Privacy Policy

Nayestan is operated by the Vahdah Educational Foundation, a nonprofit corporation registered in Canada.

Last updated: October 19, 2026. Important changes to this page are announced on this page.

Nayestan (nayestan.net and the Nayestan app) respects your privacy. This page explains what we keep, where it goes, how long it stays and how to delete it. We do not sell your data, do not use it for advertising, and run no tracking or analytics tools on the website or the app.

Without an account

Reading the couplets and their meanings needs no account, and we keep no data about you, unless you make a donation or send feedback without an account; what is kept in that case is described below. Where you were reading and your preferences stay only in that browser or device.

With an account, these are stored on your account

• Account: your email and how you sign in (email and password, Google or Facebook). If you choose them, a profile name and a Nayestan ID (username).
• Study: couplets read, lessons and pages finished, likes, notes, daily notes, bookmarks, review state, streak, nay and rank.
• A record per device: each device has a random id (not a hardware id). Its record says on which days and how much it was used for study and what nay it spent, with a short log of spending (type, amount, time).
• Preferences: language, theme, text size and reminder time.
• Family, invitations and referrals: if you use them, who invited or referred you and under which label (Nayestan ID, or the email you were invited with).
• Failed look-ups: to prevent misuse, the invitation and referral forms allow 5 failed look-ups by email a day. That day's count is kept on your account and starts again each day.
• Purchases: for each payment: your account email, what you bought, the amount, the time and the PayPal transaction id. Refunds are recorded too. Your card or bank details never reach us.
• A donation without an account: only the payer's email that PayPal gives us, with the amount, the time and the transaction id. We do not keep the payer's name or country.
• Feedback: if you send the feedback form (with or without an account): the message, its subject, the email you typed and, when signed in, your account id and email. The message is also emailed to our support address.
• IP address: Nayestan's code checks it only for a moment, to prevent abuse, and does not store it. Google Cloud's own automatic server logs (including request addresses) are kept for a limited time.

Where it goes

• Firebase and Google:
  • Your account and all of the above are kept in Firebase (Google Cloud). The data is stored on Google's servers in the United States: the database in the nam5 region (United States) and the server functions in us-central1.
  • Signing in with Google (including One Tap) or Facebook is also subject to those companies' privacy policies.
  • To prevent abuse, the members' search, the feedback form and account deletion use Firebase App Check with Google reCAPTCHA Enterprise.
  • Fonts are loaded from Google Fonts.
• Cloudflare:
  • The website, the app and the couplet audio are hosted on Cloudflare.
  • Every 30 minutes a small request reads the server's clock, so that days and streaks follow the correct time. No account data goes with it; like any request, it shows your IP address to Cloudflare.
  • Email you send to an @nayestan.net address passes through Cloudflare Email Routing.
• PayPal: payments are made with PayPal and are subject to PayPal's privacy policy. PayPal keeps its own transaction records separately.
• Brevo: feedback-form messages are emailed to our support address through Brevo.
• Links to quran.com, sunnah.com and Google search open only when you tap them.

What stays only on your device

• display and language preferences on the website
• a guest's reading position
• the device id
• the clock offset
• a local copy of your data for offline use
• members' content read in the current session (cleared when you sign out)

These sit in the browser's or the app's storage until you clear them. The app shows the daily reminder itself, on the device; Nayestan sends no reminders from a server and collects nothing for them. Nayestan sets no cookies of its own; Google, Facebook or PayPal may set theirs when you sign in or pay.

How long it stays

• Account data: while the account exists.
• Payment records: 6 years, for accounting.
• Feedback messages: 2 years; then they are deleted. Their email copies in our support mailbox are deleted by the same rule.
• Failed look-ups: that day only.
• Backups: to protect your data from loss, the database is backed up automatically every day, and backups and recovery copies are kept for at most 7 days.

Seeing, correcting and deleting your data

• In Settings you can download a backup file of your data.
• You can ask for a copy of your data, or for it to be corrected, by writing to [email protected].
• In Settings → Delete account you can delete your account and data yourself. Data deletion has the details.

Children

Nayestan is not designed for children under 13; a user under 13 should use it only with a parent's or guardian's permission and guidance.

Contact: [email protected]