DeenRoot

Privacy Policy

Last updated: August 9, 2026

1. Overview

DeenRoot is operated independently by a single individual, based in Pakistan — not a registered company. This policy explains what personal data DeenRoot collects, why, who it's shared with, and the choices you have. Every feature on the site works without an account; account data is only collected for the features that need it (bookmarks, progress, the AI assistant, monthly support).

2. What we collect

Account data

Email address, password (stored hashed, never in plain text), and display name, if you register.

Login activity

On successful sign-in, we record the IP address, browser/device (user-agent), and timestamp — used for account-security monitoring (e.g. detecting suspicious logins). Failed login attempts are not tied to an email address, to avoid revealing which emails have accounts.

Content you create

Bookmarks, notes, highlights, and reading progress on Quran/Hadith/article pages; course enrollment, lesson progress, and quiz answers if you use the Learning section.

AI assistant conversations

The text of questions you ask the assistant and its answers, stored under your account so you can revisit past conversations. If you or another user flags a message, the flag and its reason are stored too. See Section 6 on how these may be reviewed.

Support / payment data

If you buy DeenRoot Supporter: your email, the amount, currency, and payment status, plus a Paddle-assigned customer/subscription/transaction id. Card details are collected and stored entirely by Paddle — they never reach DeenRoot's servers. We also store your supporter status itself (badge, whether your membership is currently active, its renewal date) and, only if you opt in at checkout, your display name on the public supporters wall — off by default.

Site-usage analytics

Anonymous-by-default page-visit records (path, referrer, browser user-agent, time spent) with an approximate country/city derived from your IP address using a local, offline geo-lookup dataset — not a live third-party tracking service. If you're logged in, visits are also linked to your account. IP addresses used for this are not stored alongside the visit record beyond what the approximate-location lookup requires.

Error logs

If something breaks, technical error details are logged for debugging. Known secrets (API keys, tokens) are automatically redacted before logging or reaching our error-tracking tool (Sentry).

3. Cookies

DeenRoot uses two httpOnly cookies for signed-in sessions — deen_access (short-lived) and deen_refresh (longer-lived) — which JavaScript on the page can never read directly; only our own server reads them to keep you signed in. We don't use advertising or third-party tracking cookies. If you use the Django admin (staff only), standard session/CSRF cookies apply there.

4. Who we share data with

We don't sell your data. We share it only with the service providers that run DeenRoot, and only what each one needs to do its job:

  • OpenAI — receives the text of your assistant questions, to generate answers.
  • Paddle.com Market Limited — receives your email and payment details for support/donations, as merchant of record.
  • SendGrid (Twilio) — receives your email address to send account-verification email.
  • Sentry — receives technical error data for debugging; configured to exclude request bodies and personal data by default.
  • Cloudflare — provides object storage for uploaded/generated files (e.g. course certificates).

Quran/Hadith content providers (Quran Foundation, Sunnah.com, AlQuran Cloud) and the Qibla location lookup (Nominatim/OpenStreetMap) only ever receive content or place-name requests needed to serve a page — never your account identity.

Because several of these providers operate outside Pakistan (including the US and EU), using DeenRoot may involve your data being processed in those countries.

5. Data retention

We keep account and content data for as long as your account exists. Payment/donation records are kept as required for our own financial recordkeeping. Login and page-visit records are kept for a limited period for security and reliability purposes, not indefinitely.

6. AI assistant review

To catch abuse, off-topic misuse, and quality problems (including responses that incorrectly attempt to issue a religious ruling), assistant messages — including ones flagged by any user — may be reviewed by us. This is a moderation process, not routine reading of every conversation.

7. Your rights

You can:

  • View and update your display name from account settings;
  • See and cancel an active monthly support subscription from account settings;
  • Request a copy of your data, or request that your account and associated data be deleted, by emailing info@deenroot.com — self-service deletion isn't built into the product yet, so this is handled manually.

If you're in the UK, EU, or another jurisdiction with its own data-protection law, you may also have rights to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority.

8. Children's privacy

DeenRoot is not directed at young children, and we don't knowingly collect account data from children under the age of digital consent in their jurisdiction (commonly 13). If you believe a child has created an account without appropriate parental involvement, contact us and we'll remove it.

9. Security

Passwords are stored hashed, never in plain text. Session cookies are httpOnly and never exposed to page JavaScript. Card payment data never reaches our servers at all — it's handled entirely by Paddle. No method of transmission or storage is 100% secure, but we take reasonable technical measures to protect your data.

10. Changes to this policy

We may update this policy as the service changes. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

Questions about this policy, or a data access/deletion request: info@deenroot.com.