Home

Privacy Policy

Last updated: October 22, 2026

This page explains what information the Mi'Raj app (for iOS and Android) and this website use, where it is kept, and who it is shared with. "We" means the Mi'Raj team (Mohammadreza Khalili Shoja and Seyed Vahid Mirnezami, who make Mi'Raj). If you have any questions, write to seyedvahid.mirnezami@themiraj.ai or mohammadreza.khalilishoja@themiraj.ai.

1. Using the app without an account (guest mode)

As a guest, your bookmarks, notes, goals, progress and settings are stored only on this phone and are not sent to any server. If you delete the app, they are deleted too; to keep them, make a backup file from "Backup" in your profile.

Some downloadable content (such as reciters' audio or books) is encrypted. To get the keys for it, the app creates a hidden anonymous ID on our sign-in service. This ID has no name or email. To apply the daily download limit for guests, we record which items this ID has unlocked and when.

"Ask" and syncing between devices are not available in guest mode.

2. Your account

You can sign in with an email and password or with your Google account. Sign-in and accounts are run for us by Supabase.

• Email and password: we keep your email address; your password is stored one-way encrypted (hashed), never as plain text. Account emails, such as email confirmation or a password reset, are sent to you through this service.
• Google sign-in: Google shares your email address and usually your Google account's name and profile picture with our sign-in service. We never see your Google password.
• Sign in with Apple (iPhone): Apple shares your email address — or, if you choose «Hide My Email», a private relay address from Apple — and, the first time only, the name you allow. We never see your Apple ID password.
• Name and photo on the "Personal Information" screen: the name you type there is saved on your account (our sign-in service), so it follows you to another phone. The photo you pick from your library stays on that phone only; it is not uploaded.
• Face ID / fingerprint sign-in: this is handled by your phone's operating system; we receive no biometric data.

3. What is synced with your account

When you are signed in, the following is stored in our cloud database (Supabase) and linked to your account, so it is available on your other devices and survives reinstalling the app:

• App settings: theme, language and calendar, prayer-time calculation method and adhan/reminder settings, Quran reader and reciter settings, the page you are on, and the Qibla compass's last position, rounded to about 10 km (roughly your city) — the exact position stays on your phone;
• Bookmarks and their notes, favourite duas and Home shortcuts;
• Reading, recitation and memorization goals and their progress, your hifz plan (passages memorized and when to review them) and the days you were active;
• Reading tracker logs (date, pages read and time spent);
• Summaries of recitation practice sessions: when and how long, which ayahs, and how many words were right, wrong or skipped — never any audio;
• Your conversations in "Ask" (questions and answers);
• "Ask" usage records: for each question, the model that answered, the number of tokens, the cost, the time and the chat session ID — never the question or answer text (section 7).

4. Microphone and your voice

Mi'Raj uses the microphone only when you start one of these yourself: recitation or hifz practice, or following a dua's text as you read it.

• Speech recognition uses models downloaded to your phone and runs on your phone. Your voice is processed only on your phone and is never sent to any server — ours or anyone else's.
• The audio of each recitation practice session (up to about ten minutes) is saved as a file on this phone so you can listen back. These files are not uploaded or synced.
• An audio file leaves your phone only if you choose to share it, by the way you pick (for example a messaging app or email).
• You can delete sessions in the app. Deleting your account or deleting the app also deletes all of these files.

5. Location

Location access is optional and used only while you use the app, never in the background. The app works without it.

• Prayer times and the Qibla direction are calculated on your phone; your coordinates are not sent to our servers for this.
• To show your city's name, the app uses your phone's built-in geocoding service (Apple on iOS, Google on Android), which receives the coordinates. The Qibla map is loaded from Apple Maps (iOS) or Google Maps (Android).
• The last location is kept on your phone so it doesn't have to be found again every time. If you are signed in, only a rounded position, accurate to about 10 km (roughly your city), is synced as part of your settings (section 3); the exact position never leaves your phone.
• "Discover Islamic Resources" on the Home screen (centers, apps and resources, including sponsored ones) picks what fits your area on your phone: from your phone's location if you have already allowed it, otherwise from the country our content host (Cloudflare) sees for your IP address, or from your phone's region setting. It never asks for location itself and never sends your location to anyone.

6. Notifications

Adhan, prayer reminders, goal and dua reminders and the Ramadan programme's notifications are all local notifications scheduled by your phone. We don't collect your device's push token and don't send you notifications from a server.

7. "Ask" (AI questions and answers)

"Ask" requires an account. When you send a question:

• The question, part of the earlier conversation (to understand follow-up questions), the options you chose (such as topic or tafsir) and your sign-in token (which identifies your account) are sent to our question-answering server, which runs on Google Cloud (Cloud Run, in the United States).
• The server searches Islamic sources (such as tafsirs) and, to write the answer, sends your question and the passages it found to DeepInfra, which writes the answer with the DeepSeek-V4.1-Flash model. DeepInfra serves this model with zero data retention: it does not keep the questions or answers after responding.
• Our server keeps a copy of the conversation for at most 30 days, so it can understand your next questions in context, and then deletes it automatically. The server's technical logs, which include the beginning of each question, are kept for 30 days for troubleshooting and improving quality.
• To apply the daily and weekly message limits, we record the time of each message together with your account ID (not its text).
• For each question, a usage record is stored with your account in Supabase: the model that answered, the number of tokens, the cost, the time and the chat session ID — never the question or the answer. You can see your own usage in the app; the Mi'Raj team can see all usage records, to manage costs and limits.
• Conversations are also saved in your account so you can see them on your other devices (section 3).

Please don't include sensitive personal information (such as health, financial or identity details) in your questions.

8. Downloaded content

Recitations, mushaf fonts, translations and tafsirs, dua audio and speech-recognition models are downloaded from our storage on Cloudflare and from some other public sources (such as font and Quran-data delivery services). Like any internet request, these services see your IP address and technical request details, but no account information is sent to them. Keys for encrypted files come from our key service (on Supabase) after it checks your sign-in or guest ID.

9. Advertising and statistics

• The app contains no third-party advertising or analytics SDK.
• Crash reports: if the app crashes or hits an error, a technical report goes to Sentry (servers in the EU, Germany) so we can find and fix it: where in the code it failed, the phone model, operating system and app version, and the last few steps before it (such as which screen opened). It contains no name, email, account ID, IP address, screenshot or content of yours (notes, questions, voice), and is kept for at most 90 days.
• "Discover Islamic Resources" may show items labelled "Sponsored". Which items you see is decided on your phone.
• To tell a sponsor how their card did, the app may send anonymous counts of card views and taps: the card's ID, the time, country, app language, operating system and app version — no account or device ID, and no precise location.

10. Who we share information with

Only with service providers the app needs in order to work, and only as much as that job needs:

• Supabase — sign-in and accounts, the sync database, the download key service;
• Google Cloud — hosts the question-answering server (in the United States);
• DeepInfra — writes the answers with the DeepSeek-V4.1-Flash model, without keeping questions or answers (section 7);
• Cloudflare — stores and delivers downloadable content;
• Sentry — technical reports of app errors, without personal data (in the EU; section 9);
• Google — if you sign in with Google; and Apple / Google for the operating system's maps and geocoding.

We may also disclose information to authorities where the law requires it. We don't sell your information or give it to anyone for targeted advertising.

11. How long we keep data

• Synced account data (settings, bookmarks and notes, goals, logs, recitation summaries and "Ask" chat history) is kept while your account exists and is deleted when you delete your account.
• "Ask" usage records (model, tokens, cost, time and chat session ID) are kept while your account exists and are deleted with it (Delete Account).
• The question-answering server keeps its own copy of conversations for at most 30 days, then deletes it automatically.
• Server logs (which include the beginning of each question) are kept for 30 days.
• DeepInfra does not keep questions or answers after responding.
• Session audio files and guest-mode data exist only on your phone and are deleted when you delete the app.

12. Exporting and deleting your data

• Profile → Privacy & Security → Export My Data gives you a copy of your data as a file.
• Profile → Privacy & Security → Delete Account deletes the account itself (your sign-in email) and all its synced data right away, and removes the recitation recordings kept on your phone. The question-answering server's copy of your conversations is deleted automatically within 30 days (section 11).
• If you prefer, you can instead email seyedvahid.mirnezami@themiraj.ai or mohammadreza.khalilishoja@themiraj.ai from your account's email address and we will delete your account.

13. Your rights

Depending on where you live, you may have the right to access, correct or delete your data, or to object to how it is used. Email us for any of these.

14. Security

The app talks to servers over encrypted connections (HTTPS), and some downloadable content is stored encrypted. Still, no way of sending or storing data is completely secure.

15. Where data is stored

Our service providers' servers may be in a country other than yours (including the United States). By using the app, your data may be transferred to and processed there.

16. Children

Mi'Raj is not directed at children under 13, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has created an account or given us information, contact us and we will delete it.

17. This website

This website is hosted on GitHub Pages, and GitHub may log technical information such as visitors' IP addresses. The site itself uses no cookies or analytics; only the language you choose is remembered, in your own browser. The password-reset page is also on this site and sends your new password directly to our sign-in service.

18. Changes to this policy

If this policy changes, we will post the new version on this page and update the date at the top. For important changes, we will also let you know in the app.

19. Contact us

For any privacy question or request: seyedvahid.mirnezami@themiraj.ai or mohammadreza.khalilishoja@themiraj.ai