Effective date: 12 October 2026 Applies to: the Wird apps (com.drobya.wird) and the website wird2.drobya.com. Hosted at: https://wird2.drobya.com/privacy
Wird is a Quran reading and daily-portion (wird) tracking app for phones and tablets, with a guest reader on the web. This policy explains, honestly and completely, what data exists when you use it, where it goes, and how you control it.
The short version: If you never create an account, your reading never leaves your device. The one thing a guest's device asks for over the network is recitation audio you choose to play, streamed from Tarteel's CDN. (On the website, your browser also loads the site itself; see §8.) If you sign in, the reading data you'd expect (your progress, khatmah plan, highlights, notes, and settings) syncs to your own account so it follows you across devices. Wird has no ads, no analytics, no trackers, and does not sell your data or share it for anyone's marketing.
Wird is made and run by Ahmad Droby, an individual developer. He is the controller of the personal data this policy describes: the person who decides what Wird does with it, and who answers for it. To reach him about this policy or your data, use the contact form at wird2.drobya.com/support (§15).
You can use every core feature of the Wird app — reading the mushaf, building a khatmah (completion) plan, tracking your daily portion, highlighting and annotating ayahs, listening to recitation, and receiving reminders — without creating an account.
As a guest, all of your data (reading progress, khatmah plans, highlights, notes, and settings) is stored only in a local database on your device (Wird's local store; see packages/wird_db in the app's source). Nothing is sent to Wird's servers, and there is no background sync of your reading data while you are signed out.
The one network request a guest's app makes is for recitation audio you choose to play or download: your device asks Tarteel's CDN (audio-cdn.tarteel.ai) for that file directly, never through a server of Wird's. That request carries your device's IP address and which reciter and surah you asked for, and nothing about your reading (§5).
Signing in is entirely optional and only useful if you want your reading data to follow you to a second device. Accounts exist in the apps only; the website has none (§8). If you choose to sign in, Wird uses Supabase as its backend (authentication and database) and PowerSync as the sync layer between your device and that backend.
You create an account, and sign in to it, with one of these:
This creates an account record with Wird's backend provider, Supabase: your email address, an internal account ID, and the display name you choose, if any. If you sign in with Google or Apple, the record also keeps what that provider passes on: your name, your email address (with Apple, possibly a private relay address), the link to your profile picture (Google), and the provider's own ID for your account there.
Only the following categories of app data sync to your account, so they are available on every device you sign into:
A few pieces of data are deliberately device-local and never sync, even when you're signed in: your current page/scroll position within the mushaf, the reading pace you set for the reader's hands-free flow, a one-time onboarding-hint flag, and your last-played recitation position/track (so switching devices doesn't interrupt a session with a stale "resume" prompt). The per-device identifier used to keep your reading history correctly ordered across devices is a random ID generated on this device, carried inside your reading-history rows; it does not identify your hardware. This version of Wird makes a new one whenever an account starts or stops holding Wird's data on this device: when that data is cleared, when another account signs in, and whenever an account signs in over data no account holds, such as a guest's, whose reading moves onto the new identifier. So this version of Wird never links two accounts through it on its own, even on a phone restored from another phone's backup. Two things that come from outside this version can. Earlier versions of Wird kept the same identifier on a device for every account signed in there: reading recorded that way keeps it, and a device still running such a version keeps doing it. On a device where that happened, this version goes on using the shared identifier only until the account signed in there next connects, and then replaces it. And a backup file restored into a different account brings its reading with the identifier it was recorded with.
When you are signed in, the sync service (PowerSync, §9) also receives an identifier for this installation of Wird whenever your device syncs. It is a random ID too, kept with Wird's data on this device and not tied to your hardware, and this version of Wird replaces it at the same moments as the identifier above — so it never links two accounts at the sync service either, even on a phone restored from another phone's backup. Earlier versions of Wird kept it for as long as the app stayed installed, so where two accounts signed in on one device running them, the sync service saw one identifier for both; this version replaces that one the next time it replaces the identifier above.
Like any account service, Supabase also keeps a record of signing in: when it happened, the IP address it came from, and the kind of device and software that made it (the "user agent" every request carries). It keeps them as follows:
Wird does not use these records for location, analytics, or tracking; they exist so the account service can run and secure your account.
Signing out clears this device's copy once your latest changes have reached your account. If they cannot upload yet, the copy stays, marked as waiting, until you sign in with the same account — or until another account signs in here, which replaces it. Either way, what has reached your account stays stored there for when you sign back in. When the copy is cleared, the device's identifier is replaced with a new one (§2.2), and what stays on the device is what belongs to it rather than to you: the reading pace you set, the app's language, whether the app has been set up, the one-time hint you have already seen, and downloaded recitations and other content caches. The same rule applies when a session ends on its own, such as when it expires.
You can delete your account from within the app (Settings → Account). This calls a server-side function that permanently deletes your authentication record; because every piece of your synced data is linked to that account, its deletion cascades and removes all of it — khatmah plans, reading history, highlights, notes, and settings — from Wird's backend, and the sync service removes its copy as the deletion reaches it. Deleting your account also clears the app's local copy of that data on the device you deleted it from. Your other devices clear their copy when they next find the session ended, unless they hold reading not yet uploaded, which stays labelled on that device until an account signs in there. This is irreversible.
Wird asks your device for a permission only when you use the feature that needs it. On iPhone and iPad these are the only prompts it can show:
On Android the only prompt is the notifications one, asked the same way.
Wird does not request or collect your location, contacts, camera or microphone. It has no advertising SDK, no analytics SDK, and no crash-reporting SDK — nothing in the app tracks your usage across other apps or websites, and nothing is used for advertising.
Wird can remind you about your daily portion, Friday Al-Kahf, and nightly Al-Mulk readings. These are local, on-device notifications scheduled by the operating system — Wird does not use push notifications and no notification data is sent to or generated by a server. Reminders are off until you turn one on; you control them (on/off and time) in Settings, and the OS notification permission (§3) governs whether they can be delivered at all. The website has no reminders.
Word-level recitation read-along is a core feature of the Wird app. When you play a recitation:
audio-cdn.tarteel.ai, part of the Quranic Universal Library / QUL project) to your device. Your device requests specific reciter/surah files from that server; Wird's own backend is never involved in and never sees this traffic.Streaming a file necessarily sends your device's IP address and a request for that file to Tarteel's servers, the same as any audio-streaming or CDN-hosted media request — this is standard web-request behavior, not data collection performed by Wird. See Tarteel's own privacy terms for how their CDN handles that traffic; Wird is a third-party client of that public CDN and has no visibility into or control over Tarteel's server logs. The website plays no recitation.
Wird lets you share an ayah or a khatmah card (as text or a generated image) using your device's native share sheet. This hands the content to whichever app or service you choose from that sheet (Messages, Mail, another app, etc.) — Wird does not have its own sharing backend and does not see or log what you share or with whom. Choosing Save there puts the image in your photo library (§3).
Wird has a manual backup feature (Settings → Backup & restore) that exports all of your app data on the device (khatmah plans, reading history, highlights, notes, settings) to a JSON file you choose where to save, using your device's own file picker. It works whether or not you are signed in, and it is also how you get a copy of your data: the file is yours, in a portable format (§11). This file is created and stored entirely under your control — Wird does not upload it anywhere. Restoring a backup reads a file you choose in the same way. If you share that JSON file with anyone (e.g., via cloud storage, email, AirDrop), that is your choice and outside Wird's control — the file is not encrypted, so treat it like any personal document.
The website is a guest-only reader. Your reading is kept in this browser's own storage and nowhere else; clearing the site's data deletes it, and some browsers may not keep it — Wird tells you when that is the case. The site is hosted by Vercel, which keeps standard request logs.
In more detail:
Wird is completely free, with no advertisements, no in-app purchases, no subscriptions, and no third-party analytics or advertising SDKs of any kind. Wird does not sell, rent, or share your personal data with third parties for their own marketing or advertising purposes, and does not use your data for any purpose beyond providing the app's own features described above.
These are the services that handle data for Wird, or that your device talks to directly when you use a feature:
audio-cdn.tarteel.ai, §5).Some of these services are based in, or keep data in, a country other than yours — India (Supabase), the European Union (PowerSync) and the United States (Vercel, Google, Apple, Cloudflare) — so using an account, the website or the support form means your data is processed there.
Where data-protection law (such as the GDPR) asks on what basis Wird uses your data, the answers are:
You can export everything Wird holds about your reading (Settings → Backup & restore) — that is your copy, in a portable file. You can correct your name and email in Account, and delete your account and everything linked to it there too (§2.4). For anything else, write to us through the support form (§15). You may also complain to your local data-protection authority.
If you have never signed in, Wird holds nothing about you beyond a support message you chose to send (§15): your reading exists only on your device.
Wird is a general-audience reference/reading app with no age-gated content. It does not knowingly collect personal data from children beyond the same account information any user provides to create an account (an email address and a name, or what Google or Apple pass on), and account creation is never required to use the app.
If Wird's data practices change, this page will be updated and the "Effective date" above revised accordingly. Material changes will also be noted in the app's release notes.
Questions about this policy or your data can be sent through the contact form at wird2.drobya.com/support, which reaches the app's maintainer directly. There is deliberately no email address printed here: a public inbox on a public page is harvested within days, and a form that nobody else can read back is both safer for you and answerable by us. Leave a reply address in the form if you would like an answer.
When you send a message, the form keeps:
The message is stored with Wird's backend provider, Supabase (§9), in an inbox of its own that is linked to no account — so sending one needs no account, and reaches Supabase whether or not you ever sign in. Like any request to Supabase, the send also passes its gateway, which sees your IP address and your browser's user agent and keeps its service logs for the short period its plan sets (§2.3).
To keep spam out, the form is protected by Cloudflare Turnstile, so Cloudflare sees your IP address and the check your browser runs (see cloudflare.com/privacypolicy). Support messages are deleted automatically after 12 months. A message is not linked to any Wird account, so deleting an account does not reach it; to have one deleted sooner, ask through the same form.
This policy describes the data flows of the Wird apps and website as they are built today. The sign-in providers, permission prompts and recitation hosts it names are checked against the app's own code before every release, so none of them can change without this page changing too.