Privacy Policy

Effective 7 October 2026

QuranAI (the website and the Android and iOS apps) is operated by CiteDash Inc (“we”, “us”). This policy explains what we collect, why, who processes it for us, and the choices you have. We do not sell your personal data and we do not show ads.

1. Using QuranAI without an account

You can use QuranAI without signing up. Your khutbahs, notes, highlights, saved studies, chats, plans and settings are then stored only on your device (in your browser's storage or the app's files) and are lost if you clear them or uninstall the app.

To run the free daily AI allowance for guests, we give each browser or app install a random device identifier and count requests per device and per network (IP) address. We store only one-way scrambled (hashed) versions of these, never the raw identifier or IP address, and the counts are deleted after about two days.

2. If you create an account

Account details: your email address and a password (stored only in hashed form by our authentication provider), or, if you use “Continue with Google”, the name, email address and profile picture Google shares with us.
Your content, synced: your khutbahs, notes and highlights, saved studies, chat history, reading plans and progress, memorization cards, study notes, settings and last reading position, so they are available on all your devices.
Subscription status, if you subscribe (see section 5).

3. AI features

When you use an AI feature, what you entered (for example the ayah reference or question, recent messages in that chat, and your chosen school of thought and language) is sent to Google Cloud Vertex AI (Gemini models) to generate the answer. Google processes it under its Google Cloud terms, which do not allow Google to use it to train its models. Requests may be processed in Google data centres outside your country. Please don't enter sensitive personal information you wouldn't want processed this way.

For each AI request we log the tool used, the model, the number of tokens, and (if you are signed in) your account ID, to monitor costs and prevent abuse. We do not keep a separate server-side copy of your questions beyond the content you choose to save or sync.

4. Audio

Listen (website): the text you choose to hear is sent to ElevenLabs to produce the audio. This requires a free account.
Listen (Android and iOS apps): uses your phone's built-in voice; the text stays on your device.
Recitation: ayah recitations stream from everyayah.com, which receives your device's IP address like any website you load.

5. Subscriptions and payments

If you subscribe, payment is handled by Stripe (website), Google Play (Android) or the Apple App Store (iOS). We never see or store your card details. We receive and store your subscription status (plan, trial and renewal dates) and the payment provider's transaction records, which we keep as long as tax and accounting law requires.

6. Who processes data for us

Google Cloud: hosting (Belgium, EU) and AI models (Vertex AI).
Supabase: accounts and the database for synced content (Ireland, EU).
ElevenLabs: website text-to-speech.
Google: “Continue with Google” sign-in, if you use it.
Stripe, Google Play, Apple: payments, if you subscribe.

7. How long we keep data

Account and synced content: until you delete it or delete your account.
Guest allowance counts: about two days.
AI usage logs: kept for cost reporting; deleting your account removes the link to you.
Payment records: as long as the law requires.

8. Your choices and rights

Delete individual items at any time; deletions sync to your other devices.
Delete your account and all synced data yourself: on the website under Account, or in the app under Settings → Account. See how account deletion works.
To ask for a copy of your data, a correction, or anything else about your privacy, email powellorenz@gmail.com. We reply within 30 days.

9. Children

QuranAI is not directed at children under 13, and we don't knowingly create accounts for them. If you believe a child has created an account, contact us and we will delete it.

10. Security

Data is encrypted in transit (HTTPS), access to synced content is restricted so each account can only read its own rows, and server secrets are kept in a managed secret store.

11. Changes

We'll update this page when our practices change and revise the effective date above.

12. Contact

CiteDash Inc — powellorenz@gmail.com