قَبَس

English

In its default mode Qabas collects no data, shares no data, and sells no data — because it never has any. You can open and use the whole app with no account and no contact with any server of ours.

• No accounts, no sign-in.
• No ads and no ad networks.
• No analytics, no tracking, no third-party data-collecting SDKs.
• Everything you create (bookmarks, reading position, settings) stays on your device only.
• If you sign in to the optional account described below, your reading state (last surah and ayah, bookmarks, your «selections» list, chosen reciter, recitation speed) is synced with our server so you find it identical on your other devices (a second phone, a TV). These are numbers and surah names only — never text, audio or a log of what you read — and they are deleted with the account. Without an account nothing leaves your device.

One explicit exception: the Memorization & Study section contains an optional "online account" mode, off unless you turn it on yourself, which does store data on a server. It is described in full in its own section below. As long as you have not turned it on, everything on this page about "no server" is literally true.

Memorization & Study — the default offline mode

If you use it, you may enter your name and phone number, and a teacher may enter their students' names, phone numbers and recitation records. This information is stored on your device alone and never reaches us or any server. It leaves your device only when you yourself share it by an explicit manual action — sending an encrypted file through an app you choose, or showing a QR code to another device. You alone decide the recipient. As additional protection this data is excluded from Google's automatic backup. To erase all of it: use "Wipe data" inside the section, or uninstall the app.

The microphone — "Quran Mastery" (Mahir) and voice search

The microphone is used in exactly two places and nowhere else: the optional Mahir practice mode, and voice search on the search screen. In Mahir the app listens to your recitation to compare it with the ayah's text; in voice search it listens to the part of an ayah you recite so it can find it in the mushaf. In both, your voice is transcribed on your device alone, in working memory alone: no recording is ever written to storage, no audio is ever sent to any server or any party, and the audio is discarded the moment the attempt or the search ends. The microphone runs only while you are on that screen and only after you tap the microphone button yourself; leaving the screen or the app ends it. Voice search uses the very same recognition model as Mahir, and if it is not installed the app offers you the same one-time download. Recognition — and the optional tajweed hints in both their modes — runs on AI models inside your phone (one-time downloads: ~82 MB for recognition, ~122 MB for tajweed measurement if you enable it, ~876 MB for the advanced mode if you choose it yourself) and then works without internet. Your Mahir progress (which ayahs you completed) is stored on your device; if you sign in with the same optional account described below, the list of completed ayahs (their numbers only — never audio, never text) is synced with the server.

Network access

The app contacts fixed static hosts only to download recitation audio you request (everyayah.com, mp3quran.net and fallback mirrors), and contacts the app's own server to download the Mahir voice model if you request it — a static file download that needs no account and sends nothing about you. The external hosts process the download request like any web server (including transient processing of your IP address to fulfil the request); we do not operate those external servers, access their logs, or receive any data from them. The Memorization & Study section works fully offline in its default mode.

The optional "online account" mode

This mode is off by default and does nothing unless you enter the Memorization section, choose it yourself and create an account. It exists for mosques and institutes that run several study circles centrally.

Who runs the server: the app's maintainer (contact details at the end of this page). It serves participating mosques only.

Data	Why
Name and phone number	The number is the person's identity and is never duplicated
Mosque or institute	Decides who administers you and who may record for you
Role (student / teacher / admin)	Permissions
Password	Stored as a PBKDF2 hash, never as text — we cannot read it
Recitation records	Page, grade, mistakes, date, teacher's name
The teacher's note about a student	Capped at 150 characters
An audit log	Every sign-in and administrative action, with IP address and time
A device identifier	A random value the app generates to bind your session. Not any Android device ID

What is not stored: no location, no contacts, no photos, no audio recordings, and nothing about your reading of the Quran — bookmarks, reading position and settings stay on your device in both modes.

Who can see your data: your teacher, your mosque's administrator, and the super administrator. Nothing is sold or shared with any third party, and the server carries no analytics and no advertising.

Parent link: a teacher or administrator may create a read-only link showing one student's progress to a parent. Anyone holding the link can open it, which is why it can be revoked at any time and stops working immediately.

Deleting your data: ask your mosque's administrator — they can archive the account (it disappears and can no longer sign in), and the super administrator can delete it permanently with all of its records. Or write to us directly using the contact details below. After a permanent deletion nothing remains but an audit row stating that a deletion happened and when, with no usable name or number. (Deletion request page: delete-account.html)

Going back: you can leave this mode with one tap and return to offline mode, with your local data untouched.

Transport: every call to the server goes over HTTPS, and the release build of the app refuses cleartext connections outright.

Permissions

• Internet — audio and voice-model download, and the optional online mode if you turn it on.
• Background media playback — so recitation continues with the screen locked.
• Microphone — requested in exactly two places and nowhere else: the Mahir practice screen, and voice search on the search screen. It is active only while you are on that screen and only after you tap the microphone button yourself (it stops the instant you leave the screen or the app leaves the foreground — there is never any background listening, and there is no microphone foreground service, by design). Your voice is transcribed on-device and in memory only: no recording is ever saved, nothing is ever uploaded, and your voice never leaves your device. If you use neither Mahir nor voice search, this permission is never requested; if you deny it, every other feature keeps working normally.
• Notifications — to show the playback notification (play and pause from the lock screen) and the progress of surah and model downloads. Every notification is created on your device by a job you started: no promotional notifications, and nothing pushed from any server.
• Camera — requested only inside the QR scanning screen of the Memorization & Study section, and used only to read the code at that moment. No photo or video is captured, nothing is stored, nothing is transmitted. If you never use QR scanning, this permission is never requested.

Two further entries appear in the app's permission list, added automatically by official Android libraries. Both are "normal" permissions: the user is never prompted for them and neither touches personal data.

• Network state (ACCESS_NETWORK_STATE) — from the androidx.media3 playback library, which uses it to see whether a connection is available during recitation.
• Run at boot (RECEIVE_BOOT_COMPLETED) — from androidx.work, the library behind the surah download manager, so an interrupted download can resume. Qabas does not start itself when the device boots and does not run in the background on its own.

No other permissions. The app does not use Bluetooth and never requests Bluetooth permission: sending a memorization file over Bluetooth goes through Android's own share sheet, not through the app.