Privacy Policy
This Privacy Policy explains which personal data we process when you use the Noor website (www.noorscroll.com), the Noor web app and the Noor mobile apps for iOS and Android, why we do so, and which rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for data processing is:
Noor (noorscroll.com)
Email: [email protected]
You can contact us at this address with any questions about data protection.
2. Hosting and delivery of the website and app
The website and the web app are hosted by Vercel Inc. (USA). The website is additionally delivered through Cloudflare, Inc. (USA), which protects it against attacks and speeds up delivery. When you open a page, these providers technically process your IP address, the date and time, the page requested, your browser and operating system. This is necessary to deliver the website securely. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and reliable service). Logs are kept by these providers according to their own retention periods.
Our database and user accounts are hosted by Supabase in the EU (Ireland).
3. Accounts
Website sign-up
When you create an account on our website, we process your email address, your password (stored only in encrypted/hashed form) and the display name you choose. Accounts are managed with Supabase Auth.
App accounts
In the app you can sign in with email and password, with Google or with Apple. If you use Google or Apple sign-in, we receive from that provider the information needed to create your account (usually your name and email address; with Apple you may choose to hide your email address). Google and Apple process your data under their own privacy policies.
Legal basis: Art. 6(1)(b) GDPR (providing the account you requested).
4. Synchronisation, personalisation and app features
- Synced data: if you are signed in, your bookmarks, reading progress and preferences are stored in your account so they are available on all your devices.
- Feed interactions: in the discovery feed we record which content was shown to you and whether you viewed, completed, saved or shared it. We use this only to personalise your feed and avoid repetition.
- Content reports: if you report a piece of content, we store your report together with your user ID and email address so we can review it and contact you if necessary.
- Invite codes: if you use or share an invite code, we store the code and which accounts are linked through it.
Legal basis: Art. 6(1)(b) GDPR (providing the features you use). For feed personalisation and content reports also Art. 6(1)(f) GDPR (our legitimate interest in a relevant feed and in keeping content accurate); you can object at any time (see section 13).
5. Support form
When you contact us through the support form on our website, we process your name, email address, the selected category and your message. Before sending, the form checks whether an account exists for your email address. The message is stored in our database (Supabase, EU) and forwarded to our support mailbox by email through Resend, Inc. (USA). We use this data only to answer your request. Legal basis: Art. 6(1)(b) GDPR where your request relates to your account, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
If you leave the support form before sending, your draft is temporarily kept in your browser (session storage) so it is not lost; it is deleted when you close the tab or send the message.
6. AI assistant and smart search
If you use the AI assistant or smart search, the text of your question is sent through our server (Vercel) to AI providers that generate the answer: Groq, Inc. (USA), Mistral AI (France), OpenRouter, Inc. (USA) and NVIDIA Corporation (USA). We do not send your name, email address or user ID with the request, and Noor does not store your questions. The providers may process requests according to their own terms.
Please do not enter sensitive personal information (for example health information or details about other people) into the AI assistant.
Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).
7. Location (prayer times, qibla, nearby mosques)
Prayer times, the qibla direction and nearby mosques require your location. We only access your location when you use one of these features and only after you have granted permission on your device. Prayer times and the qibla direction are calculated on your device. To find your city or nearby mosques, your coordinates (or the city name you enter) are sent to OpenStreetMap services (Nominatim and Overpass servers, operated by the OpenStreetMap Foundation and other operators of public OpenStreetMap servers). Results may be cached on your device.
Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG for access to your device location). You can withdraw it at any time in your device settings; the location features will then no longer work.
8. Quran audio, content and other external resources
To play recitations and load certain content, the app retrieves files directly from external providers, for example everyayah.com, quranicaudio.com, mp3quran.net, alquran.cloud and Quran.com / Quran Foundation. These providers receive your IP address and technical request data when a file is loaded. Fonts are loaded from Google Fonts (Google LLC, USA), and parts of the website load scripts from the content delivery networks Tailwind CSS (cdn.tailwindcss.com) and jsDelivr (cdn.jsdelivr.net); these providers also receive your IP address. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in providing content and an appealing presentation).
9. Donations
We are not accepting donations at the moment. When donations become available, they will be processed by Stripe via a Stripe payment link. Stripe (Stripe Payments Europe, Ltd., Ireland) processes your payment data as an independent controller under its own privacy policy. Noor never sees or stores your card details.
10. Religious content (special categories of data)
Noor is an Islamic app. The way you use it (for example bookmarked verses or reading progress) may indicate your religious beliefs, which are a special category of personal data under Art. 9 GDPR. We process this data only to provide the features you choose to use. We do not use it for advertising or for profiling on behalf of third parties, and we do not share it with anyone other than the service providers listed in this Privacy Policy. You can delete this data at any time by deleting your account.
11. Recipients and transfers outside the EU
We use the service providers named above as processors or, where stated, as independent controllers. Some of them are located in the USA. Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not sell your personal data.
12. Retention
- Account data, synced data, feed interactions, content reports and invite links: until you delete your account.
- Support messages: [PLACEHOLDER: e.g. 12 months] after your request has been resolved.
- Technical logs: according to the retention periods of our hosting providers.
Statutory retention obligations remain unaffected.
13. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). To exercise your rights, email [email protected].
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place.
14. Account deletion
You can request the deletion of your account and the associated personal data at any time, from the app settings or via our account deletion page. We process deletion requests within 7 days.
15. Children
Noor's content is suitable for all ages. Creating an account, and the processing of personal data that comes with it, requires you to be at least 16 years old; younger users need the consent of a parent or legal guardian. Parents or guardians can contact [email protected] to have a child's account deleted.
16. Cookies and local storage
We only use storage that is strictly necessary to provide the service (for example your language setting and your login session). We do not use analytics, advertising or tracking cookies. Details are in our Cookie Policy.
17. Changes to this Privacy Policy
We may update this Privacy Policy if our services or legal requirements change. The current version is always available on this page.
18. Contact
If you have questions about this Privacy Policy, please contact: [email protected]