Privacy Policy

Quran Wave is a product of Iqra Wave Foundation, a non-profit organisation established in Bangladesh. The Foundation is registered under the Societies Act XXI of 1860, RJSC registration number S-15028/2026.

Iqra Wave Foundation decides how the information described here is handled. In data protection law it is the data controller.

This policy covers the Quran Wave website at quranwave.com and the Quran Wave app for Android and iOS. The Foundation's own website at iqrawave.com is a separate site with its own privacy policy, which you can read at iqrawave.com/privacy-policy. That policy covers only that website, not Quran Wave.

You can read the Qur'an, translations and tafsir, and listen to recitation, without creating an account. Most of what follows applies only if you choose to sign in.

Account information. If you create an account we store your email address, your first and last name, and your password as a bcrypt hash. We never store the password itself. If you sign in with Google instead, we ask Google only for your email address and basic profile. We store your Google account ID, email address, first and last name, and the web address of your Google profile picture. We do not receive your Google password and we get no other access to your Google account.

Content you create. Bookmarks (the surah and ayah, and the label they belong to), labels (the name and colour you choose), personal notes (the text you write and the ayah it belongs to), your reading progress (the last surah and ayah you read, and when), and your settings (translators, reciter, fonts, theme and layout). If you are signed in, this is stored on our servers so that it follows you between devices. If you are not signed in, it stays on your device only.

Device and session information. When you sign in we record the IP address the request came from, your browser name and version, your operating system and version, the device type, the full browser user agent string, and an approximate country and city. The country and city are looked up from the IP address using an offline database on our own server, so no third party is asked. You can see every signed-in device on the Active Devices page and sign any of them out.

We also set two cookies when you sign in. One holds your sign-in token and lasts up to 25 hours. The other holds your refresh token and lasts 7 days. Both are marked SameSite=Lax, and Secure when the site is served over HTTPS. They are removed when you sign out. We do not use advertising or tracking cookies of our own.

Usage and diagnostics. We measure how the app is used so that we can improve it:

• Our own analytics records a randomly generated visitor ID kept in your browser storage, a randomly generated session ID, whether you are signed in, your account ID if you are, the page paths you open, when a session starts and ends, and how long you were actively reading. Our server adds a country, a device type and a browser name, worked out from the IP address and the user agent of the request. The IP address itself is not saved with these records.
• Google Analytics 4 loads on every page of the website and receives the usual web analytics information, including your IP address, the pages you visit and a Google analytics cookie.
• Vercel Web Analytics measures page traffic for the website.
• Sentry receives error reports when something goes wrong: the error, the technical context around it and, if you are signed in, your account ID, email address and role. It also receives a sample of about one in ten performance traces.
• In the mobile app, Firebase Crashlytics receives crash reports: the crash, the stack trace and basic device information. Your account ID is not attached to them.

We do not record your screen or replay your sessions, on the website or in the app.

Notification information (app only). If you allow notifications, Firebase Cloud Messaging issues your device a token. We do not collect or store that token. We send notifications to groups, never to one person: everyone who has the app, everyone on Android or on iOS, and the two groups you can switch on and off yourself, offers and donation requests. Your choices and your daily reminder time are stored on your device. The daily reminder is scheduled on the device itself, so the time you pick never reaches us.

What we do not collect. We do not collect your precise or GPS location. We do not ask for your contacts, photos, microphone or camera. We do not use advertising identifiers, and there are no advertising or marketing SDKs in the website or the app. We do not take payment details, because donations are handled entirely by PayPal.

• Account information is used to create your account, to sign you in, to send you a password reset code or an account deletion code, and to confirm when your account has been deleted.
• Content you create is used only to store your bookmarks, notes, labels, reading progress and settings, and to show them back to you on any device you sign in to.
• Device and session information is used to keep your account secure, to show you which devices are signed in, and to let you sign a device out.
• Usage and diagnostics are used to understand which parts of the app are used, to find and fix crashes and errors, and to report anonymous reach figures for the Foundation.
• Notification settings are used to send only the kinds of notification you asked for, and to show your daily reminder at the time you chose.

We do not use any of this to build a profile of you for advertising, and we do not make automated decisions about you.

• Performance of a contract. Creating your account, signing you in, and storing and syncing your bookmarks, notes, labels, reading progress and settings.
• Legitimate interests. Keeping accounts and sessions secure, keeping the service working, fixing crashes and errors, and understanding overall usage. Our interest is in running a free service reliably, and we keep the information involved to the minimum described above.
• Consent. Push notifications in the app. Your device asks you first, and you can withdraw that permission at any time in your device settings.

We do not currently show a cookie or analytics banner. Analytics and error reporting start when you open the website or the app, and we rely on legitimate interests for them. If you would rather not be included, write to us at the address in section 13 and we will tell you what we can do.

We use these service providers, and each receives only what it needs to do its job:

• Google (sign in with Google). Google confirms who you are and gives us your email address and basic profile. It knows that you signed in to Quran Wave.
• Google Analytics 4 (Google). Receives web analytics information from every page of the website, including your IP address.
• Firebase Cloud Messaging (Google). Delivers notifications to the app and holds your device token.
• Firebase Crashlytics (Google). Receives crash reports from the app.
• Sentry (Functional Software, Inc.). Receives error reports and a sample of performance data from the website, including your account ID and email address when you are signed in.
• Vercel (Vercel, Inc.). Hosts the website, so it handles every request you make to it, and provides Vercel Web Analytics.
• Our email provider. Delivers password reset codes, account deletion codes and deletion confirmations. It receives your email address and the message.
• everyayah.com, served through BunnyCDN. Recitation audio is streamed from there, so playing audio sends a request, including your IP address, to that service.
• Amazon Web Services (S3). Word images and syntax diagrams are loaded from there, so your IP address reaches AWS when they are shown.
• PayPal, only if you choose to donate. Donations open PayPal outside Quran Wave, and we never see your payment details.
• WhatsApp and X, only if you choose to share a verse. Nothing is sent unless you tap share.

We may also disclose information if the law requires it, or to protect the rights and safety of our readers and the Foundation.

We do not sell, rent or trade your information, and we do not share it so that anyone can build an advertising profile of you.

Iqra Wave Foundation is established in Bangladesh and handles the information described here from there. Our hosting and the service providers listed above are outside Bangladesh. Most of them are United States companies, and our image storage is in a United States region of Amazon Web Services. Your information therefore moves between countries.

If you are in the EU or the UK, this means your information is transferred outside that region. Each provider handles those transfers under its own terms. If you would like to know more about the arrangements with a particular provider, write to us at the address in section 13.

• Your account and the content in it are kept for as long as your account exists.
• Sign-in sessions are deleted automatically once their refresh token expires, which is 7 days by default, and we check every hour. A session you sign out remotely is removed 30 days later.
• Password reset codes are valid for 10 minutes. Expired codes are removed every hour, and used codes within 24 hours.
• Account deletion codes are valid for 10 minutes and allow 5 attempts. They are removed within about an hour of expiring or being used.
• The sign-in codes the mobile app uses last 60 seconds, and the login state that goes with them lasts 10 minutes. Both are removed within about an hour.
• When you delete your account, your account, bookmarks, notes, labels, reading progress, settings and sessions are deleted immediately. Analytics records are not deleted, but the link to your account is removed, so they no longer identify you.

Copies of deleted information may remain in our backups for a limited period, until those backups are replaced. For the current schedule, write to us at the address in section 13.

You can ask us to:

• give you a copy of the information we hold about you,
• correct anything that is wrong,
• send you your data in a portable form,
• stop using your information for a particular purpose, or
• delete your account and everything in it.

You can delete your account yourself, in either of two ways. Signed in, open Settings and use Delete Account at the bottom. Without signing in, go to quranwave.com/delete-account, where we email a six digit code to your address to confirm the request. Either way the deletion happens straight away and cannot be undone.

For anything else, write to us at info@iqrawave.com. If you are in the EU or the UK, you also have the right to complain to your national data protection authority.

The Quran Wave app can send you a daily reading reminder, occasional news about new features and offers, and occasional requests for donations. Your device asks for your permission before any of these can arrive.

Open Settings in the app to switch the daily reminder on or off, change its time, and turn offers and donation requests on or off separately. You can also turn off notifications for Quran Wave entirely in your device settings, which stops all of them. The website does not send push notifications.

Quran Wave is for a general audience and is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child has created an account, write to us at info@iqrawave.com and we will delete the account and everything in it.

The website and the app talk to our servers over HTTPS. Passwords are stored as bcrypt hashes, never in readable form. Password reset codes and account deletion codes are stored as hashes too, not as the codes themselves. Sign-in cookies are marked SameSite=Lax, and Secure over HTTPS. You can see every device that is signed in to your account and sign any of them out at any time.

No service can promise perfect security. If you think someone else has reached your account, sign the other devices out from the Active Devices page, change your password, and tell us at info@iqrawave.com.

If we change how we handle your information, we will update this page and change the date at the top. If a change is significant, we will say so in the app. This version takes effect on 19 September 2026.

Iqra Wave Foundation

Email: info@iqrawave.com

Phone: +880 1314 951751

Bangladesh

Registered under the Societies Act XXI of 1860, RJSC registration number S-15028/2026.