Privacy Policy

1. Information We Collect

Using Ayafy without an account (guest mode) and offline

You can skip sign-in and explore the app. In guest mode we do not collect your name or email address. Core features, such as reading the Quran and using the app's basic functionality, also work offline, and the data they use (for example your preferences) is stored on your device.

Features that need your data on our servers, such as creating and updating memorization sessions, syncing progress, and recitation feedback, require you to sign in and be online. If you never sign in, the personal information described below as "provided by you" is not collected. Even in guest mode, the app automatically collects the device, analytics, and IP address information described under "Information Collected Automatically", using an anonymous device identifier rather than your name or email. You can delete locally stored guest data at any time by clearing the app's data or uninstalling the app.

Personal Information You Provide

We collect personal information that you voluntarily provide when you register for an account, use the app's features, or contact us. This may include:

• Account information: name, email address, username, and profile picture
• Authentication data: when you sign in with Google, we receive your name, email, and profile photo from Google Sign-In
• Onboarding preferences: choices you make during initial setup to personalise your experience. We do not collect your age or date of birth
• Voice recordings: audio recordings you make during recitation practice sessions (see Section 3 for full details)
• Learning preferences and progress: your daily memorization goals, lesson structure, progress settings, Surah completion data (how much is memorized and how much remains), streak data, and session results including recitation error highlights
• Reminder settings: you can create daily or one-time reminders, which are scheduled locally on your device; if you're signed in and syncing, the time, label and repeat settings of each reminder are also stored on our servers so they carry over to your other devices

App Permissions

Ayafy requests the following device permissions:

• Microphone: required for live recitation practice and feedback. Audio is only captured during an active session you initiate.
• Camera: required only when you choose to take a new profile photo from within the app (Settings → Profile). The camera is never accessed passively or without your explicit action.
• Notifications: required to show the reminders you create (daily or one-time). Reminders are scheduled and triggered locally on your device; we do not use a remote push-notification service, we do not collect a push token for them, and we do not send marketing or promotional notifications. Notifications only appear for reminders you create, and you can switch them off in the app or your device settings.
• Internet: required to sync your account, progress, and recitation data with our servers.

Information Collected Automatically

When you use Ayafy, we automatically collect certain technical information necessary to operate and improve the service:

• Device data: device type, operating system version, and app version
• Usage / product analytics (PostHog and Google Analytics): in the app we use PostHog and Google Analytics to measure feature interactions, screen and tab views, session timing, and product events (for example authentication funnel steps, goal and revision lifecycle, Quran reader preference changes, and downloads). We do not send recitation audio, Tajweed/ASR analysis, or passwords/OTP codes to analytics
• Search analytics: the text of global search queries and voice-search transcripts (truncated), used only to understand search quality — not the microphone audio file itself
• Identity for analytics: if you are a guest, analytics are linked only to an anonymous device identifier. When you are signed in, we associate analytics with your Ayafy user ID, your name, and your email address so we can measure retention and product usage across sessions. This information is used only for app improvement and analytics
• IP address: we receive your IP address when your device connects to our servers and to our analytics provider. We use it to operate and secure the service and to understand, at a coarse level, where the app is used. We do not use it to identify you for advertising
• Log data: limited diagnostic information needed to operate and secure the service

Recitation audio you listen to

Ayafy lets you listen to Quran recitation by different reciters, either streamed or downloaded to your device for offline listening. When you play or download a recitation, the app requests the audio file from our servers and content delivery providers (Cloudflare and Amazon S3 in Mumbai, see Section 4), which receive your IP address and technical request information, such as the reciter and surah requested, in order to deliver the file. Downloaded audio is stored on your device and can be removed from within the app or by clearing the app's data.

We record only your playback actions (such as start and pause) as product analytics events (see "Information Collected Automatically"). We do not record what you listen to in order to build a profile of you, and we do not use listening activity for advertising. This is separate from the recordings of your own voice described in Section 3.

Downloadable content and resources

You can download optional resources to your device for offline use, including surah audio, tafsir, translations, transliterations, Quran fonts, and page layouts. These are public Quran resources, not personal data, and are stored on your device only. Downloading them has the same technical effect as above: the delivery provider receives your IP address and the request. You can remove downloaded resources from within the app or by clearing the app's data.

Sensitive Information

Ayafy is a Quran learning app, so the fact that you use it may reveal information about your religious beliefs, which the GDPR treats as a special category of personal data. We do not ask you for your religion, and we do not use this information to profile you, target you, or infer anything beyond providing the app. We process it only on the basis of your explicit consent, which you give by choosing to create an account and use the app, and which you can withdraw at any time by deleting your account.

Beyond that, and beyond voice recordings collected for recitation feedback (described in Section 3), we do not knowingly process other sensitive categories of personal data such as health data, financial information, or political opinions. We do not use your voice recordings to identify you as an individual (voiceprints).

2. How and Why We Process Your Information

We process your personal information for the following purposes, and rely on the legal bases shown (GDPR Article 6):

• Account creation and authentication (name, email, sign-in data): to create and manage your Ayafy account. Legal basis: performance of a contract, Art. 6(1)(b).
• Delivering app features (preferences, progress, voice recordings): to provide recitation feedback, track your new-lesson, recent-revision, and full-revision progress, and personalize your memorization journey. Legal basis: performance of a contract, Art. 6(1)(b); for voice recordings, also your consent through the action of starting a recitation session.
• Product analytics and app improvement (anonymous device ID or user ID, name and email if signed in, IP address, device data, usage events; collected with PostHog and Google Analytics): to understand feature usage, fix reliability issues, and improve the app. This is used solely for analytics and app improvement. We do not use it for advertising, marketing, or cross-app tracking. Legal basis: our legitimate interest in improving the app, Art. 6(1)(f). You can object at any time (see Section 9).
• Customer support: to respond to your inquiries and communicate important service updates. Legal basis: performance of a contract and legitimate interest.
• Security and fraud prevention (IP address, log data): to detect and prevent unauthorized access, abuse, or violations of our terms. Legal basis: legitimate interest, Art. 6(1)(f).
• Legal compliance: to fulfill our obligations under applicable law. Legal basis: legal obligation, Art. 6(1)(c).
• Optional model improvement (anonymized recitation audio): only if you opt in. Legal basis: your consent, Art. 6(1)(a), which you can withdraw at any time.

We do not use your personal data for advertising, we do not sell it, and we do not make decisions about you that have legal or similarly significant effects through automated means. Recitation feedback is an automated learning aid only and has no effect on your rights or access to the app.

3. Voice Recordings & AI Processing

Recitation feedback is a core feature of Ayafy. When you practice reciting Quran, the app records your voice to evaluate accuracy and provide guided correction.

What we collect

Audio recordings are captured only during active recitation sessions — when you explicitly start a recitation practice session. We do not record audio passively or in the background.

How voice data is used

• To compare your recitation against Quran-aware speech recognition models and provide real-time feedback
• To highlight errors and suggest corrections aligned with Tajweed principles
• To track your recitation progress over time within your account

AI processing

Ayafy uses a custom Quran-aware speech recognition system to analyze your recitation entirely within our own infrastructure. Your audio is not sent to any external AI or cloud provider for processing. This means:

• No third-party AI: recitation audio is processed by our own system and never transmitted to external AI providers
• No training by default: your voice recordings are never used to train or fine-tune our model without your explicit consent
• Minimal retention: audio is processed to generate feedback and is not stored beyond what is necessary to display your session results

Optional: help improve recitation (opt-in only)

You may choose to contribute your anonymized recitation data to help us improve the accuracy of our custom Quran speech recognition model. This is entirely optional and turned off by default — we will never use your data for training unless you explicitly enable it.

If you opt in (via Settings → Privacy → Help improve recitation):

• A copy of your recitation audio and the corresponding Quran text is retained and used solely to train and improve our model
• All audio used for training is anonymized — your name, email, and account identifiers are stripped before any training use
• Training data is stored securely on our own infrastructure and is never shared with any third party

If you opt out (the default, or after disabling the setting):

• None of your recitation data is used for training — your audio is only processed to generate your session feedback and is not retained beyond that

You can change this preference at any time from Settings → Privacy → Help improve recitation. If you withdraw consent, your previously contributed data will not be used in any future training runs within 90 days of opt-out.

Your control

You can delete individual session recordings or all recitation history at any time from within the app. You may also revoke microphone permission from your device settings at any time, though this will disable recitation features.

4. Sharing Your Information

We do not sell, rent, or monetize your personal information. We share data only in the following limited circumstances:

Service providers

We work with trusted third-party vendors who help us operate Ayafy, including:

• Google (Firebase Authentication and Google Sign-In): account sign-in and authentication only
• Cloudflare, Inc. (content delivery) and Amazon Web Services (Amazon S3, Mumbai): the downloadable Quran files (audio, tafsir, translations, transliterations, fonts, and layouts) are stored in Amazon S3 in Mumbai, India, and delivered to you through Cloudflare's network. Cloudflare sees your IP address and request details when serving a file; neither provider receives your account information
• Google Analytics (Google): app usage and reliability analytics, used only to understand and improve the app — not for advertising
• PostHog (PostHog, Inc., United States): product analytics for the Ayafy mobile app (feature usage, funnels, and reliability signals). It receives your user ID, name, email, and IP address as described in Section 1 — not used for advertising or behavioral ad profiling

Our service providers act as data processors on our instructions and are bound by data processing agreements that require them to protect your data and use it only for the purposes we specify. We do not sell personal information and do not use analytics for cross-app tracking or advertising.

Legal requirements

We may disclose your information if required by law, court order, or governmental request, or if we believe in good faith that disclosure is necessary to protect the safety of any person, investigate fraud, or enforce our terms.

Business transfers

If Ayafy is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice prior to such a transfer.

5. Data Storage & Transfer

Our application servers and our database are located in Mumbai, India. Your account information, learning progress, profile photo, and voice recordings are stored and processed there. We do not use Firebase Storage or Firestore to store your data.

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data is therefore transferred to and processed in India, which the European Commission has not recognised as providing an "adequate" level of data protection. We protect it with the safeguards described in Section 7 (encryption in transit, access controls, and limited retention), and, where we rely on a provider to process data on our behalf, with Standard Contractual Clauses or an equivalent transfer mechanism.

Two limited sets of data are processed outside India by our providers:

• Analytics: PostHog (PostHog, Inc.) hosts product analytics data in the United States. The transfer is covered by Standard Contractual Clauses in PostHog's data processing agreement.
• Content delivery: the downloadable Quran files are stored in Amazon S3 in Mumbai, India. They are delivered through Cloudflare's global network, so when you download a file, your IP address and request details are processed by Cloudflare at a server location close to you, which may be outside India (including the United States). The files themselves contain no personal data. Cloudflare offers a data processing agreement with Standard Contractual Clauses.
• Google Analytics: Google processes app and website analytics data, which may be stored in the United States or other countries where Google operates, under Google's own data transfer mechanisms.
• Sign-in: Google processes authentication data for Firebase Authentication and Google Sign-In under Google's own privacy terms and data transfer mechanisms.

You can request more information about the safeguards we use by emailing [email protected].

6. Data Retention & Account Deletion

We retain your personal information for as long as your account is active or as needed to provide you with the service. Specifically:

• Account data: retained while your account is active; permanently deleted after the 30-day grace period following an account deletion request
• Voice recordings and session data: retained until you delete individual sessions within the app, or until your account is permanently deleted
• Guest and offline data: stored only on your device until you clear the app's data or uninstall the app; we do not hold it on our servers
• Log and diagnostic data (including IP addresses): retained for up to 90 days for security and debugging purposes
• Product analytics data (user ID, name, email, usage events): retained while your account is active so we can measure retention and product usage; when your account is permanently deleted, we delete or anonymize your analytics profile
• Anonymized training data (only if you opted in): retained for ongoing model improvement; removed from future training runs upon opt-out or account deletion

Account deletion and 30-day grace period

You can delete your account at any time directly from Settings → Account → Delete Account within the app. When you initiate deletion:

• Immediate: your account is deactivated and you lose access to all app features
• 30-day grace period: your data is held securely for 30 days. If you sign back in during this period, your account and all data are fully restored — exactly as you left them — with no action required
• After 30 days: if you do not return within the grace period, your account and all associated personal data — including profile information, memorization progress, and recitation history — are permanently and irreversibly deleted from our systems

7. Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encrypted data transmission using TLS/HTTPS
• Secure token-based authentication via Firebase Auth
• Encrypted storage for sensitive data using device-level secure storage
• Access controls limiting who within our team can access personal data

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. By using Ayafy, you acknowledge and accept this inherent risk.

8. Children's Privacy

Ayafy is not directed to children under the age of 13, and you must be at least 13 to create an account. We do not collect your age or date of birth, and we do not knowingly collect personal information from children under 13.

In some countries, including some EU member states, the minimum age at which you can consent to the processing of your own personal data online is higher than 13 (up to 16). If that applies to you, you may only use Ayafy with the permission of a parent or legal guardian.

Ayafy uses Google Sign-In as its only sign-in method, and Google's own systems restrict account creation for children under 13 without parental approval.

If you are a parent or guardian and believe your child under 13 has registered or provided personal information without your consent, please contact us immediately at [email protected]. We will promptly delete the account and any associated data.

We do not serve advertisements to any users, and we never sell data of any user.

9. Your Privacy Rights

General rights (all users)

Regardless of where you live, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate or incomplete information
• Deletion: request permanent deletion of your account and associated data
• Portability: request your data in a portable format where technically feasible
• Product analytics: object to product-analytics processing by emailing us at [email protected]. This is separate from the optional AI training / “Help improve recitation” setting
• Withdraw consent: where we rely on your consent (for example the optional “Help improve recitation” setting), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal

GDPR rights (EEA and UK residents)

Under the General Data Protection Regulation, you additionally have the right to:

• Right to be informed about data collection and use
• Right to restrict processing under certain conditions
• Right to object to processing based on legitimate interests
• Right not to be subject to solely automated decision-making
• Right to lodge a complaint with your local data protection authority

We have not appointed a Data Protection Officer because we are a small operation and not required to. For all privacy-related matters, contact us directly at [email protected]. You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or where you believe an infringement occurred.

Rights under Indian law (residents of India)

Under the Digital Personal Data Protection Act, 2023, you have the right to access information about your personal data, to request correction and erasure, to nominate another person to exercise your rights in the event of death or incapacity, and to have your grievances addressed. For any grievance, contact us at [email protected]; we will respond within the timelines stated below.

CCPA rights (California residents)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Delete personal information we have collected
• Opt out of the sale of personal information (note: we do not sell personal information)
• Non-discrimination for exercising your privacy rights

Exercising your rights

To exercise any of these rights, email us at [email protected] with the subject line "Privacy Rights Request." We will acknowledge your request within 7 business days and fulfill it within 30 days. Complex requests may take up to 60 days, in which case we will notify you of the extension.

10. Third-Party Services

Ayafy integrates with a limited set of third-party services to deliver its core features:

• Google Firebase Authentication: account creation and sign-in — Firebase Privacy
• Google Sign-In: OAuth-based account authentication — Google Privacy Policy
• PostHog: product analytics for understanding app usage and reliability — PostHog Privacy Policy. Data is hosted in the United States (see Section 5). PostHog receives your user ID, name, email, and IP address, but does not receive recitation or revision microphone audio or Tajweed/ASR analysis. Global search query text and voice-search transcripts may be included as described above. To object to this processing, email [email protected]
• Cloudflare and Amazon S3 (Mumbai): delivery and storage of downloadable Quran content — Cloudflare Privacy Policy, AWS Privacy Notice
• Google Analytics (mobile app and ayafy.com website): usage measurement in the app, and basic traffic measurement on our marketing website — How Google uses data. We do not use it for advertising

We do not use advertising SDKs or sell personal information. All Quran recitation audio processing for practice feedback is handled by our own system and is separate from product analytics. Optional AI model improvement remains controlled only by Settings → Privacy → Help improve recitation.

Third-party services linked above have their own privacy policies. Ayafy is not responsible for the privacy practices of services outside our control.

11. Website & Cookies

The ayafy.com website is an informational site. It has no user accounts, no login, and no forms that collect personal information. We do not set our own cookies, and we do not use advertising or social-media tracking cookies.

The website uses Google Analytics to measure traffic. Google Analytics may set cookies or use similar identifiers (for example, cookies beginning with _ga) and collects information such as pages viewed, approximate location derived from your IP address, browser, and device type. We use this only to understand how the site is used and to improve it, not for advertising. Our legal basis is our legitimate interest in understanding and improving our website (GDPR Art. 6(1)(f)).

You can block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on. The website works normally if you do. If you contact us by email, we use your email address only to reply.

12. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users via email or prominent in-app notification at least 30 days prior to significant changes taking effect

We encourage you to review this policy periodically. Continued use of Ayafy after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:

We aim to respond to all privacy-related inquiries within 5–7 business days. For account deletion requests, data access requests, or any privacy concern, email us with the subject line "Privacy Request" and we will assist you promptly.