Privacy Policy

Effective Date: May 24, 2026

Last Updated: October 18, 2026

Munabook ("Munabook", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our websites, mobile applications, tutoring services, learning tools, community features, and connected third-party services (collectively, the "Services").

Munabook is an independent product and is not an official application of Quran Foundation. Where applicable, Munabook uses Quran Foundation APIs and may access content from the Quran.com domain and QuranReflect ecosystem in accordance with applicable third-party terms, policies, and technical requirements.

1. Who We Are

Munabook operates Quran learning and related educational services through the following entities:

2. Scope of This Policy

This Privacy Policy applies to our websites, mobile apps, tutoring marketplace, booking and payment flows, messaging and class features, Quran study tools, reflection features, and integrations with third-party accounts and APIs, including connected apps and OAuth-based services where applicable.

Where this Privacy Policy refers to Quran Foundation, "QF Content" means Quran text, translations, metadata, audio, reflections, and other content made available through the relevant APIs or related services.

3. Information We Collect

3.1 Information You Provide to Us

3.2 Information Collected Automatically

3.3 Information from Device Permissions

Depending on the features you use, we may request access to:

After you consent and grant access, the app may refresh your contact indexes silently on first use and, once approximately seven days have elapsed since the last attempt, when you next open or return to the app with your Munabook account signed in. Manual refreshes and changes to the contacts allowed by limited access may require an earlier refresh. A completed sync replaces your previous indexes; a failed sync does not replace the last complete version. Contact changes on your device reach our server when a later sync completes.

Stored indexes let us suggest people who join later without requiring you to reopen the app. Suggestions may appear to both people, even if only one has synced contacts. We show public account information. For eligible email-source matches, both people can see each other's full verified matching email address, including a person who has not synced contacts. This applies only while the verified-email aliases and discoverability conditions permit the match. Phone- and Facebook-source suggestions do not include an email address. We do not show the other person's saved contact names, phone numbers, or which address book supplied a suggestion. A match does not automatically make you friends or permit a private chat; you can send or accept a friend request, or dismiss a suggestion. Suggestions respect account discoverability settings, blocks, dismissed suggestions, and ended friendships. Unverified phone numbers remain possible matches for the person searching their own contacts; they do not trigger reciprocal suggestions when a new account registers.

For a newly registered account with a verified email address, email-based discoverability is initially enabled and can be turned off in friend discovery settings. This does not change existing users' disabled preferences or turn on phone-based discoverability. A new suggestion may produce a grouped notice in the existing in-app inbox; this feature does not automatically send emails, SMS messages, or push notifications.

You can turn contact discovery off at any time. Turning it off, or the app detecting withdrawn contacts permission, stops further contact reads and uploads, clears the local cache, and requests deletion of your server contact indexes. Server deletion is complete only after the server confirms it; if the request cannot reach the server, deletion must be retried. Logging out clears only the local cache and does not withdraw your consent to keep server indexes. Existing friendships and chats are preserved separately.

Contact invitations use our existing referral invitation link and open an editable SMS or email draft addressed to the phone number or email address you select from a contact. You can edit the draft and decide whether to send it in the messaging or email app. Munabook does not read your SMS messages or send these invitations automatically. Opening or cancelling a draft is not treated as a sent invitation, registration, or earned reward.

3.4 Information from Third Parties

4. How We Use Information

We use personal data as necessary to operate, improve, and protect the Services, including to:

We collect and use only the minimum data reasonably necessary for the features we provide. We do not use QF user data or similar learning data to build advertising profiles. We do not sell, rent, mine, or repurpose such data for unrelated commercial uses. We do not use user reflections, notes, or other user-generated devotional content to train AI models without a separate and explicit user consent process.

5. Sensitive Religious Data

Quran reading activity, reflections, devotional notes, and similar information may reveal a person's religious beliefs or practices and may be treated as sensitive personal data under certain privacy laws.

We treat this category of data with heightened care. We process it only to provide the religious and learning features you choose to use and, where required by applicable law, on the basis of your explicit consent or another valid legal basis permitted by law.

6. Connected Apps, OAuth, and Quran.Foundation Integrations

Some Munabook features may allow you to connect a third-party account or service, including Quran.Foundation services, through an authorization flow such as OAuth 2.0.

If you disconnect a connected service, some synced features may stop working or may no longer update going forward. Disconnecting does not automatically delete content previously stored in your Munabook account unless you separately request deletion where applicable.

For Quran Foundation-connected sessions, users may also be able to end the connected session and revoke associated tokens via the Quran Foundation OpenID Connect logout flow described here: https://api-docs.quran.foundation/docs/oauth2_apis_versioned/revoke-oidc-session/.

Facebook friend discovery is not currently enabled for general use. Where this optional feature becomes available, only your explicit Find action starts the provider authorization needed for friend discovery; signing in with Facebook does not by itself authorize this feature. Facebook can provide only the limited set of friends who use the same Facebook app and have granted the required permissions, subject to Facebook's rules. This does not provide your complete Facebook social graph or a list of friends who have not registered with Munabook. We do not obtain Facebook friends' phone numbers or email addresses to address invitations. Facebook-related invitations use the existing referral link through the system share sheet, where you choose the recipient, edit where supported, and decide whether to send; they are not sent automatically.

7. Legal Bases for Processing

Where required by applicable law, we process personal data on one or more of the following bases:

8. How We Share Information

We do not sell your personal data. We may share personal data only as reasonably necessary with:

We require our service providers and data processors, by contract where applicable, to protect user data, use it only for authorized purposes, and not misuse Quran or Quranic text. Where a third party processes user data on our behalf, we seek to ensure that appropriate data protection obligations are in place.

9. International Data Transfers

We may process and store information in countries other than your own, including the Singapore and other jurisdictions where our service providers operate. Where required, we take reasonable steps to ensure appropriate safeguards are in place for cross-border data transfers.

Where required, we rely on legally recognized transfer mechanisms, including Standard Contractual Clauses or equivalent safeguards, and we remain responsible for complying with applicable local data protection and transfer laws in the jurisdictions where our users are located.

10. Data Retention

We retain personal data for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements, and maintain security and business records.

Retention periods may vary depending on the type of data, the feature involved, the sensitivity of the data, and our legal or operational requirements.

After the contact-sync consent described in Section 3.3, we retain keyed contact matching indexes (HMAC), linked to the syncing account, until you turn off this feature or account deletion is completed. They are not anonymous data. We do not retain your uploaded phone numbers and email addresses as a plaintext address book, nor store the names or native contact identifiers from your device. Submitted values are normalized and used to calculate the indexes during request processing; infrastructure may temporarily buffer them. Diagnostic records remain subject to this policy's retention and deletion provisions.

Each successful complete sync replaces your previous contact indexes. Turning contact discovery off or withdrawing contacts permission requests their deletion, as described in Section 3.3. Logging out clears device data only; the stored indexes may still be used to generate later suggestions. Completing account deletion removes these indexes from live matching storage. We also retain your dismissed-suggestion choices so a later match does not repeatedly suggest the same person; these do not create a friendship. The device cache and your own account-discovery source records below are separate from uploaded contact indexes.

Account-discovery records for your own account sources include keyed lookup hashes (HMAC), masked contact hints, and source-proof and consent-revision information. These hashes remain linked to your account; they are not anonymous data. Turning off discoverability for an account source or withdrawing consent for that source stops it from being used to find your account. Turning off contact discovery in Section 3.3 instead stops your device's contact reads and uploads and deletes your uploaded contact indexes after server confirmation. It does not erase your own account-source records or existing friendships and chats.

Requesting account deletion starts a seven-day cancellation period. After that period expires and account deletion is completed, associated account-discovery records are removed from live matching storage as part of account cleanup. This does not mean that every diagnostic or backup record related to a previous request is immediately deleted. You can also request data deletion without deleting your account through the privacy contact in Sections 15 and 17; the general retention and deletion provisions in this section apply.

If you request deletion of your Munabook account, we will begin the deletion process within a reasonable time. Where technically and legally feasible, data will be removed from live systems first and then aged out of backups according to our backup retention process. If a connected provider independently deletes its own account or revokes access, some associated synced data may no longer remain available through connected features.

11. Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include encryption in transit, access controls, logging, monitoring, and periodic security reviews.

No system is completely secure, and we cannot guarantee absolute security.

Our security program is designed to reflect industry-standard practices such as TLS for data in transit, encryption-at-rest where appropriate, least-privilege access controls, and a regular secret rotation process. Our incident response objective is to investigate actual or suspected unauthorized access promptly and, where a QF-connected incident is involved, to escalate and report it without undue delay and in line with applicable contractual or platform requirements, including Security Rule 6.9 where applicable.

12. Cookies and Similar Technologies

We and our service providers may use cookies, SDKs, local storage, pixels, and similar technologies to keep you signed in, remember preferences, measure traffic, improve performance, detect abuse, and understand how users interact with the Services.

You may control cookies through your browser settings. Some features may not function properly if cookies are disabled.

13. Third-Party Services

Our Services may link to or integrate with third-party websites, apps, tools, APIs, payment processors, identity providers, video or communication platforms, analytics services, and connected platforms. We are not responsible for the privacy practices of third parties, and we encourage you to review their own privacy policies.

Depending on the services you use, relevant third parties may include Quran Foundation, app stores, payment processors, cloud hosting providers, analytics providers, communications or video providers, and customer support tools. Their handling of data is governed by their own policies and contractual arrangements with us, where applicable.

14. Children's Privacy

Our Services may be used by learners of different ages, including minors, under the supervision, consent, or involvement of a parent, guardian, school, or other authorized adult where required by law. We do not knowingly collect personal data from children in violation of applicable law. If you believe that a child has provided personal data unlawfully, please contact us and we will review the matter.

15. Your Rights

Depending on your jurisdiction, you may have rights to:

To exercise your rights, please contact us at jimmylee@sunshingnetwork.com. We may take reasonable steps to verify your identity before responding.

We aim to respond to privacy-related requests within 30 days, subject to lawful extensions where permitted and reasonably necessary.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and, where required, provide additional notice. Your continued use of the Services after the updated policy becomes effective means that the updated policy applies.

Where appropriate, we may notify users of material changes through in-app notice, account messaging, email, or other reasonable means.

17. Contact Us

If you have any questions, requests, or complaints regarding this Privacy Policy, please contact: