Effective date: 2026-04-14
Last updated: 2026-04-14
We keep this policy short and direct. If you have questions, email privacy@hafizprime.com.
Who we are
HafizPrime (“we”, “our”, “us”) operates the HafizPrime mobile app and this website. For users in the EU, UK, and Brazil, our Data Protection Officer can be reached at dpo@hafizprime.com.
What we collect
When you use the app
- Account data: email, display name, chosen language, memorization goal, level.
- Progress data: which verses you’ve studied, retention scores, streaks, test results.
- Recitation audio (optional): captured only when you tap the recite button, analyzed on-device when possible, encrypted in transit when cloud analysis is required, automatically deleted from our servers after 30 days.
- Device data: OS version, app version, crash reports (Firebase Crashlytics, anonymized).
When you use this website
- Anonymous analytics: page views, referrers, approximate country. We use Plausible Analytics — no cookies, no fingerprinting, no cross-site tracking.
- Essential cookies: session, language preference, consent state.
What we do not collect
- We do not sell your data.
- We do not share your data with advertisers.
- We do not use your recitation audio to train our AI models.
- We do not use third-party ad trackers (Meta Pixel, Google Ads tag, TikTok Pixel, etc.) without your explicit opt-in.
How we use your data
- To run the app and personalize your memorization plan.
- To improve our AI coach and retention models (using aggregated, anonymized data only).
- To respond to your support requests.
- To send transactional emails (welcome, password reset). Marketing emails are opt-in.
Who we share it with
Only these processors, all under signed DPAs:
| Processor | Purpose | Location |
|---|---|---|
| Google Firebase | Auth, database, push | US / EU |
| Google Gemini API | AI Coach inference | US |
| Postmark / Resend | Transactional email | US / EU |
| Plausible Analytics | Website analytics | EU |
| Cloudflare | CDN / WAF | Global |
Your rights
- Access — download a copy of your data anytime from Settings → Privacy → Export.
- Deletion — delete your account and all associated data from Settings → Privacy → Delete.
- Correction — edit profile data anytime.
- Portability — export is in JSON, open format.
- Objection — you can disable AI features, analytics, and all non-essential data flows.
EU/UK: GDPR Articles 15–22 apply.
California: CCPA “Do Not Sell or Share” rights apply.
Saudi Arabia: PDPL rights apply.
Children
HafizPrime is suitable for children, but children under 13 (under 16 in some EU states) should have parental consent. Parents can request data deletion for their child at privacy@hafizprime.com.
Retention
- Account data: until you delete your account.
- Recitation audio: 30 days max on our servers.
- Analytics: 12 months in aggregated form.
International transfers
Data may move between the EU, US, and other regions. We rely on Standard Contractual Clauses and equivalent safeguards.
Security
- End-to-end TLS in transit.
- AES-256 at rest.
- Annual external pentest.
- Public bug bounty at security.txt.
Changes
We’ll notify you of material changes via email and in-app banner.
Contact
privacy@hafizprime.com · HafizPrime Data Protection · [Full postal address on request].
