Privacy & Cookies

Tilawo Privacy Policy

Last updated: 6 October 2026

Tilawo is a tool for private Qur’an/Hifz teachers to manage lessons, and for their students to follow along. This page explains what personal data Tilawo collects, why, and what rights you have over it. It’s written for UK data protection law (UK GDPR). See also our Terms of Service, which covers using Tilawo more generally.

Who’s responsible for your data

Tilawo is currently operated by an individual (not yet a registered company), trading as “Tilawo”. For any privacy question or request, contact islamsaif22305@gmail.com.

What we collect

Depending on whether you’re a teacher or a student, Tilawo holds:

• Account details — your name and email address, and a securely hashed password (we never see or store your actual password).
• For teachers: the students you add, their memorisation plan and progress, session notes and grades you record, your own private notes, and a payment record you keep manually (see “About payments” below).
• For students: your own ready-ticks and self-ratings, your private diary entries (which your teacher can never see), and messages you send.
• Messages sent between a teacher and their student, visible only to the two of you.
• Subscription details (teachers who upgrade) — which plan you’re on, and the reference numbers and status Stripe gives us for your subscription. We do not hold your card details (see “About payments” below).
• Push notification details (only if you turn notifications on) — a device identifier your browser gives us so it can deliver a notification. No location or device tracking beyond this.

About payments

Tilawo has free and paid plans. Paid plans are billed through Stripe. When a teacher upgrades, they are sent to Stripe’s own secure checkout page and enter their card details there — those details go to Stripe, never to Tilawo’s servers or database. To set up the subscription we send Stripe your email address, and Stripe asks for billing details such as your country and postcode so the correct tax can be applied. Stripe handles that information under its own privacy policy (stripe.com/privacy), including keeping payment and tax records for as long as the law requires.

Students never pay Tilawo and never see a checkout. Separately, the “Notes & Payments” page lets a teacher keep their own manual record of who has paid them for lessons (for example after a bank transfer arranged outside the app) — that is a private ledger for the teacher, is not connected to Stripe, and moves no money.

Teams and multi-teacher accounts

A paid plan can include more than one teacher. The person who owns the account (and anyone they promote to admin) can invite and remove teachers and sees a roster overview of every teacher on the account: each teacher’s name, and their students’ names, plan text and payment status. They cannot see another teacher’s session notes, grades history, private notes, messages or a student’s private diary — those stay with the teacher they belong to. If you join a team you’re agreeing to that overview; if you leave or are removed, you keep your own students and move to your own separate Free account.

Children’s data

Many Hifz students are under 18, and some are under 13. Tilawo is designed to be used with a teacher’s (and, where applicable, a parent or guardian’s) knowledge and involvement — a student joins because their teacher gave them a class code, not by discovering the app independently. We collect the minimum needed to run the lesson workflow (an assignment, progress, messages with their own teacher) and never use a child’s data for marketing. If you’re a parent or guardian with a question about your child’s account, contact us at the email above and we’ll help directly.

Why we process it

To provide the service you or your teacher signed up for (this is a “contract” basis under UK GDPR), and in some cases our legitimate interest in keeping the app secure and working properly (e.g. the security lockout described below).

Who we share it with

Tilawo doesn’t sell data, and doesn’t use advertising or analytics trackers. Your data is processed by:

• Supabase — hosts our database and handles sign-in. Every table is protected by row-level security, so a teacher can only ever see their own students, and a student only ever their own record.
• Vercel — hosts the web app itself.
• Stripe — processes payments for paid plans, only for teachers who upgrade (see “About payments”).
• Your browser’s own push service (e.g. Google’s for Chrome, Apple’s for Safari) — only if you turn on notifications, and only to deliver the notification itself.

These providers may process data outside the UK, under their own data protection safeguards.

Cookies

Tilawo uses one strictly-necessary cookie, set by Supabase, to keep you signed in. It doesn’t track you across other sites, isn’t used for advertising, and isn’t shared with any third party. Because it’s strictly necessary for the app to work (you couldn’t stay logged in without it), UK law doesn’t require us to ask your permission for it — but we wanted to tell you it’s there anyway. Tilawo doesn’t use analytics or advertising cookies of any kind. If you go to Stripe’s checkout page to upgrade, that page is run by Stripe and may set its own cookies under Stripe’s policy; Tilawo itself does not.

How long we keep it

For as long as your account exists. You can delete your own account at any time from Settings. Deleting a teacher account removes their entire roster and everything in it. Deleting a student account removes their login, but their teacher’s record of lessons taught stays (the same way a paper register would) — it just no longer has a login attached to it.

Deleting your account also cancels any paid subscription you own, so you won’t be billed again. If other teachers are still on your account you’ll be asked to remove them first. Stripe keeps its own payment and tax records after your account is deleted, for as long as the law requires.

Security

All traffic to Tilawo is encrypted (HTTPS). Every piece of data in the database is protected by row-level security rules enforced by Supabase, not just by the app’s own code — so even a bug in Tilawo can’t normally expose one person’s data to another. A 4-digit class code used to join a teacher is backed by a lockout (5 wrong guesses locks that account out for 15 minutes) specifically so a short, easy-to-share code can’t reasonably be guessed. Invitation links for joining a team are long, random, single-use and expire after 7 days.

Your rights

Under UK GDPR, you can ask us to:

• show you what data we hold about you;
• correct anything that’s wrong (most of this you can already edit yourself in the app);
• delete your data (self-serve in Settings, or ask us);
• export your data in a portable format; or
• restrict or object to how we use it.

Email islamsaif22305@gmail.com for any of these. You can also complain to the UK’s Information Commissioner’s Office (ico.org.uk) if you’re unhappy with how we’ve handled your data.

Changes to this policy

If this policy changes materially, we’ll update the date at the top. Significant changes will be flagged in the app.