sign in with them: your name, email address and account ID.
Who else handles your data
We use a small number of service providers. They handle data only to provide their service to us.
- Contabo hosts our server and database, in France.
- Cloudflare sits in front of our server and website, protecting them from attacks, so all traffic to us passes through it, including your IP address. It also stores our encrypted backups (R2).
- Quran Foundation provides the Quran text and mushaf fonts. Your phone downloads them directly from Quran Foundation’s servers, so, like any web server, they see your phone’s IP address. The app sends them no personal data.
- Google handles sign-in when you choose Google. The sign-in page is Google’s, under Google’s privacy policy. Google Workspace also runs our email, so it holds any email you send us.
- Apple will handle sign-in when Sign in with Apple is offered, under Apple’s privacy policy.
Other users see only your name and juz progress, and only in circles you join. We may disclose data if the law requires it. We don’t sell, rent or trade your personal data, and we don’t share it with advertisers.
Transfer outside Malaysia
Our server is in France, so your personal data is transferred out of Malaysia and stored there. Our backups are in Cloudflare’s storage set to the Asia-Pacific region, which may be outside Malaysia. Cloudflare, Google and Quran Foundation run their services from many countries. France is in the European Union, whose data protection law (the GDPR) gives protection comparable to the PDPA. By signing in or joining the waitlist, you agree to this transfer.
Server logs
Our server’s request logs record the time, the page or address asked for, the result and how long it took. They don’t record IP addresses, tokens or email addresses. Your IP address is kept only in the server’s memory, to limit abuse. It is never written to disk, and it is cleared within two hours. Error logs shared by the server may record an IP address, or details of a failed request, and are kept for up to about 10 weeks.
How we protect it
- All traffic to our server is encrypted (HTTPS), and the server accepts connections only through Cloudflare.
- The database is reachable only from the server itself.
- Backups are encrypted before they leave the server, and the key to read them is kept off the server.
- We keep only the data listed above.
If there is a data breach
If a breach affects your personal data, we will contain it, find out what happened, and notify the Personal Data Protection Commissioner and the people affected, as the law requires. We will tell you what happened, what data was involved and what you can do.
Your choices and rights
Under the PDPA you can:
- Access your personal data: ask us what we hold about you and get a copy, including in a commonly used format so you can take it elsewhere.
- Correct it if it is wrong, incomplete or out of date.
- Withdraw consent by deleting your account or leaving the waitlist. We will then stop using that data and delete it.
- Stop updates: ask us at any time to stop sending you launch news and updates, and we will.
- Limit what we do with your data, or object to a use you think is wrong.
Email admin@qoreen.com from the address on your account or the waitlist. We may ask you to confirm it is you. We will reply within 21 days, and there is no charge.
Deleting your account
In the app, go to Settings, then Delete account. If your last sign-in was more than a day ago, the app will ask you to sign out and sign in again first, so that nobody else can delete your account from an old session.
You can also email admin@qoreen.com from your account’s email address and ask us to delete it. You don’t need the app installed.
Deleting your account removes your name, email address, provider link, sessions, reading sessions, goals, the days you read and circle memberships. Juz you had taken in a circle become free for others. A circle you created stays for its other members, without your name on it. Copies in our backups are gone within 14 days.
To leave the waitlist, email us and we will remove your address.
Children
Anyone can read in Qoreen without an account, and that collects no personal data. To sign in or join the waitlist you must be 13 or older, or older if your country or your sign-in provider requires it. If you are under 18, please ask a parent or guardian before signing in. If you believe a child under 13 has given us personal data, email us and we will delete it.
Our website
qoreen.com doesn’t use analytics or advertising scripts, and doesn’t set cookies for tracking. Cloudflare may set a strictly necessary cookie to protect the site from abuse.
Changes to this policy
If we change this policy, we will update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app or by email before it takes effect.
Contact
For any question or request about your personal data, email admin@qoreen.com.