Privacy policy.

This document describes what Tanzeel collects from you, what we do with it, and what you can ask us to delete. We've tried to write it in plain language. If anything is unclear, email support@tanzeelalquran.com and we'll explain it like a person would.

The short version: we collect the minimum we need to make the app work. We do not sell your data. We do not run ads. The only third parties that ever see anything are the infrastructure providers we need to run the service (listed in §6) and the specific Tajweed teacher you choose to submit a recording to.

1. Who we are

Tanzeel is operated by MARIZ LLC, a company registered in the United States. Where this policy refers to "we," "us," or "Tanzeel," it means MARIZ LLC.

For privacy-related correspondence: support@tanzeelalquran.com.

2. What we collect

2.1 Account information

When you create an account, we collect your email address and name (display name; this can be a nickname). Passwords are stored hashed using bcrypt — we never see the plaintext, and neither does anyone else.

If you sign in with Apple, we receive only the identifier Apple gives us. If you choose to relay your email through Apple's private relay service, we never see your real email.

2.2 Content you create

The app stores content you produce while using it. This includes:

• Bookmarks and notes attached to specific verses
• Memorisation progress — which ayahs you've added, your strength tier per ayah, your review history, your current streak
• Audio recordings you submit for expert review
• Messages you send to or receive from a teacher
• Reading goals and settings — display mode, theme, accessibility preferences, daily goal

2.3 Device & technical data

• Device push token (APNs) — if you opt in to push notifications
• App version and OS version, used for compatibility and crash diagnostics
• Sync timestamps, so the same data on different devices doesn't fight itself

We do not collect IDFA, advertising identifiers, contact lists or your location history. Photos or video that you choose to submit for your profile or tutoring are processed for those features.

2.4 Location (only with your permission)

Prayer times and Qibla direction are calculated locally from your device location. We request location permission only for those features. The location is sent to the Aladhan API to compute prayer times for your coordinates; we don't store your coordinates on our servers, and Aladhan's API is read-only.

2.5 Usage data

We log basic, aggregated usage on the server side (which API endpoints are called, how many requests come from which app version, error counts). These logs do not contain the content of your recitations, messages, or notes.

2.6 What we do not collect

• No advertising or tracking SDKs (no Facebook SDK, no Mixpanel, no Segment, no Google Analytics)
• No microphone access except when you explicitly start a recording
• Camera and microphone access is optional and requested when you choose to record tutoring audio or video
• No access to your address book or device contacts; you choose any photo or file you upload
• No financial data — payments are handled by Apple's App Store directly

3. How we use your data

We use what we collect to:

• Run the service — sign you in, sync your data between your devices, deliver the audio and translations you've requested
• Operate expert tutoring — route a recording you submit to the specific teacher you chose, deliver their feedback back to you, and enable messaging between you
• Send notifications you've opted into — when feedback is ready, when a teacher replies, prayer time reminders if you turn them on
• Improve the app — diagnose crashes, fix bugs, identify slow API endpoints. We never read the contents of your recordings or notes for this
• Provide support — when you email us, we read what you sent us and reply
• Comply with the law — if a valid legal request requires it, we may have to disclose specific data; we will resist overbroad requests

4. When we share data

4.1 With teachers, only what you submit

Your assigned teacher sees the recordings and notes you submit, your learning profiles, shared memorization progress, assessments and Academy plans, corrections, practice entries, quizzes and revision. Device practice notes are shared with your teacher only when you enable Academy practice sync. Private reading bookmarks and reading notes remain separate. Child learning requires approved parental permission; see the parental privacy notice.

4.2 With infrastructure providers

To run the app we use a small number of vendors. They process data only on our instructions and only for the purpose listed:

• Amazon Web Services (S3) — encrypted storage of audio recordings
• DigitalOcean — application servers and MySQL database hosting
• Apple Push Notification service — delivering push notifications you've opted in to
• Resend — sending account emails (welcome, password reset)

4.3 We do not sell your data

We have never sold user data, and we don't plan to. There are no advertising-driven business models that could change this; tutoring revenue funds the rest of the app.

4.4 In a corporate transaction

If MARIZ LLC is acquired or merged, your data may transfer to the acquiring entity, which will be bound by this policy or one materially similar. We'll notify you in-app and by email before any such transfer takes effect.

5. How long we keep it

• Tutoring account records: retained while your account exists. Account deletion removes the active account and associated tutoring records and queues uploaded media for removal. You can delete individual recordings and family learning profiles sooner.
• Child learning and consent files: follow the specific time limits and renewal controls in the parental privacy notice.
• Media deletion: processed by a durable retry queue, including a second sweep after outstanding upload links expire. Storage outages can delay completion.
• Reading data: reading notes and bookmarks saved on your device or in your own iCloud account are managed separately from your tutoring account.
• Operational copies: restricted backups and security logs may contain earlier account records. They are not used to deliver tutoring after account deletion. Contact support about a deletion request that needs review of these copies.

6. Third-party services

The app talks to a small number of external services to deliver specific features. Each is listed below with what data is sent and why:

• Aladhan API — receives your latitude/longitude when you use prayer times or the Qibla compass. Returns the calculated times and direction.
• Quran.com API — receives a request for a specific surah and translation; returns the translation text. No personal data is sent.
• AWS S3 — encrypted storage of audio recordings you submit; access is restricted to your account and the teacher you choose.
• Apple App Store / In-App Purchase — when you purchase a tutoring subscription, payment is handled entirely by Apple. We never see your card details.
• Apple Push Notification service — receives a push payload (e.g. "your feedback is ready") and your device token; delivers to your device.
• Google Fonts (this website only) — when your browser loads this page, Google may log the request as part of standard CDN operations. The app itself does not use Google Fonts.

7. Security

We protect data with industry-standard measures, and try to live up to the spirit of them:

• All traffic between the app and our servers is encrypted using TLS 1.2 or higher.
• Audio recordings are stored encrypted at rest in AWS S3 with server-side encryption.
• Passwords are hashed using bcrypt; we never log them and never store them in plaintext.
• Authentication tokens are stored on your device using Apple's Keychain (a hardware-backed secure enclave on supported devices).
• API access requires a valid JWT; access tokens are short-lived (15 minutes) and are rotated using refresh tokens.
• Database access is restricted by IP allowlist and role-based credentials.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you within 72 hours of confirmed discovery, by email and in-app.

8. Your rights

You have the following rights regardless of where you live:

• Access — request a copy of the data we hold about you in a portable JSON format
• Correction — fix anything that's wrong (most account fields are editable in-app under Settings → Account)
• Deletion — delete your account from inside the app (Settings → Account → Delete account), or by emailing us
• Export — receive your bookmarks, notes, and memorisation progress in JSON form
• Opt out of push notifications — at any time, in iOS Settings or in the app under Settings → Notifications
• Withdraw consent for location use by revoking permission in iOS Settings

If you're in the EU/UK, you have additional rights under the GDPR (object to processing, restrict processing, lodge a complaint with your local supervisory authority). To exercise any right, email support@tanzeelalquran.com. We respond within 30 days.

If you're in California, the CCPA gives you similar rights to access, delete, and know which categories of personal information we collect. The same email address handles those requests.

9. Children's privacy

Child tutoring profiles are managed by an adult parent or legal guardian. Before collecting a child’s recordings or learning data, we require a signed parental consent form and admin review. Children have no separate account or inbox. Optional group sessions require separate permission and parent attendance. Parents can review child records, withdraw permission or delete child profiles in Family learning, including after a subscription expires.

Read the full parental privacy notice for the information collected, recipients, consent method, retention and operator contacts. Contact support if child information was submitted without permission so we can review and remove it.

10. International data transfers

Our servers are located in the United States. If you use the app from outside the US, your data is transferred to and processed in the US. We use vendors (AWS, DigitalOcean, Apple) that support standard contractual clauses for cross-border transfers where required.

11. Changes to this policy

We may update this policy as the app evolves. If we make a material change — meaning anything that affects what we collect or how we use it — we'll notify you in-app and by email at least 14 days before it takes effect. Cosmetic changes (typos, restructuring) take effect immediately and we will note the change at the top of the page.

12. Contact

For any privacy question, request, or concern:

• Email: support@tanzeelalquran.com
• Subject line "Privacy" routes to the right inbox
• For EU/UK residents wishing to escalate, you may also contact your national data protection authority

We aim to respond to every message within two business days. If we can't, we will tell you so and give you a date.

— The Tanzeel team, MARIZ LLC