Privacy policy

Who this covers

QuranDeck is a personal mushaf for The Noble Quran. This policy describes what QuranDeck does with information when you read as a guest or sign in.

Questions about your library can go to the operator through the QuranDeck repository.

Reading without an account

You can open the mushaf without signing in. Preferences, your place in the Quran, favorites, notes, highlights, and reading time then stay in this browser. That guest library is not copied to the QuranDeck database.

Clearing this site’s saved data in the browser removes that guest library from the device.

Signing in

You can read, bookmark, and keep notes without an account. Those stay in this browser until you sign in. An account can use Google, Sign in with Apple, a passkey you add after the first sign-in, or your email. Email sign-in sends a 6-digit code to that address. The code expires in about 10 minutes, works once, and is not shown in the sign-in window. If a message cannot be sent, sign-in stops and does not display the code. A passkey stays on your devices. QuranDeck stores the public key and an encrypted copy of the email so the passkey can open the same library. GitHub is not offered for sign-in.

If Google or Sign in with Apple is offered and you choose it, that service handles the login under its own policy and shares your name and verified email with QuranDeck. The email remains the account key. Your display name is separate: it is the name shown in the app, it does not have to be unique, and names with offensive language are refused.

QuranDeck does not use your email for a newsletter or for advertising.

The library we sync

After you sign in, QuranDeck can save a library for that email: reading preferences, favorites, notes, highlights, color swatches, progress (including how often an ayah was returned to), display name, and profile photo or icon. The same library is merged back onto a device when you sign in there.

In the database, the row is not labeled with your email address. The account key is a one-way hash of the email. The library itself is encrypted before it is stored. Someone looking at the table sees the hash and ciphertext, not your email or your progress as readable text.

QuranDeck holds the key that unlocks a library so it can sync back to you while you are signed in. This is storage for the service, not a claim that the operator is unable to open a library. We do not sell your reading, notes, or progress.

Platform reading ranks

When a signed-in library syncs, QuranDeck can add anonymous visit counts for the ayahs that increased since the last sync for that account. Those counts go into a separate table of surah and ayah totals for the product. That table stores only an ayah key and a number. It does not store your email, account hash, display name, notes, or photo.

Guest reading does not feed those totals. Any shared list is a count of openings on QuranDeck. It is not a spiritual score, a hasanat counter, or a leaderboard, and it is not sold.

Cookies

A sign-in cookie keeps the session on that browser. Signing out clears it. If an invite-only beta is turned on, a separate cookie can remember that this browser was invited, for about 90 days.

QuranDeck does not set advertising cookies and does not run an ads or analytics tracker.

Quran text, tafsir, and audio

Arabic text, translations, tafsir, search, and recitation are fetched for you from Quran Foundation when server credentials are configured, and otherwise from the public Quran.com API, with some search lines from AlQuran Cloud. Quran data provided by Quran.Foundation. Those requests ask for the surah, ayah, translation, or reciter you opened. They do not include your notes, favorites, or email. Responses are cached for at most a few days.

Those providers handle the request under their own policies.

Hosting

The site runs on Vercel. The sealed library and the anonymous reading-rank counters are stored in Neon Postgres. Those hosts keep ordinary connection logs, such as IP address and time, to operate and protect the service. QuranDeck does not use those logs to build an advertising profile.

How long it stays

Guest data stays in the browser until you clear it. A signed-in library stays until you delete the account from the account panel or ask for it to be removed. Delete my account removes that email’s sealed library, passkeys, and unused sign-in codes. Sign-in codes expire after about 10 minutes and work only once. Anonymous platform rank totals are not tied to your row, so deleting an account does not unwind counts already added to those totals. Notes that never left this browser stay here until you clear site data.

Children

QuranDeck is a reading app for anyone. It does not ask for a date of birth and it is not built to collect accounts from children under 13. A parent or guardian can ask us to delete a library tied to a child’s email.

Changes

If this policy changes, the date at the top of this page will change with it. Continued use of QuranDeck after that date means the updated policy applies.