Privacy policy

Last updated: 10 October 2026

Hidayah Steps (hidayahsteps.com) helps new Muslims learn to pray, recite the Quran and remember Allah through the day. This page explains what we collect, why, who it is shared with, and how to delete it. Questions: support@hidayahsteps.com.

You can use most of Hidayah Steps without an account.
With an account, we keep your learning progress so it follows you to any device.
When you ask for a recitation check, your recording is sent to Google's AI to be checked. We do not keep it.
"Record yourself" recordings never leave your device.
We do not sell your personal information.
Deleting your account in Settings deletes your progress and profile with it.

What we collect, and why

Your account, if you create one: your name, email address and profile photo (yours, or the one from your Google account if you sign in with Google). Sign-in is handled by Firebase Authentication, a Google service.

Your learning, if you are signed in: the verses in your Daily Practice and when each is due, the steps of Your journey you have passed, the Names of Allah you have met, your saved verses, the last place you read, your streak and points, your settings (such as theme, text size and reciter) and, if you choose, the place you use for prayer times. Without an account, your settings and a few answers stay in your browser only.

Messages you send through Help & support: your email address and your message, so we can reply.

Gifts and the supporter subscription: payments are made through Stripe, which handles your card details; we never see them. We keep a record of each gift (amount, currency, number of trees, status and, if you were signed in, your account) and your Stripe customer reference. Trees are planted by Greenspark, which receives the number of trees and an internal reference, never your name or email.

Your voice

Recitation checks. When you tap Recite, your recording is sent to Google's Gemini AI, through Firebase AI Logic, to hear what you recited and give feedback. We do not store the recording. Google processes it under its service terms.

Record yourself. When you record yourself to compare with a reciter, the recording stays in your browser and is gone when you leave the page. It is never uploaded.

Your location

Only if you ask for prayer times or the qibla. If you use your location, it is rounded to about a kilometre before it leaves your device, then sent to AlAdhan for prayer times and to BigDataCloud for the name of the place. A city you search for is sent to Open-Meteo. If you are signed in, the place you choose is saved to your account.

Recitations, text and fonts from other services

Quran recitations play from everyayah.com, recordings of the 99 Names from islamicapi.com, and fonts load from Google Fonts. Tafsir is fetched through our server from the Quran Foundation. Like any website, these services see your IP address and browser when your device asks them for a file.

Analytics, security and advertising

Google Analytics for Firebase tells us how the app is used (for example which pages are visited and on what kind of device), so we can improve it.

Firebase App Check with reCAPTCHA Enterprise protects the app from abuse. Google may collect information about your device and how you use the page for this purpose.

Advertising. We may show ads through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. You can opt out of personalised advertising in Google's Ads Settings, or opt out of some other vendors' use of cookies at aboutads.info. Google explains how it uses information from sites that use its services.

If you are in the European Economic Area, the United Kingdom or Switzerland, you are asked for your consent before personalised ads are shown. Google's policies do not allow ads to be personalised based on religious beliefs.

Where your information is kept

Your account and progress are stored with Google Firebase (Google Cloud), and payment records with Stripe. These providers may process data in the United States and other countries, under their own safeguards.

How long we keep it

Your account and progress: until you delete your account.
Support messages: as long as needed to help you.
Payment and gift records: as long as the law and accounting require, even after an account is deleted.

Your choices and rights

Delete your account in Settings. This deletes your profile and photo, your Daily Practice, journey and Names progress, and your saved verses.
Correct your name and photo in Settings and Your progress.
Ask us for a copy of your information, or to delete or correct anything else, at support@hidayahsteps.com. Depending on where you live (for example under the GDPR or in California), you may have further rights, including to object to how we use your information; write to us and we will help.

Children

Hidayah Steps is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

Changes

If this policy changes, we will update this page and the date at the top.