Darajat — Privacy Policy
Darajat is an app for memorising the Qur'an. It records how well you recall each ayah so it can decide what you should review and when. This page explains, in plain language, what we store, why, who else can see it, and how to get rid of it.
Darajat is operated by Davlat Sultonov ("we", "us"). You can reach us at davlatsultonov2001@gmail.com.
The short version. You can use Darajat without giving us a name, an email address or a password. What we hold is your memorization record. We do not sell it, do not advertise against it, do not use it to train machine-learning models, and do not show it to anyone else. Connecting your Quran.com account is optional and read-only — we never write to your Quran.com streak or activity.
Religious practice data — your separate, explicit consent
A record of which verses of the Qur'an you are memorising is information about your religious practice. Under the GDPR and comparable laws this is a special category of personal data, and it deserves to be treated as more sensitive than an ordinary app profile.
We therefore ask for your consent to process it separately from your acceptance of our Terms of Service, on its own screen, as its own decision. Agreeing to the Terms does not give this consent, and you will never be asked to grant it as a condition of reading the Terms.
That consent covers exactly this:
- which surahs and ayahs you are working on;
- your recall performance on each one — the grade, how many hints you revealed, how long you took, how many mistakes you made, and when;
- the scheduling state derived from that, which is what decides your next review.
You can withdraw this consent at any time in the app's settings. Withdrawing it stops further processing and deletes the data on the schedule set out under Deletion below. It does not make our earlier processing unlawful.
What we collect
Your account
On first launch, the app creates an anonymous account: a randomly generated identifier and a token stored on your device. No name, no email address, no password, no phone number. We also store your time zone, because a "day" has to start somewhere and getting it wrong would make your review schedule drift.
Your memorization record
Every time you practise, we store one record of that attempt: which item it was, the exercise type, the grade, and the raw signals the grade came from — hints revealed, response time, mistakes, whether you gave up. We keep the individual attempts rather than only the current score, so that the review scheduler can be improved later using real data about how people actually memorise. That improvement work uses aggregated review timings; it is not, and will not become, a machine-learning model trained on Qur'anic content.
If you connect your Quran.com account
This is optional. Darajat works fully without it. If you do connect it, we receive and store:
- your Quran Foundation account identifier (the OAuth
sub) — we link it to your existing Darajat account and never use your email address as an identifier; - your most recent reading position, so the app can open where you left off;
- your Quran.com streak and display name, shown to you as theirs;
- access and refresh tokens, encrypted, held only on our server.
We request read-only permissions. We do not request permission to write activity, and we will never request permission to modify your streak. You can disconnect at any time, in Darajat or from your Quran.com account settings; disconnecting deletes the tokens immediately and the rest of the linked data on the schedule below.
Technical logs
Our servers keep ordinary request logs — IP address, user agent, timestamp, endpoint — to keep the service running and to detect abuse. These are retained for 30 days and then deleted.
What we do not do
- We do not sell, rent or share your data with anyone for their own purposes.
- We do not serve advertising, and we do not build advertising or marketing profiles.
- We do not collect biometric identifiers, and we do not process recordings of your voice.
- We do not train machine-learning models on Qur'anic content or on your data.
- We do not use cross-site trackers or third-party advertising SDKs.
- We do not publish your progress, rank you against other people, or show your data to other users. There are no leaderboards in Darajat, deliberately.
Legal basis
| Data | Purpose | Basis |
|---|---|---|
| Account identifier, time zone | Run the service, get day boundaries right | Contract |
| Memorization record | Schedule your reviews | Explicit consent |
| Quran.com linked data | Continue from where you were reading | Explicit consent |
| Technical logs | Security, abuse prevention, reliability | Legitimate interests |
Who else processes your data
We use the following sub-processors. Each is bound by a data processing agreement and may use your data only to provide the service to us.
| Sub-processor | Purpose | Location |
|---|---|---|
| Quran Foundation | Qur'anic text, translations and recitations; Quran.com account sign-in if you connect it | See their privacy policy |
| HOSTKEY B.V. | Server hosting and database storage | Amsterdam, Netherlands |
We will update this list before adding a new sub-processor. If a change materially affects how your data is handled, we will tell you in the app first.
Security
- All traffic between the app and our servers uses TLS 1.2 or higher.
- Data at rest is encrypted with AES-256.
- Quran Foundation access and refresh tokens are encrypted a second time at the application layer, with a key held separately from the database. They are never sent to the browser.
- Access to production data is limited to those who need it and is logged.
If something goes wrong
If we become aware of a security incident affecting your data, we will notify affected users and the Quran Foundation within 24 hours, and tell you what happened, what was affected, and what we are doing about it.
Deletion and retention
- You can delete your account from within the app at any time.
- When you do, we hard delete your data from our live systems within 30 days — not a soft delete, not an anonymised leftover.
- Residual copies in encrypted backups are purged within 90 days.
- If you delete your Quran Foundation account, or revoke Darajat's access to it, we delete all data we obtained from that account on the same 30-day schedule, without you needing to ask us separately.
- Technical logs are deleted after 30 days regardless.
Your rights
Depending on where you live, you may have the right to access your data, to receive a portable copy of it, to correct it, to delete it, to restrict or object to processing, and to withdraw consent. Darajat supports export and deletion directly in the app. For anything else, write to davlatsultonov2001@gmail.com and we will respond within 30 days. You also have the right to complain to your local data protection authority.
Because your account is anonymous by default, we may be unable to identify you from an email alone. Requests made from within the app are the reliable route.
International transfers
Your data is stored on servers in Amsterdam, the Netherlands. Where data is transferred outside your country, we rely on Standard Contractual Clauses or an equivalent safeguard.
Children
Darajat is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided us with data, contact us and we will delete it. Where local law sets a higher age of consent for the processing described here, that age applies instead.
Changes to this policy
If we change this policy in a way that materially affects you, we will tell you in the app before the change takes effect, and — where the change concerns your religious practice data — ask for your consent again rather than assuming it.