MyDiiwaan is a portal for Qur'an schools: the office, teachers, parents and students each use it to follow lessons, attendance and progress. This policy explains what information MyDiiwaan holds, why, who can see it, and how to have it removed. It covers the website at www.mydiiwaan.com and the MyDiiwaan apps for iPhone, iPad and Android, which show the same portal.
Who is responsible
Each school decides who has an account and what is recorded about its students. For those school records the school is responsible, and MyDiiwaan looks after them on the school's behalf. Questions about a child's record are best asked of the school first; you can also contact us at omar.miraf5@gmail.com.
What we collect
- Account details — your name, your role (admin, teacher, parent or student), your school, and for staff and parents an email address and, if the school adds one, a phone number. Passwords are stored by our sign-in provider in a form no one at MyDiiwaan can read.
- Student records, entered by the school — a student's name, halaqa (class), grade and campus; attendance; Qur'an and Qa'idah lessons and revision, the teacher's ratings and notes, memorisation progress and yearly plans; Islamic Studies and Arabic work and marks; stars and badges; school fees owed and paid (amounts and dates only — no card or bank details); and messages between parents and teachers about the child.
- Student sign-in — the 4-digit PIN the school sets, which the office can read back to a child who forgets it, and a count of wrong PINs: after five in a row, that child's PIN is refused for 15 minutes.
- The school's own finances, if it uses them — what it pays its staff each month and what it spends. Only the school's admins can see these.
- Lesson recordings — audio a teacher records of Qa'idah lessons, for the school's students to listen to. Stored for the school and played only to its signed-in members.
- Spreadsheets the office uploads to add students or parents are read to take out the names and details, and are not kept.
- Teachers at more than one school — a teacher can belong to several schools with one login. Each school sees the teacher's name and email, and only its own records.
- Agreements — when a school's admin accepted our terms and confirmed the school has parents' agreement, and who did.
- Staff sign-in — when a teacher signs in or out, the phone's location is checked against the school's location to confirm they are on the premises. We keep the time, the distance from the school and how precise the reading was — not the location itself. Location is only read at the moment of signing in or out, never in the background, and never for parents or students.
- The school's location, set by the school's admin for that check.
- Your phone's notification address — if you use the MyDiiwaan app and allow notifications, an identifier for your phone is kept so the portal's notices (for example an absence alert) can reach it. It is sent to Apple's or Google's notification service to deliver the message, is only for staff and parents (never students), and is removed when you sign out or delete your account. You can turn notifications off in your phone's settings at any time.
- Notices and emails the portal sends — for example to parents and the office when a child has missed five school days in a row; a welcome or password-reset email; and, if the school uses them, a Friday email to parents about their child's week. Every Friday email has a link to unsubscribe, and parents can also turn them off on their Account page.
- On your device — a sign-in cookie that keeps you signed in, and settings such as your language, light or dark theme, and the school code used for student sign-in.
What we don't do
There is no advertising in MyDiiwaan. We don't sell or rent anyone's information, we don't track you across other apps or websites, and the portal contains no advertising or analytics trackers.
How it is used
Only to run the portal for your school: showing each person what their role needs, working out lesson plans and attendance, and sending the notices described above. We may look at an account's data when the school or the account holder asks us for help, or to keep the service working and secure.
Who can see it
- Staff at your school, according to their role — for example, teachers see their students' work.
- Parents see their own children's records and messages. Students see their own work.
- No other school can see your school's information.
- Our service providers, only to run MyDiiwaan for us: Supabase (database, file storage and sign-in), Vercel (hosting), Resend (sending emails — it receives the recipient's address and the email's contents) and Cloudflare (which runs the mydiiwaan.com domain name).
- When an admin sets the school's location, the map is drawn from OpenStreetMap and the address typed is looked up with OpenStreetMap's search service. They see the address searched for and your device's internet address, nothing about your account.
- When you play a recitation or open the Mushaf, your device fetches the audio from cdn.islamic.network or everyayah.com and the Mushaf fonts from cdn.jsdelivr.net. Those services see your device's internet address, as with any website, but nothing about your account.
We only share information beyond this if the law requires it.
Children
Students are children. Their accounts are created by their school, they sign in with a PIN the school gives them, and MyDiiwaan only holds what the school records about them for their Qur'an education. The school is responsible for having parents' agreement to this, for example as part of enrolment. Parents can ask the school, or us at omar.miraf5@gmail.com, to see, correct or delete their child's information.
Keeping and deleting information
- Information is kept while your school uses MyDiiwaan.
- When a student has been inactive for over two years, the school is offered to delete their records for good from its Students page.
- You can delete your account at any time from the Account page in the portal or the app. That removes your login and your details. Records you made about students — attendance taken, lessons set, messages in a child's thread — belong to the school and stay, without your name.
- A student can ask their school to delete their account from the same page, and a school's admin can delete a student's record permanently.
- When a school closes its account, its information and every account in it are deleted.
- Deleted information may remain in encrypted backups for a short time until they are replaced.
Security
Everything is sent over encrypted connections. Each school's records are separated from every other school's, and each person can only reach what their role allows — a student's login can't open a teacher's or a parent's pages, and only staff can change the school's records. Yearly plans are additionally encrypted before they are stored. If a breach ever affected a school's records, we would tell the school without undue delay and help it tell the people affected.
Your choices
You can ask to see, correct or delete your information, or ask a question about this policy, by contacting your school or emailing omar.miraf5@gmail.com. You can turn off location for MyDiiwaan in your phone's settings at any time; staff sign-in will then ask for it again.
Changes
If this policy changes, the new version will be posted here with a new date. Significant changes will be announced in the portal.
Contact: omar.miraf5@gmail.com · Terms of Service · Help and support