How we handle your data.

Who we are

Buruja is a free sadaqah jariyah, built and maintained quietly. For anything about your data, or anything else, write to [email protected].

Buruja is run by Mittetulundusühing Baqiyah, a non-profit association registered in Estonia (registry code 80675864), Maakri tn 36-66, 10145 Tallinn. The association is the data controller for the information described here.

What we collect, and why

Your email address, if you subscribe

When you sign up for a daily series (by email), we collect your email address and which series you chose. We use it only to send you those emails. We process this on the basis of your consent, and you can withdraw it at any time by unsubscribing. Email signups are handled by Klaviyo (see below); we do not sell, rent, or share your address.

Your notification subscription, if you turn on daily reminders

If you turn on a daily reminder, your browser gives us a push subscription: a technical address at your browser's push service (run by Google, Apple, Mozilla, or Microsoft), together with the hour and topic you picked. It contains no name or email address. We store it with Cloudflare only to send the reminder, on the basis of your consent, and delete it when you turn reminders off or when the push service tells us it has expired.

Payment details, if you donate

Donations are taken on Stripe's own secure checkout page. We never see or store your full card number. Stripe shares with us what we need to record and receipt the gift, such as the amount, the date, your email address, and the card type and last four digits. We keep these records to meet our bookkeeping obligations as a registered non-profit.

How the site is used

We use privacy-conscious analytics (PostHog, hosted in the EU, and Ahrefs Web Analytics, which sets no cookies) to understand which pages and features help people, so we can improve the site. This records things like pages viewed and buttons pressed. Form fields, including your email as you type it, are masked and not captured. We do not record your screen, we do not build advertising profiles, and we do not sell this data. We rely on our legitimate interest in keeping the site working well, kept to the minimum needed.

What stays on your device

Your bookmarks, reflection notes, reading progress, and preferences (theme, reading size, chosen reciter) are stored locally in your own browser. They are never sent to us, and you can clear them at any time through your browser settings.

Server logs

Our host (Cloudflare) keeps standard, short-lived request logs, such as IP addresses, for security and to keep the site running. These are not used to identify or profile you.

Who we share it with

We rely on a small number of trusted providers, only as needed:

• Klaviyo sends the emails and stores your subscription (United States).
• PostHog provides the usage analytics described above (European Union).
• Ahrefs provides cookieless website analytics (overall traffic and search performance).
• Cloudflare hosts and delivers the site, and stores notification subscriptions for daily reminders.
• Stripe processes donations (European Union and United States).
• Your browser's push service (Google, Apple, Mozilla, or Microsoft) delivers daily reminders, if you turn them on.
• Google Fonts serves the typefaces; your browser requests them from Google, which may log the request to deliver them.
• everyayah.com and hisnmuslim.com serve the recitation audio, loaded only when you press play.
• YouTube is used only if you click through to watch a linked lecture; nothing is shared until you do.

Where your data goes

Some of these providers (such as Klaviyo, Stripe, and Google) are based in the United States, so your data may be processed there. We rely on their standard safeguards for international transfers. Our PostHog analytics are hosted in the EU.

How long we keep it

• Your email address: until you unsubscribe. After that we keep only a record that you unsubscribed, so you are never emailed again.
• Your notification subscription: until you turn reminders off, or until your browser's push service tells us it has expired.
• Donation records: for seven years, as Estonia's Accounting Act requires for accounting records.
• Usage analytics: within PostHog's retention period for our account, and never linked to your name or email address.
• Server logs: for a short time only, by Cloudflare.

Your choices and your rights

Every email has a one-tap unsubscribe, and you can resubscribe any time. If you are in the EU, UK, or a region with similar laws, you have the right to access the data we hold about you, to correct it, to have it deleted, to object to or restrict its use, and to withdraw consent. To exercise any of these, just email [email protected] and we will take care of it. You also have the right to complain to a data protection authority: in Estonia, where the association is registered, that is the Andmekaitse Inspektsioon (Data Protection Inspectorate), or you can contact the authority where you live.

Cookies

We keep cookies to a minimum. We use them only for the PostHog analytics described above (Ahrefs Web Analytics sets none), never for advertising. You can block or clear cookies in your browser at any time without losing access to the site.

Children

Buruja is for a general audience and is not directed at young children. We do not knowingly collect personal information from children. If you believe a child has subscribed, write to us and we will remove it.

Changes to this notice

If we change how we handle data, we will update this page and the date at the top. For anything that materially affects you, we will do our best to let subscribers know.