Privacy policy

1. Who is responsible, and how to contact us

The controller responsible for the processing described in this policy (Art. 4(7) GDPR) is the operator of Q19 named above. The same details appear on the seller information page (Impressum).

For questions about your data or to exercise your rights, contact support@q19.ai.

Privacy contact: Privacy requests are handled by the operator at support@q19.ai; no separate data protection officer contact is published.

2. Overview

Q19 is a website for studying the Qur'an: a reader, search, subject pages, a research canvas, a Research Hub, and Ask Q19, which writes answers with AI models from Q19's library and index. Without an account you can see Q19's public pages and a short demo; the platform itself needs a free account, and some features need a paid plan.

This policy covers these kinds of personal data:

• Connection data: IP address, browser and device details, time and requested address.
• Account data: email address, password hash or sign-in provider identity, display name, settings and plan.
• Research data: bookmarks, notes, annotations, collections, canvases, reading history and Ask Q19 conversations.
• Usage and billing data: AI usage counts and costs, subscription status and Stripe references.
• Communication data: emails Q19 sends you, and withdrawal or cancellation declarations you submit.
• Device storage: cookies and browser storage, described in section 13.

3. Hosting and server logs

Q19 runs on a server rented from netcup GmbH, Karlsruhe, Germany, on a European hosting plan. The precise data-centre country has not yet been independently verified. The databases that hold accounts, research and temporary data run on that server and are not reachable from the internet; only Q19's web server accepts connections. The hosting provider processes data on Q19's behalf under a data processing agreement (Art. 28 GDPR).

For each request, Q19's server records only the time, the method (for example GET), the general route that was called (for example /api/v1/verses/:id, not which verse), the response status and how long it took. It does not record your IP address, your search terms or any other part of the address after "?", or what you send. Q19's web server (reverse proxy) keeps no access log. Q19 also records technical errors, and in some events your account id (for example when a password reset or an email confirmation is completed, or when a digest is sent).

If Q19's safety filter removes text that looks like an attempt to manipulate the AI from a question to Ask Q19, only the kind of text removed and the length are logged, never the question.

Purpose and legal basis: running Q19 securely, finding and fixing errors, and detecting attacks. This is Q19's legitimate interest (Art. 6(1)(f) GDPR). You can object to it (section 19).

Retention of server logs: 7 days at the latest.

4. Your account

You need an account to use the Q19 platform (the reader, search, research tools and Ask Q19). Q19's public pages and the demo work without one.

5. Saved research, reading history and conversations

If you have given your explicit consent (see the box below), Q19 keeps in your account:

• Bookmarks (verse, tags, your note), annotations (verse, your text, tags, colour), collections (name, colour, description), research notes (title, your text, verse reference, pinned) and canvases (name, the verses and links on it, whether it is shared), each with the time it was created or changed. You can delete each of them yourself, or all of them at once in Account › Privacy.
• Reading history: each time a verse stays in view for about 1.5 seconds, Q19 records the surah and verse and the time. It powers Continue reading and the history in the Research Hub. Reading history is recorded only if you have given consent and reading history is switched on in Account › Privacy. It is on by default once you consent, you can switch it off at any time, and you can delete it in Account › Privacy.
• Ask Q19 conversations are saved to your account only if you have given consent and chat history is switched on (on by default once you consent; you can switch it off in Account › Privacy). A saved conversation has a title (the first 60 characters of your first question), the verse it refers to if any, every question and answer, and details of each answer such as its sources and the model that wrote it. You can delete a conversation in Ask Q19. Answers work either way.

Without consent you can still read, search, study subjects, use the analysis tools and ask Q19, and you can save bookmarks, notes, collections and canvases on your device. Q19's server then stores none of this research data, and Ask Q19 conversations are answered but not saved.

If you share a canvas, other signed-in members whose plan includes canvas sharing can open it through its link. Your name and account id are not shown with it.

Some of your work is also kept in your browser (section 13).

6. Ask Q19 and other AI features

Ask Q19 is available to signed-in members whose plan includes AI answers; on the free Reader plan your email address must be confirmed first. Answers are written by an AI model, can be wrong, and are labelled with the model that wrote them.

7. Payments

Paid plans are sold through Stripe Checkout and managed in Stripe's billing portal. Q19 sends Stripe your email address and your Q19 account id as a reference. On Stripe's page you enter your payment method, your name and a billing address (required), and a tax ID if you wish. Q19 never receives your card or bank details.

Q19 stores your Stripe customer id, your subscription (id, plan, status, current period, cancellation), and each checkout you start (its id, the price and Stripe's session id, with the time). Stripe tells Q19 when a subscription changes, and Q19 then reads its current state from Stripe. Q19 keeps the id and type of each such notification for 90 days, so that it processes each one only once.

Stripe: Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, Ireland. Stripe processes payment data on Q19's behalf to provide the payment service. For fraud prevention, anti-money-laundering and identity checks and its own billing, Stripe acts as an independent controller under its own privacy policy. Stripe keeps invoices and payment records as tax and commercial law require.

Legal basis: performing your subscription contract (Art. 6(1)(b) GDPR) and Q19's legal duties to keep invoices and accounting records (Art. 6(1)(c) GDPR with § 147 AO and § 14b UStG and, where Q19 is a merchant (Kaufmann), § 257 HGB).

8. Emails

Q19 sends emails through Resend (Plus Five Five, Inc., San Francisco, USA), which receives the recipient address and the content of each email as Q19's processor. Q19 sends:

• Account emails: the confirmation link and password reset links (section 4). Legal basis: Art. 6(1)(b) GDPR.
• Receipts and outcome notices for withdrawal and cancellation declarations, to the address you give in the form (section 9). Legal basis: Art. 6(1)(c) GDPR.
• The weekly digest, only if you switch it on in Account and your email address is confirmed. It contains a featured verse, how many bookmarks you have (not which verses) and the newest topic. Every digest has an unsubscribe link, which does not expire; you can also switch it off in Account. The unsubscribe page does not show your address. Q19's operator can send a single test digest to check how the email looks, but only to the operator's own address or to an account that has switched the digest on and confirmed its email address. When a digest is sent or you unsubscribe, Q19's server log records only your account id, not your email address; these entries are deleted after 7 days at the latest (section 3). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Operational alerts to Q19's operator, which contain no visitor data.

Q19 does not send newsletters or advertising other than the weekly digest you choose.

9. Withdrawal and cancellation declarations

The withdrawal form (/v3/withdrawal) and the cancellation form (/v3/cancel-subscription) work without signing in. Q19 stores what you enter (name, email address, contract reference, type of cancellation, requested end date and reasons where needed), your language, the time it was received, a fingerprint (hash) of the declaration and the receipt text, which repeats these details. The receipt is emailed to the address you give; Q19 retries the delivery if it fails. When Q19 has processed your declaration, it records the outcome, the time and the person who handled it, and emails you the outcome.

To prevent misuse, at most 3 receipts a day are emailed to the same address automatically (counted under a keyed hash of the address, not the address itself); further receipts, and receipts above an overall hourly limit, are held until Q19 has checked them. Each IP address can submit 10 forms an hour.

These records are not linked to your account and are kept after an account is deleted, because they prove your declaration. Legal basis: Art. 6(1)(c) GDPR with §§ 312k and 356a BGB, and the establishment or defence of legal claims (Art. 6(1)(f) and 17(3)(e) GDPR). Retention: 3 years from the end of the year in which Q19 received them (the limitation period, §§ 195, 199 BGB), together with the emails sent about them; longer only while a declaration is still being handled or an email about it has not been sent.

10. Invitations (referrals)

Members can share a personal invitation link. Opening one sets no cookie and stores nothing on your device: the link opens the registration page with the inviter's code in the web address, and the page removes the code from the address bar straight away, so it is not passed to analytics. If you then create an account, with email and password or with Google, Apple or Microsoft, Q19 records who invited you. When you use Google, Apple or Microsoft, the code is kept only on Q19's server during that sign-in (at most 10 minutes) and is not sent to the provider.

The inviter sees only how many people created an account through their link, and only once at least 3 have; never who they are, which plan they have or whether they pay. Q19's operator sees inviters' email addresses and how many of the people they invited have a paid plan, and grants rewards (a free month of the Study plan for every 3 invited people with a paid plan) by hand as Stripe discount codes sent by email. A reward therefore tells the inviter that at least 3 of the people they invited pay for Q19; if exactly that many joined through the link, the inviter can infer that each of them pays.

If the inviter deletes their account, the link to them is removed. Legal basis: Q19's legitimate interest in crediting the member who invited you (Art. 6(1)(f) GDPR). Q19 sets no cookie for invitations.

11. API keys

API access is not part of any current plan. If you have an API key, Q19 stores its name, a hash of the key, its first 12 characters, when it was created and last used, and when it was revoked. The key itself is shown only once. Revoked keys stay listed until your account is deleted. A password reset, or linking a Google sign-in, revokes all keys. Legal basis: Art. 6(1)(b) and (f) GDPR.

12. Security and abuse protection

Q19 uses encrypted connections (TLS). Passwords are stored only as bcrypt hashes; refresh tokens, reset codes and API keys only as hashes. The sign-in cookie cannot be read by page scripts. The databases are not reachable from the internet.

To protect Q19 against overload, abuse and runaway costs, Q19 counts requests per IP address and, for signed-in members, per account id. Each counter is deleted when its time window ends: 60 seconds for most requests, 1 hour for withdrawal and cancellation forms, account deletion and data downloads. Plan allowance and spending counters per account are kept for up to 40 days and are deleted when you delete your account. These counters are held in a fast data store that is also written to disk.

Q19's operator, and administrators the operator names, can see for support, billing and misuse: the email addresses of the accounts with the highest AI costs, the email addresses of inviters, and cost and quality dashboards. The server operator has technical access to the databases and logs.

Q19 makes nightly backups of its whole database, stores them on the same server and keeps them for up to about 4 months. Data you delete stays in older backups until they are removed in rotation, and is not restored into the live service.

Legal basis: Q19's legitimate interest in a secure, available and affordable service (Art. 6(1)(f) GDPR); the measures also serve Q19's duty to keep data secure under Art. 32 GDPR (Art. 6(1)(c) GDPR). You can object (section 19).

13. Cookies and device storage

On your first visit Q19 asks for your choice. Accept all and Reject all are offered with equal weight, next to Customize; nothing optional is stored or loaded before you choose. Your choice is kept in the q19_consent cookie on your device for 12 months; Q19 does not keep a copy on its servers.

The cookie banner and the settings dialog are available in English, Arabic and German; they follow the language of this page, an Arabic interface, or a browser set to German. The banner names Google Analytics and the possible processing in the USA, and links to this policy and the Impressum.

What is stored on your device

Every cookie and storage entry Q19 or Google may set, by category.

14. Analytics with Google Analytics (optional)

Google Analytics is currently disabled on q19.ai. The following describes the optional analytics functionality, which requires both configuration by Q19 and your consent before it can operate. Google Analytics is not active on the public website; no acceptance of Analytics processing terms is claimed here.

Data: the type of page you visit (the address reduced to its template, for example /v3/read/:surah/:ayah or /v3/subject/:slug, with the page type as title; never which verse, surah, subject, lecture or source), the Q19 features you use and their outcome (for example "search", "verse read" or "added to canvas", with counts, the search mode and whether it worked), device type, browser, screen size, language, the region Google derives from your IP address, the referring website (reduced to its domain), and a random identifier in the _ga cookie. Your IP address is transmitted to Google for this; according to Google, Google Analytics 4 does not store it. Of what you type into a search box, only its writing system (Arabic, Latin, digits), a length range (for example 3 to 5 characters) and the kind of query (for example a verse reference or a root) are sent; never the text itself.

Also sent: your plan (visitor, free, a paid plan, or operator), whether you are signed in, your reading persona, interface and content language and theme, and, when you buy a plan, the plan, billing interval, price, currency and a one-way hash of the payment session (never the payment details).

Never sent: which verses, surahs, roots or words you read or search for, which subjects, topics, scholars, lectures, claims or sources you open, your name, email, user id, questions, notes or any search text. Google signals and ad personalisation are off.

Retention in Google Analytics: Not applicable to the current public website: Google Analytics is disabled and Q19 sends it no analytics events.

Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. Q19 sends Google Analytics nothing about which verses, roots, subjects, scholars, lectures or sources you study.

Google LLC (USA) may process this data. Safeguard: No Google Analytics transfer takes place on the current public website. Optional Google sign-in is separate and follows Google’s privacy policy.

15. External content and embeds

Fonts are served from Q19's own server; your browser does not contact a font service.

Recitation audio and manuscript photographs are loaded from Q19's own servers. When you play a recitation (Q19 also loads the next three verses in advance so that playback continues smoothly) or view a manuscript photograph, your browser requests the file only from Q19. Q19's server fetches the file from its source the first time it is needed and keeps a copy in a size-limited cache on Q19's server, removing the least recently used files first. The sources are:

• Recitations: everyayah.com.
• Manuscript photographs: Corpus Coranicum (Berlin-Brandenburg Academy of Sciences and Humanities, Germany), the Staatsbibliothek zu Berlin (Germany), OPenn (University of Pennsylvania Libraries, USA) and The Metropolitan Museum of Art (USA).

These sources receive only Q19's server request: the server's IP address, a fixed Q19 user agent and the file's path, which names the reciter and verse, or the photograph. They do not receive your IP address, cookies, browser details, the page you were reading or anything about your account. Because cached copies are reused, a source learns at most that a file was needed, not by whom or how often.

Your request to Q19 for these files is handled like any other request to Q19 (server logs, section 3). The file address carries a time-limited signature (valid for 12 to 18 hours) that is the same for every reader and does not identify you. To stop abuse, Q19 counts these requests per IP address in a counter that expires after 60 seconds. Legal basis: Art. 6(1)(b) GDPR (providing the reader and manuscript features you use); for the request counter, Q19's legitimate interest in protecting the service (Art. 6(1)(f) GDPR, section 12).

The citation links on manuscript cards (the original catalogue record and the licence) are ordinary links to the institutions' websites. They open only if you click them; the website then receives your IP address and browser details, but not the address of the Q19 page (no referring address is sent).

External reference links open third-party websites. Their privacy policies apply when you visit them.

Verse cards embedded on other websites load from Q19's server in an isolated frame, without cookies, device storage or analytics. Q19's server receives the visitor's IP address, browser details and the embedding site's address, and uses them only to deliver the card; its logs keep only what section 3 describes. Legal basis: Art. 6(1)(f) GDPR.

16. Recipients and processors

Q19 does not sell personal data and does not share it for advertising. Data goes only to the recipients below, and to authorities where the law requires it (Art. 6(1)(c) GDPR). The sources of recitation audio and manuscript photographs receive no personal data about you (section 15).

17. Transfers outside the EU

Q19's own servers are at netcup GmbH, Karlsruhe, Germany, on a European hosting plan. The precise data-centre country has not yet been independently verified. Some recipients are in the USA or belong to US groups: Together AI, Anthropic, OpenAI, Google, and possibly Stripe, the email provider, Microsoft and Apple. The sources of recitation audio and manuscript photographs, some of them in the USA, receive no data about you, because Q19's server fetches those files (section 15).

For the recipients in section 16 to which Q19 itself sends data (its processors and Stripe), Q19 relies on a safeguard under Chapter V GDPR: either the recipient is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR), or Q19 has agreed the European Commission's standard contractual clauses with it (Art. 46(2)(c) GDPR). The safeguard for each recipient is in the table in section 16. You can ask for a copy of the standard contractual clauses at the contact address in section 1.

18. How long data is kept

The table below lists the current retention periods. Where no fixed period is given, data stays until you delete it or your account.

Expired data is deleted in a monthly clean-up, so deletion can happen up to one month after a period ends. Database backups contain deleted data for up to about 4 months, until they are overwritten.

Q19 does not currently delete inactive accounts automatically.

19. Your rights

Under the GDPR you have the right to:

• access the data Q19 holds about you and receive a copy (Art. 15);
• have incorrect data corrected (Art. 16);
• have your data erased (Art. 17);
• have its processing restricted (Art. 18);
• receive the data you provided in a common machine-readable format, or have it sent to another provider (Art. 20);
• withdraw any consent at any time, with effect for the future (Art. 7(3)).

In Account you can download your data and delete your account yourself, and in Account › Privacy you can withdraw your research-data consent, switch reading or chat history off, and delete your reading history or all your saved research. For anything else, write to the contact address in section 1. Q19 answers within one month (Art. 12(3) GDPR) and may ask you to confirm your identity first.

20. Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for Q19 is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

21. Children

Q19 is for people aged 16 or older. When you create an account, or first sign in with Google, Microsoft or Apple, you must confirm that you are 16 or older; Q19 does not verify this further. Visitors under 16 cannot themselves consent to Analytics (Art. 8 GDPR) and should not switch it on. If Q19 learns that an account belongs to someone under 16, it deletes the account.

22. Automated decisions

Q19 makes no decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). AI answers are generated content, not decisions about you. Your plan's limits on answers and requests are applied automatically, exactly as the plan describes.

23. Changes to this policy

This policy is dated 15 October 2026. When Q19 changes how it processes personal data, it updates this page and its date. If a change affects your cookie choices, Q19 asks for your choice again; if the research-data consent text changes in substance, Q19 asks for your consent again (section 5).

This policy is available in German, English and Arabic. If the versions differ, the German version prevails.