Privacy
Nahfaz does not ask you to sign in and does not collect your name or email.
On your device
Progress, settings and your saved place stay in localStorage or IndexedDB on your device. Prayer times and Qibla are calculated there; your chosen coordinates are not sent to us.
Circles
Circles store encrypted records on our server. We cannot read names or progress; keys stay on devices. The server can link circle activity from the same device. Hosting sees IP addresses during requests; abuse limits retain short-lived hashed network identifiers. In a Khatm where each person picks a part, the server also holds a short-lived reservation per claimed part (about 12 minutes) so two people cannot take the same part at once. It learns how many parts of a circle are being claimed and when, when a round turns over, and how many parts the circle has (30 or 60). The reservation itself does not show which part it is or who made it, and reservations carry nothing that ties them together; like any request, our host still sees the network address and the time. When a Halaqa reads together live, devices exchange encrypted position messages through our realtime provider (Supabase). It cannot read them; it sees the network address, a random channel name, when devices connect, and the size and timing of messages, and what kind each one is (a position, a raised hand, the end of a session). The channel name is the same for every session of the same circle. Nothing is stored.
Move my progress
A one-time sealed box holds encrypted progress for up to 10 minutes. Its key stays on devices. The box is deleted when taken or after expiry.
Approximate place
Vercel connection headers provide an approximate place. We return it without storing it; it is saved on your device only if you confirm it.
Audio and offline saving
Streamed from the reciters’ audio hosts; those hosts see the request. Only your browser keeps a copy on your device when you choose offline saving; you can remove it. We do not re-host the audio.
Analytics and challenges
When enabled, we use cookieless Vercel Web Analytics and Speed Insights on public pages. Query strings and fragments are stripped; Do Not Track and Global Privacy Control suppress events. Cloudflare sees the Turnstile challenge used to prevent abuse.
Hosting logs
Our host keeps standard server logs, including IP addresses, for a short time. We do not use them to identify you.
No accounts or ads
No accounts, no ads, and no selling data. You can clear browser storage and remove saved audio.