Privacy Policy وقاية

Last updated: 2026-05-01

Wiqaya is a Chrome extension built for the Quran Foundation Hackathon 2026. This page explains what data the extension touches, where it lives, and what we do not do with it.

Short version: Wiqaya stores everything locally in your browser. The only servers it talks to are the Quran Foundation APIs (for verses, recitations, and — if you sign in — your bookmarks and reading streaks). There is no analytics, no advertising, and no third-party tracking.

1. Data Wiqaya stores locally

The following is kept in chrome.storage.local on your device and never transmitted anywhere except as described below:

The list of websites you've added to your watch list and their per-site time limits.
How long you've spent on each tracked site today (resets daily at local midnight).
Your settings: theme, translation, reciter, global time limit, audio auto-play.
Local counts of verses you've read today and total verses read.
If you sign in: an OAuth access token, refresh token, and their expiry timestamps.
A cached list of Quran chapters (downloaded once from the Content API).

2. Network requests Wiqaya makes

The extension makes outbound requests only to the following hosts, and only as a direct consequence of using the extension:

apis.quran.foundation — to fetch a random verse, its translation, and recitation metadata.
oauth2.quran.foundation — to obtain an access token for the Content API (client-credentials grant, no user data involved).
apis-prelive.quran.foundation and prelive-oauth2.quran.foundation — only if you sign in, to handle OAuth and User-API calls (bookmarks, streaks, reading sessions).
audio.qurancdn.com and verses.quran.com — to stream the audio recitation file for the verse currently shown.

Wiqaya does not contact any other server, and it does not send the URLs or content of the websites you browse to anyone — your browsing list stays on your device.

3. What Wiqaya does not collect

No analytics or telemetry of any kind.
No advertising identifiers, fingerprinting, or third-party trackers.
No collection of the content of pages you visit.
No personal information beyond what you voluntarily share with the Quran Foundation by signing in.

4. Sign-in and the Quran Foundation User API

Sign-in is optional. If you choose to sign in, Wiqaya uses the OAuth 2.0 Authorization Code flow with PKCE, redirecting you to the Quran Foundation's authorization server. After you approve, the access and refresh tokens are stored locally on your device. They are sent only to the Quran Foundation's API endpoints, only when you take an action that requires them (such as bookmarking a verse or recording a reading session).

The Quran Foundation has its own privacy policy that governs what they store on their servers. Please refer to quran.foundation for those terms.

5. Permissions the extension requests

activeTab, tabs — to detect which site is currently in the foreground for time tracking.
storage — to persist your settings and tracked-site data locally.
idle — to pause tracking when your computer is idle or locked.
alarms — to run the time-tracking tick on a periodic schedule.
identity — used by the OAuth flow when you sign in.
<all_urls> content script — required to inject the verse overlay onto the site you're currently using when the time limit is reached. The content script does not read or transmit page content.

6. Removing your data

To delete all local data, remove the extension from chrome://extensions — Chrome will clear its local storage. To revoke server-side access, sign out from within Wiqaya's settings, or revoke the application from your Quran Foundation account.

7. Changes to this policy

This is a hackathon project and the extension is under active development. If this policy changes, the updated date at the top of this page will reflect that.

8. Contact

For questions, open an issue at github.com/0xNoramiya/wiqaya.