Frequently Asked Questions

CariDoa is a Malaysian du'a finder. It brings three things together in one place: a catalogue of sourced du'a from the Quran and hadith, the Ask & Pray network where Muslims pray for one another, and Du'a Links so family and friends can send du'a to umrah and hajj pilgrims.

See Features for the full picture, or the Guide for step-by-step help.

Yes, completely. There is no subscription, no advertising and no paid feature. We accept no payment to pray for anyone, and no donation is tied to du'a. Read why there is no paid du'a.

No. CariDoa is a tool for finding du'a and praying for one another. We do not issue fatwas or rulings. For questions of Islamic law, please ask your state Mufti department.

The catalogue is compiled from named sources and reviewed by accredited scholars before it is published.

No. Acceptance of du'a belongs to Allah alone. Nobody, including CariDoa, can promise it, and we never claim that any du'a will surely be accepted.

Scholars explain, based on a hadith narrated by Imam Ahmad, that a du'a containing no sin and no cutting of family ties is answered in one of three ways: it is granted, it is stored as good for the Hereafter, or an equal harm is turned away.

Reference: Musnad Ahmad, as cited in Bayan Linnas No. 85, Office of the Mufti of the Federal Territories (opens in a new tab).

Yes. CariDoa is a web app you can install on the home screen of Android phones and iPhones without an app store. Follow the install guide.

Du'a text, notes and messages are encrypted (AES-GCM) before they are stored, and decrypted only for the people who need to see them: our moderation team, who read each new request before it is shown, members who pray for your request (after automatic redaction), or the pilgrim who receives the du'a you send. Requests are anonymous by default.

Your sign-in email and display name are stored as written so that you can sign in. Our system also removes phone numbers, identity card numbers, email addresses and links automatically, and shortens full names written with bin or binti. Read the Privacy Notice for the full list of what is encrypted and what is not.

No. There are no ads, no third-party analytics, no social media pixels and no session recording. We only use the first-party cookies CariDoa needs: the sign-in cookies, the cd_ref campaign cookie and a cookie that remembers the first-visit setup. The full list, with device storage, is in the Privacy Notice.

Your IP address is not stored. For security and rate limits we keep only a one-way hash that cannot be turned back into the IP address.

Only a place label (for example "Masjid al-Haram") and whether it was verified. The device's coordinates are used once to check the holy-site area, then discarded. In reading mode without a connection, they wait on your device until the completion is sent.

You can refuse location access and type the place yourself. The "verified" badge is a sign of trust, not absolute proof.

Only you. The "prayed for" count on your request is never shown to anyone else, so that the deed stays sincere and away from showing off (riya'). On the home page we only show site-wide totals.

CariDoa runs on Cloudflare's global network. Your data is stored and processed by Cloudflare, including in data centres outside Malaysia. This cross-border notice is in the footer of every page and explained in the Privacy Notice.

Every du'a has a source: a surah and ayah of the Quran, or a hadith collection with its number, grade and grader. The Arabic is never typed. It is extracted automatically from named source files (the Tanzil Quran text and published hadith collections), and each extraction is recorded.

The full list of sources and their licences is on Source Attribution.

The Arabic is checked against a printed mushaf or hadith collection. Then an accredited Syariah reviewer checks the meaning, pronunciation guide, when to read and context of each du'a. Only reviewed du'a are published.

We never mention a du'a's virtue unless it is sourced, and nothing is attributed to the Prophet Muhammad ﷺ without a reference.

No. No AI writes religious text on CariDoa, and there is no AI du'a generator. Translations and pronunciation guides are prepared by the CariDoa Editorial Team and reviewed by accredited scholars before they are published.

JAKIM's 2024 Guideline on Islamic Content in New Media prohibits showing Quranic verses in Latin script. It follows the National Fatwa Council's decision that Quranic verses must not be written in any script other than Arabic.

CariDoa shows no rumi for Quranic text, including Quranic quotations inside dhikr and du'a from hadith. A hadith du'a counts as quoting the Quran when it shares at least three consecutive words with an ayah and those words are a quotation: a whole ayah, seven or more words, or three or more meaningful words besides the common formulas of dhikr (such as the declaration of tawhid, tasbih, tahmid, ta'awwudh and the names of Allah), or words the Quran itself teaches, such as the istirja'. Such du'a are shown without rumi, and the quotation is labelled with its surah and ayah.

The rumi pronunciation guide is only for du'a that are not from the Quran, and it is always shown next to the Arabic.

The Quranic verse text is being prepared for display under Malaysia's rules on Quranic text (the Printing of Quranic Texts Act 1986). Meanwhile, du'a that contain the Quran show only the title, the surah and ayah reference, when to read it, and links to read the verse on quran.com and in JAKIM's Smart Quran app. The verse text, its translation and CariDoa's meaning are not shown yet. For hadith du'a that quote the Quran, only the part that is not from the Quran is shown, and the quotation is marked with its surah and ayah.

Please read these verses directly from a mushaf or an official source. In sha' Allah the verse text will be shown as soon as every requirement is met.

Yes. Outside the prayer (solat), making du'a in a language you understand, including Malay, is allowed as long as the meaning is good and does not go against the Shariah. Du'a narrated in the Quran and hadith remain the better choice.

Inside the prayer, the Office of the Mufti of the Federal Territories advises making du'a in Arabic, especially the narrated du'a, for anyone able to manage even a little. If you cannot, make your du'a in your heart. For the details, ask your state Mufti department.

Yes. The Office of the Mufti of the Federal Territories explains that asking righteous people to pray for us is permitted and rooted in the Sunnah. Praying for a brother or sister without their knowledge also carries a virtue mentioned in a hadith narrated by Muslim (Sahih Muslim 2733 (opens in a new tab)).

That is the spirit of Ask & Pray: praying for one another as brothers and sisters, not handing our du'a over to someone else. Keep praying for yourself too.

Reference: Al-Kafi li al-Fatawi No. 1035, Office of the Mufti of the Federal Territories (opens in a new tab).

Because selling du'a goes against the Shariah. In its explanation of the "Valet Doa" service, the Office of the Mufti of the Federal Territories stressed that acceptance of du'a belongs to Allah alone, so it cannot be sold, promised or packaged by levels of "mustajab".

On CariDoa there is no paid du'a, no package, no "boost" and no donation tied to du'a. CariDoa has no payment system at all.

Reference: Bayan Linnas No. 85: An explanation of Valet Doa (opens in a new tab).

Thank you for caring. Tap "Report an error" on that du'a's page, or send feedback naming the du'a. Every report is checked by the content team together with the Syariah reviewer.

A Du'a Link is a link you share so family and friends can send du'a to you, especially before you travel to the Holy Land. You can create a personal link, or an Umrah, Hajj or Other journey with its own dates and du'a limits.

Incoming du'a go into a numbered trust list, so no request is forgotten. See how to create and share a link.

No. Senders only open the link, attach a du'a from the catalogue or write their own, agree to the Privacy Notice and pass a security check. Name and email are optional, and the email is never shown to the link owner. If they give an email, they receive a memento once their du'a has been read.

When the pilgrim marks your du'a as done, you receive a private link to a memento page: an Alhamdulillah greeting, your du'a, the place label (with a verified badge where available), the time, and the pilgrim's short note and voice note.

From that page you can send a dedication, a thank-you note, back to the pilgrim. The pilgrim can revoke the memento link at any time.

A memento never contains the pilgrim's private link address. The "Send another du'a for this journey" button appears only for a public journey that still accepts du'a. A memento is deleted with its du'a, at the latest 180 days after the link closes.

Yes. The pilgrim can reject a du'a and give a reason, and the sender is told by email if they gave one. Du'a containing curses, magic, gambling, requests for money or other people's personal details are blocked or held automatically before they reach the pilgrim.

Yes. In reading mode, press "Get ready for offline" while you are online. After that, the du'a you mark as done are saved on your device and sent automatically when you are back online. See the reading mode guide.

The offline copy is deleted automatically 7 days after the journey ends (or 30 days after it was prepared when there is no end date), and when you sign out.

Only if you choose so. Explore lists only the journeys their owners choose to list, with the display name only when the owner chooses to show it. Personal links are never listed, and users under 18 cannot list a journey.

Every journey address carries your public username (for example caridoa.com/j/jemaah-k3x9wd/umrah). New accounts get a random username, and you can change it in Settings.

Anyone aged 13 or over. Users aged 13 to 17 can use CariDoa but cannot post anything publicly: they cannot post du'a requests to Pray or list journeys, and their notes are always anonymous. Signing up needs a verified email address, a password of at least 10 characters and consent to the Privacy Notice.

In Settings, choose "Download my data" to get a copy of your data (JSON), or "Delete my account". The account is locked straight away: you can still sign in, but only to cancel the deletion. After 7 days a daily job erases it permanently.

Du'a you sent through other people's links stay with their recipients as an amanah, without your name or email. The details are in the Privacy Notice.

Yes. In Settings you can turn all email off or choose which kinds you receive, and every email has an unsubscribe link. The morning reminder is sent at most once a day, and only when du'a are waiting. Account security emails, such as verification and password reset, are still sent.