Privacy Policy
Effective date: 1 May 2026
Iqrayah (“we”, “us”, “our”) is operated as a sole trader. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Data we collect
1.1 Data you provide
- Email address — if you subscribe to the daily verse newsletter. Used only to send you the emails you requested.
- Message content and email address — if you use the contact form. Used solely to respond to your enquiry.
1.2 Data collected automatically
- Usage analytics — page views, events (verse viewed, font changed, share clicked), device type, browser, and app platform. On the website this is collected via PostHog (EU-hosted) and Vercel Analytics only if you accept cookies. In the mobile app, PostHog React Native is used only when analytics are configured for the app release. Anonymous and aggregated by default.
- Mobile app delivery data — Expo Application Services and Expo Updates may process app build, install, update, and release-channel metadata needed to deliver the iOS and Android app.
- Notification settings — reminder time and opt-in state are stored on your device. Iqrayah v1 uses local scheduled reminders through Expo Notifications and the operating system notification permission prompts. We do not currently register FCM or APNs remote push tokens for server-sent push notifications.
- Reading preferences — font choice, translation, theme. Stored in
localStorageon the website and app-local storage on mobile. Never sent to our servers as account data.
1.3 Data we do NOT collect
We do not collect your name, phone number, location, payment information, or any government identifiers. We do not run advertising networks or sell data.
2. Legal bases for processing (GDPR)
- Consent (Art. 6(1)(a)) — analytics cookies and newsletter emails.
- Legitimate interest (Art. 6(1)(f)) — security logging, rate-limiting to protect the service from abuse.
- Contract performance (Art. 6(1)(b)) — processing your contact message to respond to it.
3. How we use your data
- Send daily verse emails to newsletter subscribers.
- Respond to contact-form enquiries.
- Understand how the site is used to improve it (analytics, if consented).
- Protect the service from spam and abuse.
4. Third-party processors
| Processor | Purpose | Data transferred | Location |
|---|---|---|---|
| Vercel, Inc. | Hosting & edge delivery | IP address, request logs (ephemeral) | USA (SCCs) |
| Brevo (Sendinblue) | Newsletter delivery | Email address | EU (France) |
| PostHog, Inc. | Product analytics | Anonymised usage events (consent-gated on web; app-release configured on mobile) | EU (Frankfurt) |
| Expo Application Services | Mobile app builds, updates, and distribution support | Build metadata, update identifiers, release channel, device/app install metadata | USA (SCCs) |
| Apple Push Notification service / Google Firebase Cloud Messaging | Platform notification delivery if remote push is enabled in a future release | Remote push tokens and notification delivery metadata | Apple/Google infrastructure |
| Vercel Analytics | Web Vitals & page views | Anonymised metrics | USA (SCCs) |
SCCs = Standard Contractual Clauses approved by the European Commission for GDPR-compliant international transfers.
5. Data retention
- Newsletter subscribers — retained until you unsubscribe. Click the unsubscribe link in any email.
- Contact messages — deleted within 90 days of the final reply.
- Analytics events — retained for 12 months in PostHog, then auto-deleted.
6. Your rights (GDPR — EEA / UK residents)
You have the right to:
- Access (Art. 15) — request a copy of the personal data we hold about you.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — ask us to delete your data (“right to be forgotten”).
- Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent — at any time, by declining analytics cookies or unsubscribing from emails.
To exercise any right, email privacy@iqrayah.com with subject line “Data Request”. We will respond within 30 days.
7. Your rights (CCPA — California residents)
Under the CCPA you have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To submit a request, email privacy@iqrayah.com.
8. DMCA takedown
If you believe content on Iqrayah infringes your copyright, send a DMCA notice to dmca@iqrayah.com with:
- Identification of the copyrighted work claimed to have been infringed.
- Identification of the infringing material and its URL on our site.
- Your contact information (name, address, phone, email).
- A statement that you have a good-faith belief the use is not authorised by the copyright owner.
- A statement that the information is accurate and, under penalty of perjury, that you are authorised to act on behalf of the copyright owner.
- Your physical or electronic signature.
9. Cookies
We use cookies and local storage for reading preferences and, with your consent, analytics. See our Cookie Policy for full details.
10. Children’s privacy
Iqrayah is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@iqrayah.com.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced via the newsletter and the effective date above will be updated. Continued use of the site after changes constitutes acceptance.
12. Contact
Data controller: privacy@iqrayah.com
Postal address: available on request.
⚠️ Lawyer review required before publication. This page is a working draft and has not been reviewed by qualified legal counsel.