← Meddeb

Privacy policy

Last updated: 1 November 2026

In short

Meddeb listens to your recitation on your own device. Your voice, your recordings and your marks are never sent to us or to anyone else. There is no account, no advertising, no analytics and no tracking.

Who is responsible

The person named in the Impressum is the controller within the meaning of the EU General Data Protection Regulation (GDPR) for this website and the Meddeb apps.

The app (Android, PC)

• Microphone. While a session or a "find where I am" search runs, the app records the microphone and turns it into text with a speech model that runs on the device itself. The audio is never uploaded.
• What is stored, and where. Each session is saved in your profile folder on the device: the recording (audio.wav), the recognised words and verdicts, your manual marks and your settings. This data stays on the device. Only you can export it (Settings → Export profile), and you choose where the file goes.
• Network. The app uses the internet for three things only:
  • downloading the speech model, once: on Android by itself after the first start (on the PC it is on disk). It is downloaded from GitHub (raw.githubusercontent.com), which receives your IP address and technical request data like for any download; see GitHub's privacy statement;
  • in Listen, downloading the recitation you choose. On Android (since 0.21): Yasser Al-Dossary (the default) and the "Mix" choice play QuranicAudio's whole-surah files (download.quranicaudio.com); the "Meddeb selection" also plays surah files from mp3quran (cdn.mp3quran.net) and the Internet Archive (archive.org); the other reciters (Abdul-Rahman Al-Sudais, Yasser Salamah, Mishary Alafasy, Fares Abbad), the voice clips and any file a surah file could not replace come from EveryAyah (everyayah.com), whose files are delivered by the BunnyCDN network. These hosts receive your IP address, technical request data and the names (and byte ranges) of the audio files requested, like for any download; see BunnyCDN's privacy policy and the Internet Archive's terms. On Android the downloaded parts, and the rest of that surah fetched in the background on an unmetered network (Wi-Fi), are kept in the app's own storage on the device (not in your profile), so that later plays work offline; on the PC and in the web app the browser plays them from EveryAyah and may cache them;
  • on Android, looking for a new version of the app: when you open About, and after 10 minutes of use (at most every 12 hours once a check succeeded, at most every hour while it does not), the app fetches a small file (update.json) from this website (GitHub Pages, or the same file on raw.githubusercontent.com); when you press Update it downloads the new version from GitHub (github.com and release-assets.githubusercontent.com). GitHub receives your IP address, technical request data and the app's version (in the request's User-Agent), like for any download.
  Apart from this request data (your IP address, the names of the files requested and, for the update check, the app's version), nothing is sent: no account or identifier, and nothing from your profile (recordings, recitation, marks, progress).
• Permissions. Microphone (to listen), notifications (the "Meddeb is listening" notice that keeps the microphone working with the screen off, the playback controls while Listen plays, and "Meddeb is installed" after an update), internet (model download, Listen audio and the app's updates only), install apps (only Meddeb's own updates, after you press Update).
• Deleting your data. Settings → Space used shows what takes space and deletes, after a confirmation, your recordings, your mistake history or the downloaded recitation audio. Uninstalling the app deletes its profile folder and the downloaded recitation audio. You can also delete single session folders from the profile.

The web app (Meddeb in your browser)

The web app at karim-53.github.io/Meddeb/app/ does the same as the apps above, inside your browser: the speech model and the whole recitation coach run in the page (WebAssembly), on your computer.

• Microphone. The browser asks for your permission; while a session or a search runs, the page records the microphone and turns it into text on your computer. The audio is never uploaded.
• What is stored, and where. Your profile (sessions with their recordings, verdicts, marks, settings) and the speech model are kept in the browser's private storage for this website (the Origin Private File System), on your computer. Other websites cannot read it, and it is never sent anywhere. Settings → Export profile downloads it as a zip (the same file as the Android app's), Import profile reads one back.
• Network. The app's files and, at the first recitation, the speech model come from this website (GitHub Pages); Listen plays the recitation from EveryAyah as described above; when the page shows again it fetches a small file (version.json) from this website, at most every hour, to tell you when a new version is available. The request data of these downloads (your IP address, the files requested) reach GitHub and EveryAyah / BunnyCDN as described above; nothing else is sent, and nothing from your profile.
• Speaking a surah's name. Before a session that starts at a surah's first ayah, the page may say the surah's name with your browser's Arabic voice, and only with a voice that runs on your computer; without one, it plays the reciter's basmala instead.
• Bug reports. ☰ → Send feedback opens a new GitHub issue on Karim-53/Meddeb, prefilled with the app's version, the browser and system names and the session's name. Nothing is sent until you submit it, and the issue is public (see below).
• Deleting your data. Settings → Space used deletes your recordings or your mistake history; your browser's settings for this site ("Delete data" / "Clear site data") delete the whole profile and the model. Export the profile first if you want to keep it.

This website

This website is hosted by GitHub Pages (GitHub, Inc., USA). When you open it, GitHub processes your IP address and technical request data to deliver the pages and keep the service secure (legal basis: legitimate interest, Art. 6(1)(f) GDPR). The website itself sets no cookies and uses no analytics. See GitHub's privacy statement.

Bug reports and feature requests

Reports are filed as issues on GitHub and are public. Anything you write or attach there (text, logs, screenshots, recordings) can be read by anyone and is processed by GitHub under its own terms. Please do not post recordings or personal information you do not want to publish.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. Since the app keeps your data on your device, you exercise most of these rights yourself (export, delete, uninstall). For anything else, use the contact in the Impressum.

Changes

If the app ever starts to send data anywhere, this page will say so before that version is released.