Subac is a Qur'an memorisation app at https://subac.net. It is a product of Subac / Mohamed Jeyte. This policy explains what we collect, why we collect it, and how long we keep it. It is written for people using the website, the installable web app, and the Android / iOS wrappers that open the same service.
What we collect
- Account details. Email address, name, and a hashed password when you sign up. Teachers and schools may also add a school name, website, and logo image. We do not store your password in plain text.
- Session and progress. Which surah, juz, or page you are practising; scores; streaks; daily goals; badges; and a mistake journal (including the ayah, your transcript text, and accuracy). If a practice is interrupted, the ayah, mode, and scores stay in this browser so you can choose to continue or start over. Teachers may store student names and optional emails. A mistake journal row — who missed it, which ayah, the accuracy, and when — is visible to that student, a parent the teacher has linked to them, and the teacher of that student's dugsi. Platform operators see how many mistakes are stored, not which student missed which ayah.
- Microphone audio. When you press Record in a practice session, we capture a short clip of you reciting so we can transcribe it, mark words green or red, and compute a score. We do not record in the background. Listen-only mode does not use the microphone.
- Cookies and similar data. A signed-in session cookie (
subac_session, httpOnly, about 30 days), plus language (subac_lang, your chosen interface language) and theme (subac_theme) preferences. These are for running the app, not advertising. - Optional extras. Feedback you send us; crash reports (page, error message, stack); and share-link settings for a practice session.
How we use recitation audio
Audio is used only to score the practice turn you just recorded. When you press Record, the clip is sent from your device to Subac's speech checker (POST /api/transcribe). That checker runs on Subac's own server, hosted on Railway, and transcribes the clip with a faster-whisper model running on that server. The server writes the clip to a temporary file so it can be decoded, then deletes that file. We do not keep a library of recordings. We do not sell them, and we do not use them for advertising. The default configuration does not send the clip to anyone else. If the operator turns on OpenAI Whisper, that same short clip is sent from Subac's server to OpenAI for transcription under OpenAI's terms. The key that authorises that request stays on the server. If OpenAI cannot transcribe the clip, Subac scores that turn on its own server instead.
After scoring, what we retain is the result of that turn: the transcript text, accuracy, and related progress — not the audio file itself. Server logs or backups are not used as a recording archive.
How we use other data
Account, session, and progress data run the product: sign-in, saving where you left off, showing teachers and parents how students are doing, and enforcing plan limits. The app, the account database, and that processing are hosted on Railway. Feedback and crash reports help us fix bugs.
When you play a recitation, your device requests the audio file directly from a third-party audio host: everyayah.com or cdn.islamic.network. That host sees your IP address and the file address, which identifies the reciter and the ayah. English audio, when it is on, is Ibrahim Walk reading Saheeh International from everyayah.com. Subac does not send your account email to those hosts and does not copy the files. The clip itself is not your recording; it is the published audio.
Who else can see data
- The student sees their own mistake journal: the ayah, the transcript, the accuracy, and the time.
- Teachers see progress and those mistake rows only for students on their own roster. A teacher does not see students from another dugsi.
- Parents see mistake rows only for children a teacher has explicitly linked to them.
- Platform operators can see totals, such as how many mistakes are stored, so the service can be run. They do not see which student missed which ayah, or that student's accuracy.
- Resend (resend.com) sends welcome, password-reset, student-invitation, and product-announcement email when email is configured that way. An announcement includes an unsubscribe link. The message includes the address it is sent to.
- Railway (railway.com) hosts the website, the account database, and the server that processes recitation audio.
- OpenAI, only when the operator has turned on OpenAI Whisper for scoring. In that case OpenAI receives the short recitation clip for that turn so it can be transcribed. The default does not send audio to OpenAI.
- Telegram. When the owner has turned on notifications, a new signup sends that person's name and email address to the owner in a private Telegram chat. Crash and error reports (the page, the error message, and the signed-in person's name) may be sent the same way, so problems can be fixed. That is not advertising and is not a sale of data.
- Sentry (sentry.io), when a monitoring key is configured, receives the page and the error message so a crash can be fixed. The account email address is not included.
- Audio hosts everyayah.com and cdn.islamic.network receive the playback request described above.
We do not use advertising SDKs, analytics pixels, or cross-app tracking.
How long we keep it
Account, progress, and mistake-journal records stay until the account is deleted. Session cookies expire after about 30 days of inactivity (active use can renew them). Password-reset tokens expire after a short period. Recitation audio is written to a temporary file for the practice turn and deleted after decoding. It is not stored as a recording library. Crash and error reports that belong to the account are deleted with the account.
Children and family accounts
Subac is used in homes and dugsis, including by children practising under a teacher or parent. We collect student names (and optional emails) so the roster and progress screens work. We do not use this information for ads. A student who is signed in can delete their own practice data from Profile. A parent or teacher who added a child can delete that student by deleting the teacher account, or ask us to remove only that student.
Your choices
- You can use listen-only practice without the microphone.
- You can sign out at any time (Profile).
- You can change language and night mode; those preferences are stored in cookies on your device.
- To access or correct an account, email [email protected]. To delete an account and its practice data, open Profile in the app or on the website and choose Delete account. You confirm by typing DELETE. A teacher or dugsi account also removes the student accounts that teacher created. If you cannot sign in, use subac.net/account/delete or email us with the subject “Delete my Subac account”.
Security
The live site uses HTTPS. Passwords are stored with scrypt hashes. Session tokens are httpOnly cookies. Speech checking and account APIs require a signed-in session. No method is perfect; if you believe there is a data incident, write to us at the address below.
Contact
Privacy requests: [email protected]
Account deletion: https://subac.net/account/delete
Product: Subac / Mohamed Jeyte
Website: https://subac.net
If this policy changes in a material way, we will update the date at the top of this page.