Privacy Policy

MKH is operated privately by its owner. Questions, access requests, corrections and deletion requests can be sent to khisaund2@gmail.com. Signed-in members can also submit a request from Your information.

We collect only what MKH's features need in order to work:

• Account information — your name (as you enter it) and your email address. Your password is handled by our authentication provider and is stored only as a cryptographic hash; MKH never sees or stores your password.
• Organization membership — which MKH organization(s) you belong to, your role there (student, admin, owner) and when you joined.
• Memorization and study records — assigned segments, revision, current surah revision, marked completions, pages/ayat progress, mistake marks made by your teacher, badges, journey progress and competition participation.
• Assessment records — test scores and official Qur'an test scripts, including the questions asked, the marks your examiner awarded, mistake annotations and examiner notes.
• Attendance and day-off records — whether you completed the day's tasks, day-off states and exclusions from a roster.
• Messages and posts — chat messages you send inside your organization, reports you submit to your teacher, announcements you acknowledge, and messages and reactions you choose to share in Penguin World.
• Voice room information — that you joined a live or voice room, when you joined and left, invitations sent to you, and (if you record one) a short introduction voice note you choose to upload.
• Moderation records — actions taken by an organization's admins, such as removing a member, hiding a message or excluding someone from a roster.
• Notification information — if you turn on notifications, a push subscription for that browser/device, and your per-organization notification choices.
• Gender — collected only where a feature separates male and female voice rooms, and used only to route a person to the correct room.
• Technical information — our hosting, database and voice providers process ordinary connection information such as IP address, browser/device type and timestamps in their service logs, for security and reliability.
• Error reports — if the app fails, a technical error report (page, error message, stack trace) may be recorded so it can be fixed.

We do not collect payment information, we do not run advertising, we do not build advertising or marketing profiles, and we do not sell personal information.

• To create and secure your account and sign you in.
• To run the memorization features: assignments, revision, progress, rankings, badges and competitions.
• To let your teacher assess you and keep an official record of that assessment.
• To let you communicate inside your organization and join its voice rooms.
• To send notifications you have asked for, including task reminders.
• To protect the platform: preventing unauthorized access, abuse and misuse.
• To fix errors and keep the service working.

When you create an account you are asked to affirmatively agree to this policy and to the Terms of Service. We record which version you agreed to and when. Notifications are off until you turn them on, and can be turned off per organization or entirely at any time. You may withdraw consent by asking us to close your account, subject to the retention rules in section 8.

• Other members of your organization can see your name, your progress on shared boards (leaderboards, rosters), your badges and the messages you post there.
• Verified MKH members from other organizations can see only your profile name, penguin appearance, current Penguin World room, movement, reactions and the lobby messages you choose to post. They cannot see your email address, phone number, circle, study records, reports or assessments through Penguin World.
• Your organization's admins can additionally see your study records, completions, reports and assessment records for that organization.
• Confidential contact and account details, including email addresses and phone numbers, are not shown to students or circle admins. They are visible only to the platform owner, to you for your own information, and to service providers that need them to operate the service.
• Official test scripts, examiner notes and mistake annotations are visible to your examiner and the owner. You see your own result only to the extent your examiner allowed (result only, per-surah breakdown, or the full marked paper).
• The platform owner can access records across organizations in order to administer the platform and respond to privacy requests.

MKH uses the following categories of processors. They receive only what they need to provide their service, and are not permitted to use it for their own purposes:

• Application hosting and delivery (Lovable and its infrastructure providers) — serves the website and processes connection logs.
• Database, authentication and file storage (Supabase) — stores your account, study records, messages and uploaded files.
• Real-time voice (LiveKit) — carries live and voice room audio and connection metadata while a room is in use.
• Transactional email — sends account emails such as sign-up confirmation and password reset, from our own MKH sending domain.
• Web push delivery (the push service of your browser or device, for example Apple, Google or Mozilla) — delivers notifications you enabled.
• Qur'an text (the Qur'an.com API) — supplies verified Qur'anic text. No personal information is sent to it.

Some of these providers operate outside Canada, which means information may be stored or processed in other countries (including the United States) and may be subject to the laws of those countries.

We do not sell or rent personal information. We disclose it only: to the service providers above; to you or people you have chosen to share with inside your organization; where required by law or valid legal process; and where necessary to protect the safety, rights or security of MKH members or the platform.

• Account and organization membership — while the account is active, and until deletion is requested and completed.
• Memorization, attendance and progress records — kept while your account is active because they are the record of your memorization.
• Test scores and official test scripts — kept as an assessment record. Completed official scripts are intentionally immutable historical records and are corrected only by an authorized examiner.
• Organization chat messages — kept while the organization exists, unless removed by a moderator or on request. Penguin World messages are visible in the app for up to 24 hours; moderation and backup copies may remain longer where needed for safety, legal compliance or abuse prevention.
• Voice room information — the audio itself is not recorded; participation records are kept as short-lived operational records.
• Notification subscriptions — until you turn notifications off, or the device token stops working (dead tokens are deleted automatically).
• Moderation records — kept while needed to administer the organization.
• Security, error and provider logs — kept for a short period by our providers under their own retention settings.
• Deleted accounts — when an account is deleted, the account, contact details and profile are removed. Records that MKH must keep for its own legitimate purposes (for example an organization's assessment history) may be retained; what is kept is decided per request and explained to you.

• All traffic is served over HTTPS/TLS in production.
• Data is stored with providers that encrypt data at rest.
• Passwords are never stored in plain text; authentication is handled by our provider.
• Access to every record is enforced on the server and in database row-level security policies, not merely hidden in the interface.
• Voice room access tokens are generated on the server only after your membership and permissions are verified.
• Privileged keys (service keys, voice API secrets, notification keys) are stored as server-side secrets and are never included in the code sent to your browser.
• Passwords, tokens and private message contents are not written to application logs.

No online service can promise perfect security, but we work to protect information with safeguards appropriate to its sensitivity.

MKH does not use advertising or tracking cookies, and does not run third-party analytics or marketing trackers. We use strictly necessary storage only: your sign-in session (stored by your browser so you stay signed in), and small local settings such as whether you dismissed a prompt or turned on notifications. Clearing your browser storage signs you out.

MKH is used by young memorizers. A person under the age of majority may use MKH only with the knowledge and consent of a parent or guardian, and we ask for that confirmation at sign-up. We collect the same minimal information from younger members as from adults, and we do not profile or track them for advertising. A parent or guardian may contact us at khisaund2@gmail.com to review, correct or delete their child's information.

• Account emails — sign-up confirmation, password reset, email change and similar messages needed to operate your account. These are sent from our own MKH sending domain and cannot be switched off while your account exists.
• House announcements from the owner — the platform owner may email everyone in MKH (or only admins, or only students) with news, reminders and encouragement about the memorization programme. These are sent one message per recipient; other members' addresses are never revealed to each other.
• Replies to you — if you contact us or submit an inquiry, we reply by email to the address you gave, or to your inbox inside the app.
• No marketing, no sharing — we do not send advertising, we do not send messages on behalf of third parties, and we never sell, rent or share your email address for marketing.
• Opting out — to stop receiving house announcements, reply to any of them or write to khisaund2@gmail.com. You will still receive the account emails described above.

Wherever you live, you may ask us to do the following with the personal information we hold about you, and we apply these rights to every member regardless of location:

• Access — get a copy of your information, and know how it is used and who receives it.
• Portability — receive your own records in a machine-readable file (available instantly from Your information).
• Correction — have inaccurate or incomplete information fixed.
• Deletion / erasure — have your account and information deleted, except where we must keep something for a legal or legitimate documented reason, which we will explain.
• Restriction and objection — ask us to pause or stop a particular use of your information.
• Withdraw consent — at any time, for anything based on consent (for example notifications), without affecting past lawful processing.
• Non-discrimination — we never reduce your access to MKH, or treat you differently, because you used a privacy right.
• Complain — raise a concern with us first, and with your data protection authority if you are not satisfied.

Signed-in members can submit and track requests, and download their own records, at Your information. Anyone can write to khisaund2@gmail.com. We answer within 30 days (and within 45 days, extendable once, where US state law sets that period). Requests are free unless they are excessive or repetitive. We may need to confirm your identity before releasing information, and we will only use what you send for that purpose. If we refuse a request in whole or in part, we tell you why and how to appeal or complain.

Where the EU/UK General Data Protection Regulation or a similar law applies, we rely on these bases:

• Contract — to give you the account, organization, assignments, progress records and voice rooms you signed up for.
• Consent — notifications, any voice note you choose to upload, and a parent or guardian's consent for a young member. Withdrawable at any time.
• Legitimate interests — keeping MKH secure, preventing unauthorized access and abuse, fixing errors, and keeping an accurate assessment record. We balance these against your rights, and use the minimum information needed.
• Legal obligation — where a law or valid legal process requires us to keep or disclose something.

We do not use your information for advertising profiles, and we do not make decisions about you by automated means alone. Rankings, badges and leaderboards are simple records of what was marked complete by you or your teacher, never automated judgements with legal effects.

MKH is operated from Alberta, Canada, and our providers operate data centres in Canada, the United States and the European Union. This means your information may be transferred to, stored in and processed in a country other than your own, where different laws — including lawful access by public authorities — may apply.

• Transfers out of the EEA, the UK and Switzerland are made under the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss equivalent), or to a country with an adequacy decision.
• Transfers out of Canada are made under written contracts requiring comparable protection, as PIPEDA and Alberta's PIPA require.
• Transfers of Brazilian, Australian, South African, Emirati, Saudi, Indian and Turkish members' information are made under equivalent contractual safeguards required by those laws.
• Providers act only on our instructions, may not use your information for their own purposes, and are bound to confidentiality and security obligations.

You may request further information about the safeguards for transfers relevant to you, and a copy of the relevant clauses, at khisaund2@gmail.com.

• Canada (PIPEDA and Alberta PIPA) — we collect, use and disclose personal information only for the purposes described here, with your knowledge and consent. You may complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
• European Economic Area, United Kingdom and Switzerland (GDPR, UK GDPR, FADP) — MKH is the controller of your information. We have not appointed a Data Protection Officer because we are not required to, and our privacy contact is the owner at the address above. You have the rights in section 13, including the right to lodge a complaint with your national supervisory authority (in the UK, the Information Commissioner's Office).
• United States (CCPA/CPRA, Virginia, Colorado, Connecticut, Utah, Texas and similar laws) — in the past 12 months we have not sold personal information, have not shared it for cross-context behavioural advertising, and have not used sensitive personal information for inferences or profiling. We do not offer financial incentives for information. You may exercise the rights in section 13, use an authorized agent, and appeal a refusal by replying to our decision; if your appeal is denied you may contact your state attorney general.
• Brazil (LGPD) — you also have the rights to confirmation of processing, anonymization or blocking of unnecessary data, and information about sharing. Our controller contact is the owner at the address above.
• Australia (Privacy Act and APPs) — we handle personal information in line with the Australian Privacy Principles, and you may complain to the Office of the Australian Information Commissioner.
• South Africa (POPIA), UAE, Saudi Arabia (PDPL), India (DPDP Act), Turkey (KVKK), Japan (APPI), South Korea (PIPA), New Zealand, Nigeria and Kenya — we apply the same rights, purpose limits and security measures described in this policy, and respond to requests made under those laws.

We monitor for unauthorized access and abuse, throttle and temporarily block connections that behave abusively, and keep privileged keys on the server only. If a breach of security safeguards creates a real risk of significant harm, we will notify affected members and the relevant privacy authorities without undue delay — within 72 hours of becoming aware of it where GDPR-style rules apply — and tell you what happened, what information was involved, and what you should do.

If this policy changes, the version number and effective date above change with it, and members may be asked to review the updated policy. Material changes are announced inside MKH before they take effect.