Privacy Policy — Shaikhy App

EDUBAB · Last updated 2026-11-07

Who we are

Shaikhy (the website shaikhy.com and the Android and iPhone apps) is provided by EDUBAB, Jerusalem (some of our pages also refer to us as Motqen Academy), which is responsible for your data in this service. Privacy contact: [email protected].

The service listens to your recitation and shows notes on reading and tajweed. Recitation analysis is available in the Shaikhy app for Android and iPhone; on the website you keep the mushaf, listening to reciters, your history and your account.

Your voice

• Microphone permission is requested when you start recording and is used only for recording.
• The app does not upload your voice recording or store it on our servers; it sends only what is needed to compute the result, over an encrypted connection. That data is processed in memory and only the result is kept in your history (see Learning history).
• A copy of the recording stays on your device inside the app so you can replay your words; it is erased when you move to another verse or close the app.
• Analysis of recordings on the website server is limited to Shaikhy team (admin) accounts, for operations and quality review: the recording stays in server memory for at most two minutes and the result for at most ten minutes, is never written to disk, and during analysis only may be handed to another of our servers inside our Hetzner project over an encrypted private network.
• We do not use your voice for training, do not sell it and do not share it with anyone.
• The only exception: a recording that a Shaikhy team admin saves from their own account, with an explicit click, to review the accuracy of the analysis (expert feedback) — their own voice, never a learner's. It stays on the server disk until the admin deletes it, a copy is kept on the site owner's computer, and two of them are kept as test cases in our private source-code repository.

Account data

• E-mail address: to sign in and to send codes and account notices.
• Your name, if you enter one (optional).
• Your password, if you choose one: we never store it, only a salted scrypt hash. When you choose it we send the first five characters of its hash (never the password or your e-mail) to Have I Been Pwned to check it has not appeared in known breaches.
• Your Google account ID, if you sign in with Google.
• Interface language, when you accepted the terms, and your opt-in to the weekly e-mail reminder.
• Your subscription status and period, and any minutes granted to you.

App device

An account works in the app on one device at a time, and the free trial is once per account and per device. The app therefore sends an identifier of its own on your device (it cannot be used to track you across other apps). We never store the identifier itself, only a one-way hash, together with the platform (Android or iPhone), app version, binding time and last seen time. The free-trial record stays after account deletion, tied to that device hash with no e-mail, name or IP address, so the trial cannot be repeated. A web browser is not counted as a device and does not send this identifier.

Learning history

For each analysis we keep: time, surah and verses, recording length in seconds, score, codes of the rules you missed, platform (Android, iPhone or website) and IP address, which is erased after 30 days. No text and no audio. You can delete one attempt or your whole history in the app, or delete the whole account.

Payments

• Subscriptions are bought through Google Play in the Android app installed from Google Play and through the App Store in the iPhone app, and through Paddle on the website (including the Android app downloaded from our website). Your card details stay with the payment provider and never reach us.
• On the website, Paddle.com is the Merchant of Record: in its checkout it collects what it needs for the sale, invoicing and tax (such as name, e-mail, country and payment method) as an independent controller under its privacy policy. We send it your account e-mail to prefill the checkout and a random token that links the subscription to your account; it does not send us your name, address or card details. PayPal and other methods that may appear in Paddle's checkout process your payment for Paddle; we do not connect to them directly.
• We keep what is needed to prove and renew the subscription: subscription ID, purchase token or transaction ID, Paddle customer ID, status, product or price, expiry or renewal date, amount and currency, and any refunded amount. We do not keep the payer's name or card details.
• Payment records (amount, date, order number; no name, no e-mail) are kept after account deletion for as long as tax and accounting law requires.

Logs and security

• Sign-in session: IP address (erased after 30 days) and browser or app type, until you sign out or the session expires after 90 days.
• Sign-in, confirmation, deletion and device-move codes: valid for 15 minutes, deleted one day after expiry.
• Rate-limit records against abuse (e-mail or address with a time): deleted after one day.
• Event log (sign-ins, registrations, e-mail failures…): deleted after 90 days; IP addresses erased from it after 30 days.
• Our own visit counter, with no cookie and no third-party tool: page, referrer, link campaign and IP address (erased after 30 days); deleted after 90 days.
• Server operation logs (errors and diagnostics, which may mention an e-mail address a message was sent to) are kept for a short period and then deleted.
• A daily database backup, transferred encrypted, kept for 35 days on our server with a copy at the site owner's, then deleted.
• All traffic is encrypted (HTTPS), and only the service can read the database.

Cookies and storage on your device

• One strictly necessary sign-in cookie: sid (HttpOnly, Secure, SameSite=Lax), kept for 90 days or until you sign out. No advertising or tracking cookies.
• Your settings (surah, reciter, language, theme) and a copy of your history are kept in the browser's or app's local storage on your device.
• The website keeps a copy of public mushaf data on your device so it loads faster.
• Google sets its own cookies only when you use the Sign in with Google button, and Paddle only when you open the checkout on the website.

Who processes data with us

• Hetzner (Helsinki, Finland, EU): server and database.
• Cloudflare: network delivery and protection; traffic passes through it encrypted and is decrypted at its edge.
• Brevo: e-mail delivery (codes and notices); it sees your address and the message.
• Paddle (Paddle.com, Merchant of Record for website orders): payment, subscription, invoicing, tax and refunds on the website, under its privacy policy. PayPal is a payment method that may appear inside Paddle's checkout, not a processor we connect to directly.
• Google Play and the Apple App Store: in-app payments and subscriptions, each under its own privacy policy.
• Google: Sign in with Google, if you choose it.
• Have I Been Pwned: five characters of the password hash when you choose a password.
• Hugging Face and the app stores: download of the app's large files (the analysis model); the source sees your device's address when downloading.
• Quran.com, quranicaudio.com, everyayah.com and islamic.network: reciter audio and word timings when we have no local copy; they see your device's address when you listen.
• Google Fonts: interface fonts for Urdu, Persian, Hindi, Bengali and Chinese only.
• GitHub: our private source-code repository; it holds no user data other than the two test recordings mentioned under Your voice.

No ads, no third-party analytics or tracking tools, and we never sell or rent your data.

App permissions

Microphone only, used only while recording. The Android app excludes its data from the phone's cloud backups.

Retention

Your rights

• Access and portability: download all your data as a JSON file from the account page on the website.
• Rectification: change your name in the account, or write to us.
• Erasure: see Deleting your account.
• Objection, restriction and withdrawing consent (the weekly reminder can be turned off in settings). You may also complain to the data-protection authority in your country.

Legal bases: performing the service you asked for (account, analysis, subscription); our legitimate interest in security and abuse prevention (logs, rate limits, backups, device binding); legal obligation (payment records); your consent (weekly reminder).

Deleting your account

Delete your account yourself at any time: from the account page in the app or on the website, or from the account deletion page without the app. We e-mail you a code, then you type your e-mail address to confirm.

• Deleted immediately: your e-mail, name, password, Google ID, sessions on every device, learning history, balance, device binding, events and codes.
• Kept without e-mail or name: payment records for accounting, the free-trial record with the device hash, and an internal number of the deleted account.
• If the account was banned for abuse we keep a one-way hash of its e-mail, so the ban stays if someone registers with it again.
• A website (Paddle) subscription is cancelled immediately. We cancel Google Play renewal when we are able to. An App Store subscription must be cancelled by you in your device settings, as deleting the account does not stop it; please check Google Play too.
• Your data disappears from backups within 35 days. If backups stop because of a fault, we keep the last copies until they resume, for restoring only; and after any restore from a backup we delete every deleted account again before the service restarts.
• Admin accounts and class seats cannot be deleted here: an admin's rights are removed first, and a class seat is deleted automatically, with its analyses, 30 days after its class ends.
• No access to your mailbox? Write to [email protected] and we will verify that the account is yours before deleting it.

Children

You may create your own account from age 13 (or the age of digital consent in your country, if higher). Younger learners use a parent's account or a seat in their teacher's class; class seats carry no e-mail address.

International transfers

Your data is stored in the European Union (Finland). Cloudflare, Brevo, the payment providers, Google and Apple may process the parts they handle in other countries under their approved contractual safeguards (such as Standard Contractual Clauses).

Changes and contact

We publish any change here with its date and tell you inside the service if it is material. See also the Terms of Use and the Refund Policy. Contact: [email protected] · shaikhy.com

Sources & credits

Muaalem model v3.2, quran-muaalem and quran-transcript by obadx (MIT); KFGQPC Hafs text and font (King Fahd Complex, via QUL); Tanzil text (CC BY 3.0); word timings and word audio from Quran.com; recitations from quranicaudio.com and everyayah.com; Cairo font (SIL OFL).