Privacy Policy

Welcome to OpenAyah. We are committed to protecting your privacy and being transparent about how we handle your information. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding your personal information.

1. Who We Are

OpenAyah is a mobile application developed to help users read, study, and engage with the Quran and Hadith collections. Our mission is to provide a beautiful, distraction-free reading experience while respecting your privacy.

Data Controller:
Kitaby LTD
Email: privacy@kitaby.app
Website: https://kitaby.app

2. Information We Collect

2.1 Information You Provide Directly

Data Type	When Collected	Purpose
Email Address	When you create an account	Account authentication, password recovery, important service notifications
Name	When you sign in with Apple or Google	Personalization (display name in app)
Reading Progress	As you read the Quran	Track your position, display progress statistics, sync across devices
Bookmarks & Notes	When you save verses or add notes	Store your personal annotations for later reference
App Preferences	When you customize settings	Remember your theme, font size, translation preferences, and reading settings

2.2 Information Collected Automatically

Data Type	What We Collect	Purpose
Device Information	Device model, operating system version, app version	Ensure app compatibility, troubleshoot issues
Usage Analytics	Features used, reading sessions (stored locally)	Calculate your reading streaks and statistics
Crash Reports	Technical error logs (if app crashes)	Fix bugs and improve app stability

2.3 Information We Do NOT Collect

• Location data - We do not request or access your device location
• Contacts - We do not access your address book or contacts
• Photos or media - We do not access your camera or photo library
• Audio recordings - We do not record your voice or save audio from your device (the microphone permission you may see is required by our audio playback library, but OpenAyah only plays pre-recorded Quran recitations - it never records you)
• Browsing history - We do not track websites you visit
• Cross-app tracking - We do not track you across other apps
• Advertising identifiers - We do not collect IDFA or similar advertising IDs
• Biometric data - We do not collect fingerprints, face data, or voice prints
• Sensitive personal information - We do not collect health, financial, racial, ethnic, religious beliefs, or sexual orientation data beyond what is inherent to an Islamic app

3. How We Use Your Information

We use your information only for the following purposes:

Purpose	Legal Basis (GDPR)
Provide app functionality - Display Quran text, track reading progress, save bookmarks	Contract Performance
Sync data across devices - Keep your progress consistent when you use multiple devices	Contract Performance
Process subscriptions - Manage premium features and payment processing	Contract Performance
Send service notifications - Password resets, account security alerts	Legitimate Interest
Improve the app - Analyze crash reports to fix bugs	Legitimate Interest
Respond to support requests - Help you when you contact us	Contract Performance

We do NOT use your information for:

• Advertising or marketing to third parties
• Selling or renting to data brokers
• Profiling for targeted advertising
• Building marketing profiles

4. Third-Party Services

To provide OpenAyah's features, we work with the following trusted third-party service providers:

4.1 Authentication & Data Storage

Service	Provider	Purpose	Data Shared
Supabase	Supabase Inc.	User authentication, secure cloud data storage	Email, encrypted password, reading progress, settings
Apple Sign-In	Apple Inc.	Optional secure login method	Name, email (with Apple's privacy relay option)
Google Sign-In	Google LLC	Optional secure login method	Name, email, profile picture

Privacy Policies: Supabase | Apple | Google

4.2 Payment Processing

Service	Provider	Purpose	Data Shared
RevenueCat	RevenueCat Inc.	Manage subscriptions and in-app purchases	Device ID (IDFV on iOS), anonymous user ID, purchase history, subscription status
Apple App Store	Apple Inc.	Process iOS payments	Handled directly by Apple - we do not receive payment details
Google Play	Google LLC	Process Android payments	Handled directly by Google - we do not receive payment details

Important: We never receive, store, or have access to your credit card numbers, bank account details, or payment credentials. All payment processing is handled securely by Apple, Google, and RevenueCat.

Privacy Policy: RevenueCat

4.3 Content Delivery

Service	Provider	Purpose	Data Shared
Quran.com Audio CDN	Quran Foundation	Deliver Quran recitation audio files	IP address (standard web request), verses requested
Tarteel.ai	Tarteel AI	Word morphology and dictionary data	IP address, word lookup requests
Cloudflare CDN	Cloudflare Inc.	Deliver language packs and app assets	IP address (standard web request)

Privacy Policies: Quran.com | Tarteel.ai | Cloudflare

4.4 No Advertising or Analytics SDKs

• Facebook/Meta SDK
• Google Analytics or Firebase Analytics
• Amplitude, Mixpanel, or Segment
• Any advertising networks
• Any data brokers or marketing tools

5. Data Storage and Security

5.1 Local Storage (On Your Device)

Most of your data is stored locally on your device using encrypted storage:

• Quran text and translations - Stored in local SQLite database
• Reading progress - Cached locally for offline access
• Settings and preferences - Stored in encrypted local storage (MMKV with AES encryption)
• Authentication tokens - Encrypted and stored securely on device

5.2 Cloud Storage (Synced Data)

If you create an account, the following data is synced to our secure cloud servers (Supabase):

• Your reading progress and position
• Bookmarks and notes
• App preferences and settings
• Reading goals and achievements

5.3 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption in transit - All data transmitted uses TLS/HTTPS encryption
• Encryption at rest - Sensitive data is encrypted on our servers
• Secure authentication - We use OAuth 2.0 and JWT tokens with short expiration
• Access controls - Strict access controls limit who can access backend systems
• Regular security updates - We keep all systems updated with security patches

6. Data Retention

We retain your data only as long as necessary to provide our services:

Data Type	Retention Period
Account information	Until you delete your account
Reading progress & bookmarks	Until you delete your account
Local app data	Until you uninstall the app or clear data
Crash reports	90 days
Support correspondence	2 years after resolution

When you delete your account, we delete or anonymize your personal data within 30 days, except where we are required by law to retain certain information.

7. Your Rights

You have the following rights regarding your personal data:

7.1 Access and Portability

You can view your data within the app (Settings > Account) or request a complete export of your data by contacting us.

7.2 Correction

You can update your account information directly in the app or by contacting us.

7.3 Deletion

You can delete your account and all associated data at any time:

• In-app: Go to Settings > Account > Delete Account
• Email: Send a request to privacy@kitaby.app

7.4 Data Export

You can request a copy of all your data in a machine-readable format (JSON) by contacting us.

7.5 Withdraw Consent

Where we process data based on your consent, you can withdraw consent at any time by adjusting your settings or contacting us.

7.6 Restriction and Objection

You can request that we restrict processing of your data or object to certain processing activities.

To exercise any of these rights, contact us at privacy@kitaby.app. We will respond within 30 days.

8. Children's Privacy

OpenAyah is designed to be family-friendly and suitable for users of all ages. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA) without parental consent.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at privacy@kitaby.app, and we will take steps to delete such information.

For children using the app, we recommend:

• Using the app without creating an account (guest mode)
• Parents creating the account on behalf of the child
• Using Apple's "Hide My Email" feature when signing up

9. International Data Transfers

Your data may be processed in countries outside your country of residence. Our service providers operate data centers in:

• United States - Supabase, RevenueCat, Cloudflare
• European Union - Some Cloudflare edge servers

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Selection of providers with strong privacy practices

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

10.1 Right to Know

You have the right to request that we disclose:

• Categories of personal information collected
• Sources of personal information
• Business purposes for collection
• Categories of third parties with whom we share data
• Specific pieces of personal information collected about you

10.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

10.3 Right to Opt-Out of Sale

10.4 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

10.5 Categories of Information Collected

Category (per CCPA)	Collected?	Sold?	Shared for Ads?
Identifiers (email, name)	Yes	No	No
Commercial information (purchases)	Yes	No	No
Internet activity (app usage)	Yes	No	No
Geolocation data	No	No	No
Biometric information	No	No	No
Sensitive personal information	No	No	No

To exercise your California privacy rights, contact us at privacy@kitaby.app or use the in-app account deletion feature.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent laws:

11.1 Legal Bases for Processing

We process your data under the following legal bases:

• Contract Performance: To provide the app services you requested
• Legitimate Interest: To improve our services and ensure security
• Consent: For optional features where you explicitly opt-in
• Legal Obligation: To comply with applicable laws

11.2 Your GDPR Rights

In addition to the rights listed in Section 7, you have the right to:

• Lodge a complaint with your local data protection authority
• Data portability - receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests
• Not be subject to automated decision-making (we do not use automated decision-making)

11.3 Data Protection Authorities

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local supervisory authority:

• UK: Information Commissioner's Office (ICO) - ico.org.uk
• EU: Your local Data Protection Authority

12. Apple App Store Privacy Details

In accordance with Apple's App Store requirements (effective May 2024), here is how our data collection aligns with Apple's privacy nutrition labels. This section uses Apple's exact terminology for App Store Connect.

12.1 Data Linked to You

The following data types are collected and linked to your identity:

Apple Category	Data Type	Purpose	Tracking?
Contact Info	Email Address	App Functionality (authentication)	No
Contact Info	Name	App Functionality (personalization)	No
Identifiers	User ID	App Functionality (account management)	No
Identifiers	Device ID (IDFV)	App Functionality (subscription verification via RevenueCat)	No
Purchases	Purchase History	App Functionality (subscription management)	No
User Content	Other User Content (bookmarks, notes)	App Functionality (save and sync user annotations)	No
Usage Data	Product Interaction (reading progress)	App Functionality, Product Personalization	No

12.2 Data Not Linked to You

The following data is collected but not linked to your identity:

Apple Category	Data Type	Purpose
Diagnostics	Crash Data	App Functionality (bug fixes)
Diagnostics	Performance Data	App Functionality (stability)

12.3 Data Not Collected

We do not collect the following data types:

• Location - No precise or coarse location (prayer times use timezone only, not GPS)
• Health & Fitness - No health or fitness data
• Financial Info - No payment info (handled by Apple/Google)
• Sensitive Info - No racial, ethnic, biometric, or political data
• Contacts - No address book access
• Photos or Videos - No camera or photo library access
• Audio Data - No audio recording (microphone permission required by audio SDK, but app only plays audio, never records)
• Browsing History - No web browsing tracked
• Search History - In-app search is processed locally only, never sent to servers
• Gameplay Content - Not applicable

12.4 Tracking Declaration

Per Apple's definition, "tracking" means linking data with Third-Party Data for advertising or sharing with data brokers. We confirm:

• We do not display targeted advertisements
• We do not share data with advertising networks
• We do not share data with data brokers
• We do not use IDFA (Advertising Identifier)
• Device ID (IDFV) is used only for subscription verification, not advertising

12.5 Third-Party SDK Disclosure

Per Apple's requirements, we disclose data collection by third-party SDKs:

SDK	Data Collected	Purpose
RevenueCat	Device ID (IDFV), Purchase History	Subscription management, fraud prevention
Supabase	Email, User ID, User Content	Authentication, cloud sync
Google Sign-In SDK	Email, Name (via OAuth)	Authentication only
Apple Sign-In	Email, Name (first sign-in only)	Authentication only

Note: We do not include any advertising SDKs (Facebook, Google Ads, etc.) or analytics SDKs (Firebase Analytics, Amplitude, etc.).

12.6 Privacy Manifest (PrivacyInfo.xcprivacy)

Per Apple's May 2024 requirements, our app includes a Privacy Manifest declaring the following Required Reason APIs:

API Category	Reason Codes	Why We Use It
File Timestamp	C617.1, 0A2A.1, 3B52.1	Check file modification dates for cache management
User Defaults	CA92.1, C56D.1	Store app preferences and settings
System Boot Time	35F9.1	Calculate elapsed time for animations/timers
Disk Space	E174.1, 85F4.1	Check available space before downloading language packs

Our Privacy Manifest declares NSPrivacyTracking: false and NSPrivacyCollectedDataTypes: empty (no tracking-related data collection).

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email (if you have an account) or in-app notification
• For significant changes, request your consent where required by law

We encourage you to review this policy periodically to stay informed about how we protect your information.

14. Contact Us

Data Subject Access Requests

To submit a formal data subject access request (DSAR), please email privacy@kitaby.app with the subject line "Data Subject Access Request" and include:

• Your full name
• The email address associated with your OpenAyah account
• A description of your request (access, deletion, correction, etc.)

We may need to verify your identity before processing your request to protect your privacy.