1. Information we collect
Account information: email address, display name, authentication provider, internal user identifier and the security information needed to maintain your session. Passwords are handled by Supabase Auth and are not visible to A Suhba Saliha.
Reading information: personal goals, Quran pages marked as read, reading position, completion dates, streak-related calendar data and progress within shared challenges.
Group information: reading-group membership and role, invitations, challenge proposals, responses, rankings and notifications generated by group activity.
Preferences and technical information: language, time zone, reminder settings, essential cookies, IP address and basic request or error logs generated by our infrastructure providers.
2. How we use information
We use this information to create and secure your account, preserve your reading progress, operate personal and shared goals, send requested account emails and reminders, show relevant notifications, prevent abuse and diagnose technical problems.
We do not sell personal information, use it for advertising, or make decisions that produce legal or similarly significant effects through automated profiling.
3. Google sign-in
If you choose Continue with Google, Google provides basic identity information needed to sign you in, such as your email address, name and Google account identifier. A Suhba Saliha does not request access to Gmail, Google Drive, contacts or calendars.
Google processes the sign-in interaction under its own privacy terms. You can revoke A Suhba Saliha access from your Google Account permissions.
4. Service providers
Supabase provides authentication, the PostgreSQL database and access controls. Vercel hosts the web application and may process delivery and technical logs. Google provides optional sign-in. The configured transactional-email provider delivers confirmation and password-recovery messages. Quran Foundation supplies Quran text requested by the application; we do not intentionally send it your account profile.
These providers may process information in different countries under their own contractual and legal safeguards. We only use them to operate the service described here.
5. Legal grounds and sharing
Processing is necessary to provide the service you request and manage your account. Security, reliability and abuse prevention are pursued as legitimate operational interests. Optional choices, such as Google sign-in and reminders, are initiated or controlled by you.
Information is shared with other members only where the feature requires it: for example, your display name, participation and challenge progress within a reading group. We may disclose information when required by law or to protect users and the service.
6. Cookies and analytics
A Suhba Saliha uses essential cookies for authentication, security and language preference. The current beta does not use advertising cookies or third-party marketing analytics.
7. Retention and deletion
Account and reading information is retained while your account remains active and for as long as needed to provide shared-history features, meet legal obligations, resolve disputes and protect the service. Limited logs or backup copies may remain for a restricted period after deletion.
During the beta, ask the person who invited you if you want your account and associated personal data deleted. Some shared challenge records may need to remain in a limited or de-identified form so that other participants retain an accurate history.
8. Your choices and rights
You may request access, correction, deletion, restriction or a portable copy of your personal information, and you may object where applicable. You can change your display name, reminder preferences and password from your profile, leave groups where the feature permits it, or sign out at any time.
People in the European Economic Area may also complain to their national data-protection authority. Requests may require identity verification before information is released or changed.
9. Security
We use encrypted HTTPS connections, authenticated sessions, database row-level access policies and restricted server credentials. No internet service can guarantee absolute security, so beta participants should use a unique password and report suspicious activity promptly.
10. Children and changes
The private beta is intended for invited participants. A child should use the service only with the knowledge and permission of a parent or guardian where required by applicable law.
We may update this notice when the service, providers or legal requirements change. The date above will be revised, and material changes will be communicated appropriately.