Privacy Policy
Document version: 2026-10-15.2
Effective date: 2026-10-15
Summary for parents: IlmQuest is a school platform. Your child's school creates accounts and decides what records it keeps here, such as grades, attendance and Qur'an memorization progress. We use that information only to run the school service. We do not sell it, show advertising or use it to train AI models. You can ask to see, correct or delete your child's information by contacting the school or us.
Who we are
IlmQuest is operated by Abdirahman Mohamed, an individual sole proprietor, referred to here as "IlmQuest," "we" or "us."
- Mailing address: 235 A Danforth St, Portland, Maine 04102, United States
- Email: supportilmquest@gmail.com
- Telephone: (207) 800-7829
- Website: https://theilmquest.com
This policy covers the IlmQuest website and web application at theilmquest.com and the IlmQuest app for Android. The section on the Android app explains what is different there.
Schools are in charge of student records
IlmQuest is offered only to schools. Parents and students cannot create their own accounts; the school creates them. The school decides which records it keeps in IlmQuest and who in the school can see them. We process those records on the school's behalf to provide the service. For questions about a specific record, such as a grade or an attendance mark, the school is usually the best first contact.
Information we collect
From the school and its staff: names, usernames and email addresses, roles, class membership, parent-child links, grades, assessments, attendance, Qur'an memorization (Hifz) progress, teacher comments and report cards, announcements, school documents and forms, and school billing records such as invoices and payment status.
From people who use the service: messages, posts and comments, profile images and uploaded files, answers to school forms, electronic signatures, notification and text-message preferences, and phone numbers given for text-message alerts. When someone signs a document, we record the signed text, the time, the IP address and browser information.
Automatically: sign-in and session information, device notification tokens if you turn on notifications, IP addresses and browser details used for security, records of who changed a record and when, and error reports when something goes wrong.
Messages, comments and form answers are free text, so they may contain anything a person types. Religious-learning records may reveal religious belief, and school forms can contain health or family information. Please share only what the school needs.
The IlmQuest Android app
The Android app connects to its own IlmQuest server and database, separate from the website. It handles the same kinds of school records described above, with these differences.
- Class day plans and checklists: teachers can share the parts of each class day and a daily task checklist. Students can mark their own tasks done, and linked parents and the teacher can see those marks.
- Qur'an revision sessions: a student can record a revision session with its planned length, its timing and where it happens, either a choice such as home or masjid or a short description the student types. Linked parents and teachers can be notified when a session starts, including that description. The app does not use GPS or the device's location.
- Student sign-in needs the school's approval: before any student can sign in, the school must approve our notice about children's information, and a school administrator must record each student's age range (under 7, 7 to 12, or 13 and older). We store the approval, the age range, who recorded it and when. Students under 7 cannot sign in.
- Agreements: we keep a record of which version of our policies and agreements a person viewed or accepted, and when.
- Peer features are limited: students cannot post in class chats, and student leaderboards and classmate revision partners are turned off in the app.
- On your device: the app keeps your sign-in tokens in the device's secure storage and, if you allow notifications, a push notification token. The only device permission it asks for is permission to show notifications. It does not access your camera, contacts, location or files.
- Downloading your records: from the Account screen you can download your account records, and a parent can download a linked child's education records.
How we use information
We use information only to do the following.
- Provide the school service: records, reports, schedules, messages and notifications.
- Let parents see information about their own linked children.
- Send the email, text and push notifications that users or the school have turned on.
- Process school payments where a school has turned on online payment.
- Keep accounts secure, prevent misuse and fix problems.
- Meet our legal obligations.
We do not sell personal information. We do not show advertising or use student information for targeted advertising. We do not build profiles of students for any non-school purpose, and we do not use school information to train artificial intelligence models.
Who can see information
Access depends on a person's role in their school. Teachers see the classes they are assigned to, and school administrators see their school. Parents see information about the children linked to their account. A parent-child link is set by the school; schools should remove a link when a family's access changes.
Some features are visible to other students in the same school. These include student names with leaderboard ranks and points, and posts and comments shared to the school. Class messages are visible to the members of that class conversation. Direct messages are visible to their participants. A reported message can be shown to school staff who handle reports.
We do not share information with other schools. We share information outside IlmQuest only with the service providers listed below, when the school or a user asks us to, or when the law requires it.
Service providers
We use these companies to run IlmQuest. They receive only the information needed for their task.
| Provider | What it does | Information it receives |
|---|---|---|
| Railway | Hosts the IlmQuest website, and the Android app's server and database | All information processed by the website and the app |
| MongoDB Atlas | Hosts the website's database and its backups | All records stored by the website |
| Cloudinary | Stores and delivers uploaded images and files | Uploaded images and files |
| SendGrid | Delivers email | Email address and message content |
| Twilio | Delivers text messages to people who opted in | Phone number and message content |
| Expo push notification service | Sends the Android app's push notifications on to Google | Device token and notification content |
| Google Firebase Cloud Messaging | Delivers push notifications to people who turned them on | Device token and notification content |
| Sentry | Receives error reports so we can fix problems | Technical error details, with known personal fields removed before sending |
| Stripe | Processes card payments when a school turns on online payment | The payment and payer details described below |
| Google Fonts | Supplies typefaces for some pages | Your IP address and browser details when a page loads |
Payments
When a school turns on online payment, card payments go through Stripe's secure checkout. You enter card details directly with Stripe; IlmQuest never receives your full card number. The payment goes to the school's own Stripe account. To set up checkout we send Stripe the invoice amount and title, the payer's name, email, phone and relationship, and account identifiers for the school, payer, invoice and linked children. We receive and store the payment result and Stripe's reference numbers alongside the school's billing records.
Children's privacy
Many IlmQuest students are under 13. Their accounts are created by their school, and we collect children's information only to provide the school's educational service. When a child is under 13, we rely on the school's authorization, given on the parent's behalf, for this educational use only. We do not use children's information for any other commercial purpose, and we do not require a child to share more information than an activity needs.
A parent can review the information we hold about their child, ask us to correct or delete it, and tell us to stop collecting further information from their child. Contact the school or email supportilmquest@gmail.com. Deleting a child's information or stopping its collection means the child can no longer use IlmQuest.
Your choices and requests
You can ask to see, correct, download or delete your information, or the information of a child linked to you. Send requests to supportilmquest@gmail.com or contact your school. We will confirm the request comes from the account holder, a linked parent or an authorized school administrator before acting on it. For records the school controls, we will work with the school. We respond within 45 days. If we cannot fully meet a request, for example because the school must keep a record by law, we will tell you what we kept and why. We will not treat you differently for making a request.
You can turn notification emails, text messages and push notifications on or off in your account settings. Reply STOP to any IlmQuest text message to stop texts.
How long we keep information
We keep school records while the school uses IlmQuest and needs them. When a school asks us to delete student information or stops using IlmQuest, we delete that information from our live systems within 45 days, unless the law requires us to keep part of it. Payment records may be kept longer where accounting or tax law requires it. Database backups are deleted as they expire under our hosting provider's backup schedule. A deleted record can remain in a backup until that backup expires; we restore from a backup only to recover from a failure.
Hiding a message or deactivating an account does not delete it. To have information deleted, make a request as described above.
Security
We protect information with encrypted connections (HTTPS), hashed passwords, access limited by role and school, records of changes, and protection against cross-site request forgery. No system is completely secure. If we learn of a security incident affecting student information, we will notify the affected schools without unreasonable delay and give any other notice the law requires.
Cookies
IlmQuest uses a sign-in cookie that keeps you signed in for up to 7 days, along with cookies that protect forms from misuse. We do not use advertising cookies or third-party analytics trackers. Some pages load typefaces from Google Fonts, which receives your IP address when they load.
Changes to this policy
If we make a material change, we will tell schools and signed-in users before it takes effect and update the effective date above. We will not use information collected under an earlier version of this policy in a materially different way without any consent the law requires.
Contact
For privacy questions or requests, email supportilmquest@gmail.com or write to IlmQuest, 235 A Danforth St, Portland, Maine 04102, United States.