Privacy Policy
Effective: 28 February 2026
1. Who We Are
WhatSurah is a QR-based Quran audio card game operated by launch0.dev. We are the data controller for the personal information described in this policy. Contact: privacy@launch0.dev
2. Data We Collect
Order data
When you place an order, we collect your name, email address, and shipping address. This is stored in a database hosted on AWS (EU region).
Reciter preference
Your preferred reciter is saved in your browser's localStorage only. It never leaves your device and is not sent to our servers.
Cookies & analytics
We set no cookies by default. With your consent, we use Umami, a cookieless, privacy-focused analytics tool, to see which pages are popular — it does not collect personal data. Separately, and only with your consent, we use the Meta (Facebook/Instagram) pixel to measure how well our ads perform; this does set cookies and may involve cross-site tracking. You can accept, decline, or change either of these at any time using the cookie icon in the corner of the screen.
3. Why We Process Your Data
Order processing — to fulfil your purchase and ship the card deck. Legal basis: performance of a contract.
Advertising measurement — to see whether our ads are effective, via the Meta pixel described above. Legal basis: your consent, which you can withdraw at any time.
4. How Long We Keep It
Order records are retained for as long as required by applicable accounting and tax law (typically 7 years). You may request deletion of any data not subject to a legal retention obligation at any time.
5. Third Parties
Amazon Web Services (AWS) — database and hosting, EU (eu-central-1) region. Governed by the AWS Data Processing Addendum.
Stripe — payment processing. Stripe operates as an independent data controller for payment data. See stripe.com/privacy.
Quran Foundation — provides the audio clips via their API. No personal data is transmitted in audio requests.
Umami — cookieless, anonymous website analytics, loaded only if you accept analytics cookies. See umami.is/privacy.
Meta Platforms, Inc. — Meta Pixel, used to measure and improve our advertising, loaded only if you accept marketing cookies. Meta may process this data under its own privacy policy; see facebook.com/privacy/policy.
6. Your Rights (GDPR)
If you are in the European Economic Area or the UK, you have the following rights:
Access — obtain a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected.
Erasure — request deletion of your data ("right to be forgotten").
Restriction — ask us to limit processing while a dispute is resolved.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests.
Withdraw consent — unsubscribe from our notification list at any time.
To exercise any of these rights, email privacy@launch0.dev. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
7. Changes
We may update this policy as the service evolves. Material changes will be noted with a new effective date at the top of this page. Continued use of the service after changes constitutes acceptance.