Privacy Policy — Ilm Journal

Last updated: 15 October 2026

Ilm Journal is a private study tracker. You write down what you're studying, and only you can see it. This page explains exactly what the app knows about you, why, and what you can do about it.

We've tried to write it in plain English. If anything here is unclear, email hello@ilmjournal.co.uk and we'll explain it properly.

The short version

• Everything you write in Ilm Journal is private to your account. There is no sharing, no groups, no public pages, and no way for another user to see your study log.
• We don't track you. No analytics, no advertising, no third-party services watching how you use the app.
• We don't ask for your location, camera, photos, microphone, or contacts.
• You can delete your account and everything in it, permanently, from inside the app.

Who we are

Ilm Journal is run by Shuceeb, contactable at hello@ilmjournal.co.uk.

For data protection law, that means we are the "data controller" for the information described below — the ones responsible for it.

What we collect

1. Your account

When you sign up with an email address and password, we store:

• Your email address — so you can sign in, and so we can email you a confirmation code and a reset code if you forget your password.
• Your password, scrambled — stored in a form that can't be turned back into your password. Nobody at Ilm Journal can read it, and we can't recover it for you.

If you sign in with Google instead, Google tells us your email address and your name, and nothing else. We don't get access to your Gmail, your contacts, your Drive, or anything else in your Google account.

We also store which method you signed in with, so the app knows whether to offer you a "change password" option.

2. Your profile

• The display name you choose (you can change or clear it at any time).
• Your Quran settings: which end of the Quran you're memorising from, how much you revise at a time, and when you started.

3. What you write about your studies

This is the heart of the app. It's whatever you choose to type in, and may include:

• The title of a book, course, or class, its format (online, in person, self-study), whether it's in progress or finished, and when you last opened it.
• The name of your teacher, if you enter one.
• Where the class is — as text you type. The app never reads your phone's location.
• Cost information — an amount, a currency, and whether it's free, one-off, or ongoing. This is for your own records. No money ever moves through the app.
• Schedule details — which days and what time your class runs, and when it starts.
• Links you paste in, such as a YouTube video, and where you stopped in it.
• Your progress — which lessons you've ticked off, which days you made progress, and the date you finished something.
• Exams you add — what the exam is, its date if you give one, and whether you passed.

4. Your Quran memorisation

• Which surahs and ayahs you've memorised, and the date you memorised each stretch.
• A record of each revision: what you revised, the date, whether it felt shaky, and — only if you choose to say — whether you recited it in salah, to a listener, or alone. That last one is a choice between three buttons, not something you type.

The app never shows or stores Quranic text, translation, or audio. It records references only — surah and ayah numbers.

5. Your subscription

If you subscribe, we store which plan you're on and the date it runs to, so the app knows what you're allowed to use. Free accounts have no such record at all — having nothing stored here is exactly what being on the free version means. We check subscriptions with Apple or Google directly — we don't process payment ourselves, and we never see your card details. See "Who else touches your information" below for how Apple and Google are involved.

6. Things kept on your phone

These stay on your device and are not sent to us:

• Your sign-in token, encrypted, with the key held in your phone's own secure storage (the iOS Keychain or Android Keystore).
• A short error log — the last few dozen failures the app hit, recorded as reference codes and error numbers. It's deliberately built so that nothing you typed, and not even your user ID, can end up in it. It exists so that if you email us for help, you can send us a code we can actually look up.
• A note that you've seen the intro screens, so we don't show them twice.

Signing out or deleting your account clears the error log.

7. The launch waitlist on our website

If you enter your email on our website to hear when the app launches, we store that email address and the date you signed up, and nothing else. We use it only to tell you the app is live. To be removed, email us and we'll delete it. It isn't linked to an app account.

What we don't collect

We want to be specific about this, because "we value your privacy" means nothing on its own. Ilm Journal has:

• No analytics or usage tracking. We do not know how often you open the app, which screens you visit, or how long you spend in it.
• No advertising and no advertising identifiers. Your information is never sold, rented, or shared for marketing by us or anyone else.
• No third-party tracking software of any kind built into the app.
• No automatic crash reporting. Nothing is sent to us when the app fails unless you choose to email us.
• No access to your location, camera, photos, microphone, contacts, or calendar. The app never asks for these permissions, so it cannot use them.
• Reminders stay on your phone. If you turn reminders on, your phone schedules them itself. Your reminder choices are saved only on your device, nothing about them is sent to us or to anyone else, and there are no push notification tokens.
• No sharing between users. There are no groups, no feeds, no public pages, and no way for anyone else to see what you've written.
• No card details. Subscriptions are billed entirely by Apple or Google through your App Store or Google Play account — we never see or store your card number or other payment details.

Why we hold this, and our legal basis

We hold your information for one reason: to run the app you asked us to run. Your account details let you sign in; your study notes are the thing the app exists to keep for you.

In data-protection terms, our legal basis is performance of a contract — we can't provide the service without storing what you write. Where we email you a password reset code, that's the same basis.

We do not use your information for any other purpose. We do not profile you, and there is no automated decision-making in the app.

Who else touches your information

We keep this list as short as we can.

Supabase — our database and sign-in provider. Everything described above lives on Supabase's servers, and they process it on our instructions. Their privacy notice: https://supabase.com/privacy

Resend — sends the account confirmation and password reset emails on our behalf, so your email address and the code in the email pass through their system. They don't get anything else. Their privacy policy: https://resend.com/legal/privacy-policy

Google — only if you choose "Continue with Google". Google handles the sign-in itself and tells us your email address and name. If you sign in with an email and password instead, Google is not involved at all. Their privacy policy: https://policies.google.com/privacy

Apple or Google, for billing — whichever app store you installed from handles your free trial and subscription entirely. They tell us whether it's active so the app can check what you're allowed to use — never your card details. Apple's privacy policy: https://www.apple.com/legal/privacy/ Google's privacy policy: https://policies.google.com/privacy

Your own email app — if you open Help & troubleshooting and tap Email us, the app opens a draft email addressed to us, with the recent error codes pasted in at the bottom. Nothing is sent until you send it, and you can read and edit or delete any part of it first.

Websites you open yourself — if you tap a link you saved (a YouTube video, for example), your phone opens it in your browser or in YouTube's app. From that point you're dealing with that site, under their privacy policy, not ours. We don't tell them anything about you.

That's the complete list. We don't use any other processors, and we don't sell or share your information with anyone.

Where your information is stored

Your account and study data are held on Supabase's servers in the United Kingdom.

If that location is outside your own country, the transfer is covered by the safeguards Supabase has in place for international transfers.

How long we keep it

We keep your information for as long as your account exists. We don't have a schedule for deleting inactive accounts — your study log is meant to still be there when you come back to it years later.

When you delete your account, we delete it. See below.

Deleting your account

In the app: Settings → Account → Delete account.

This is permanent and immediate. It removes your login, your profile, every study item, and your entire Quran memorisation and revision history in one go. There is no recovery period and no archived copy — once it's done, we cannot get it back for you, and neither can you. Please make sure that's what you want.

Backups held by our hosting provider may take a short while to cycle out, after which no copy remains.

Keeping it safe

• Every request is checked against your account. The database enforces, at its own level, that a signed-in user can only ever read or write their own rows. It isn't a rule the app politely follows — the database refuses anything else.
• Your sign-in token is encrypted on your phone, with the key stored in the phone's hardware-backed secure storage.
• All traffic is encrypted in transit.
• Changing your password requires your current password, so someone who picks up an unlocked phone can't lock you out of your own account.
• We deliberately don't log the contents of failures, so your study notes can't leak into an error report.

No system is perfect, and we won't pretend otherwise. If we ever discover a breach that puts your information at risk, we'll tell you and the relevant regulator as the law requires.

Your rights

You can ask us to:

• See what we hold about you.
• Correct anything that's wrong — most of it you can edit directly in the app.
• Delete everything — the in-app Delete account button does this immediately, but you can email us instead if you'd rather.
• Send you a copy of your information in a portable format. You can also make one yourself: Settings → Account → Get a copy of my journal.
• Restrict or object to how we use it.

Email hello@ilmjournal.co.uk and we'll respond within one month.

If you're not happy with how we've handled it, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Children

Ilm Journal is not aimed at children under 13, and we don't knowingly collect information from them. If you believe a child has created an account, email us and we'll remove it.

Changes to this policy

If we change how the app handles your information, we'll update this page and change the date at the top. If it's a significant change, we'll say so in the app.

Contact

Shuceeb hello@ilmjournal.co.uk