Privacy Policy
In short
- No account, no ads, no tracking, no analytics.
- Your prayer tracker, streak, favourites, tasbih and settings stay on your phone.
- Your location (if you allow it) is used to calculate prayer times and the Qibla on the device; it is never sent to our servers.
- A few online features (translations, tafsir, recitations, AI assistant, like counts) send only what is needed to answer you. We never sell any data.
- Optional purchases (Premium, tips) are paid through the App Store or Google Play; we never see your card details.
1. Who we are
The Ayalume app ("the app") is published by AquaTech EU s.r.o. (IČO 21503826), Na Folimance 2155/15, Vinohrady, 120 00 Praha 2, Czech Republic, the data controller under the General Data Protection Regulation (GDPR). For any question: contact@ayalume.app.
2. Data that stays on your device
The app works without an account. The following data is saved only in the app's local storage on your phone. We have no access to it:
- your prayer tracker, streak and goals (reading, Ramadan mode, khatm);
- your favourites, reading position and the verses already seen in the feed (your likes are also counted on our server, see section 7);
- the tasbih counter and your progress in the adhkar;
- the amounts entered in the zakat calculator and your giving intentions;
- your settings: language, theme, backgrounds, calculation method, muezzin, notifications, chosen city;
- recitations downloaded for offline use, and a cached copy of the translations, tafsirs and explanations you have already opened;
- a random technical identifier (see section 5).
This data is erased when you delete the app. Depending on your phone settings, it may be included in your iCloud or Google backup, managed by Apple or Google.
3. Location
Location is optional. If you allow it (only "while using the app", never in the background), your position is used to calculate prayer times and the Qibla direction directly on the device. Your coordinates are saved on your phone and are never sent to our servers.
To show the name of your city, the app uses your phone's built-in geocoding service (Apple on iOS, Google on Android), which then receives your coordinates under its own privacy policy. You can also pick your city from a list without granting location access. The Qibla compass uses the phone's orientation sensor, on the device.
4. Notifications
Adhan notifications and reminders (such as the verse of the day) are scheduled locally on your phone, based on times calculated on the device. We do not use a push notification server and do not collect any notification token. You can turn them off in the app or in your phone settings.
5. Online features
Our server
Some features go through our server, hosted by Cloudflare: the translations, tafsirs and recitations provided by the Quran Foundation, the AI assistant and the like counts (section 7). Our server keeps our access keys secret and forwards the requests. It receives:
- the content requested (for example a verse reference or a chosen translation);
- for the assistant: your question, the app language and the Quran passages found by the app; for "Explain this verse": only the verse reference and the language;
- a random technical identifier created by the app, which is not linked to your name, your phone or any account;
- your IP address, as with any internet connection.
Apart from likes (section 7), the technical identifier (or, if missing, the IP address) is used only to limit the number of requests per device and prevent abuse. This counter stays in the server's memory for one hour at most and then disappears; it is not written to any database. We do not record your questions or your request history. Cloudflare, our host, processes technical connection data (including IP addresses) to run and secure the service, under its privacy policy.
Quran Foundation
Our server queries the Quran Foundation API on our behalf. Your IP address and technical identifier are not passed on to it.
AI assistant (Cloudflare Workers AI)
When you use the assistant or the AI explanation of a verse, the answer is generated by Cloudflare Workers AI, our host's AI service, with an open model (Google's Gemma or Mistral Small) running on Cloudflare's infrastructure. Our server passes it only the text needed: your question and the Quran passages, or the tafsir of the verse to rephrase; your IP address, technical identifier and location are not passed on. Under its Workers AI commitments, Cloudflare does not keep these texts once the answer is delivered and does not use them to train models. No text is sent to Google or any other AI provider. To stay within the service's free allowance, our server keeps a global daily counter (date, total number of requests and compute used) in a Cloudflare D1 database, with no question, identifier or IP address. Still, please avoid writing personal information in your questions. The assistant is optional and does not give religious rulings (fatwas).
Content loaded directly
To play or download a recitation, or read a tafsir, the app connects directly to the sites that provide this content: mp3quran.net (recitations and verse timings), QuranEnc.com (Al-Mukhtasar tafsir) and the Quran.com / QuranicAudio audio servers. Like any website, they see your IP address and standard technical information (device type, time). We do not send them any identifier.
6. Sharing and photos
You can share a verse (for example as a story) through the system share sheet, or save a verse image to your Photos. The app then only asks for permission to add photos; it does not read your photo library. What happens next depends on the app you share to.
7. Shared likes
When you tap the heart on a verse, the app sends our server only the verse number and the device's random technical identifier (section 5), so that each device counts once per verse and so we can show the counts and "Most liked". No name, account, email, location or other personal data is sent.
- These likes are stored in a Cloudflare D1 database (our host). The device identifier is not stored in clear: only a keyed hash (HMAC-SHA-256 with a secret key) is kept, together with the verse number. Your IP address is never stored there.
- Other users only see rounded totals per verse, with no information about who liked what.
- Removing a like (tapping the heart again) deletes it from the server. To delete all your shared likes at once: Profile → Settings → Privacy → Delete my shared likes. Do this before uninstalling the app: afterwards the identifier no longer exists and we can no longer link those likes to your device.
- When you are offline, your likes stay on your phone and are sent once you are back online.
8. No ads, no tracking
The app contains no advertising, no analytics or audience measurement tools, and no advertising SDK. It does not use your phone's advertising identifier (IDFA / AAID), does not track you across apps or websites, and does not build profiles. We do not sell or rent any data.
9. Optional purchases (Premium and tips)
The app offers an optional Premium subscription (unlimited assistant, exclusive backgrounds, stats) and optional tips to the developers. The Quran and recitations stay free. The terms of these purchases are in our Terms of Use.
- Payment: handled entirely by Apple's App Store or Google Play, under their own privacy policies. We never receive your name, email or card details.
- Purchase management (RevenueCat): to verify your purchases, unlock Premium and allow restoring, the app uses RevenueCat, Inc. (United States) as our processor. It receives a random anonymous user identifier generated by the app, your in-app purchase history (products, dates, prices, subscription and trial status, store receipt) and technical information (app and OS version, language, store country, IP address when connecting). We link none of this to a name, email or advertising identifier, and it is not used for tracking or advertising.
- Your Premium status and tip history are also kept on your phone.
- To manage or cancel a subscription: your Apple or Google Play account settings.
10. Children
The app is for everyone, requires no account and does not knowingly collect personal data from children. If you believe a child has sent us personal data (for example by email), contact us and we will delete it.
11. Legal bases (GDPR)
- Performance of the service you request (Art. 6(1)(b)): providing online content, assistant answers and like counts, and verifying and delivering your purchases.
- Legal obligation (Art. 6(1)(c)): keeping the purchase records required by accounting and tax law.
- Legitimate interest (Art. 6(1)(f)): running and securing our server, preventing abuse, replying to your emails.
- Consent (Art. 6(1)(a)): access to location, notifications and adding photos, granted through your phone's permissions and revocable at any time in its settings.
12. Retention
| Data | Retention |
|---|---|
| Data in the app (section 2) | On your device, until you erase it or delete the app |
| Anti-abuse counter on our server | One hour at most, in memory only |
| Shared likes (verse + hash of the device identifier) | Until you remove the like or delete them in the app (Settings → Privacy) |
| Questions asked to the assistant | Not kept, neither by us nor by Cloudflare Workers AI once the answer is delivered |
| Global AI usage counter (date, daily total) | Aggregate statistic with no personal data (one row per day) |
| Purchase history at RevenueCat (anonymous identifier) | As long as the developer account exists, then as required by accounting law; deletable on request |
| Emails sent to contact@ayalume.app | As long as needed to handle your request and its follow-up |
13. Transfers outside the European Union
Cloudflare, RevenueCat and Google (email) may process data outside the European Union, in particular in the United States. These transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
14. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, and you can withdraw your consent at any time. Most of your data is on your phone: you can delete it yourself by clearing the app's data or uninstalling it. Your shared likes can be deleted from the app (section 7). Because we collect no data that identifies you, we may sometimes be unable to find data about you. To exercise your rights: contact@ayalume.app.
You can also lodge a complaint with the Czech data protection authority (Úřad pro ochranu osobních údajů) or with the authority in your country.
15. Security
All of the app's connections are encrypted (HTTPS). Our secret access keys (Quran Foundation, AI) stay on the server and are never included in the app; the app only contains public keys (such as RevenueCat's), which give access to no data.
16. Contact
AquaTech EU s.r.o., IČO 21503826, Na Folimance 2155/15, Vinohrady, 120 00 Praha 2, Czech Republic. Email: contact@ayalume.app. Messages sent to this address are received in our Gmail (Google) mailbox.
17. Changes
We may update this policy, for example when a new feature is added. The date at the top of the page shows the latest version. If there is a significant change, we will flag it in the app or on this page.