Mueeny — Privacy Policy
Last updated: 2026-10-23 (GDPR & KVKK review)
The Arabic version is the reference; this is its translation. Written from the app's own source code, not from a template, so every statement matches what the app actually does. Subscriptions are not built yet; when they are, a section will be added and the date above updated.
Mueeny helps you memorise, revise and read the Qur'an daily. This policy states what is actually collected and what is not — no boilerplate.
1) The app works without an account
No sign-in is required. The Mushaf, plan, alarm, memorisation session, revision, daily reading and progress all work without an account, and their data stays on your device only.
2) What is stored on your device
In an encrypted database on your device. The key is generated on your device and kept in the system secure store (Keychain on iOS, Keystore on Android) and never leaves it:
- Your goal, memorisation direction, daily amount, and what you memorised.
- Each page's memorisation strength and its revision schedule.
- Your busy schedule, session times, alarm and reminder settings.
- Daily reading progress, streak, points and badges.
- App language, translation language, theme, chosen reciter, playback speed.
- Your last reading position in the Mushaf.
On the web: nothing is stored in your browser
On the website (not the mobile app) we store none of your data in your browser. The database there lives in memory only: it opens empty in every new tab and is forgotten when you close it. Nothing is left behind for whoever uses the device after you — which is the point, since the website is opened on shared computers.
Because your data does not stay in the browser, it is kept in your account in the cloud:
- When you open the website an anonymous account is created automatically — with no email, no password and no name. We ask you for nothing; it is simply a place to keep your progress.
- When you sign in with your email or with Google, that same account is linked, so your progress carries over unchanged.
- An anonymous account that is not signed in to for 180 days is deleted permanently, together with its data.
- If the account cannot be created (for example with no internet), the app tells you plainly that your progress is not being saved. It does not pretend otherwise.
⚠️ The website needs internet, and it also has no automatic mistake detection (that works on mobile only). If you need it to work offline, use the mobile app — its database is encrypted on your device and works fully without a connection and without an account.
Downloading the reciter's audio
So recitation works offline, the app downloads — on Wi-Fi only and with a small cap (three surahs) — what your own plan refers to: your next memorisation surah, today's wird, and the review that is due. Nothing is downloaded over mobile data without you asking, and it can be turned off in Settings → Downloaded audio.
This is a download from storage we own (audio.mueeny.com): it carries neither your account, nor your progress, nor what you have memorised. But — as with any connection on the internet — your device's IP address and the name of the file requested do reach the server; that is required for the file to reach you and no connection is possible without it. We do not keep those logs and do not link them to you; our network provider (Cloudflare) keeps temporary technical logs for service security and abuse prevention, under its own policy.
3) What is never collected or sent
| Your voice recordings | Stay on your device. Never uploaded — not even to us |
| Your location | Prayer times are computed on your device; coordinates are never sent to any server |
| Your calendar events | Never uploaded |
| Contacts, photos, files | Never requested, never read |
| Ads or ad trackers | None in the app |
| Selling or brokering your data | Does not happen, and will not |
4) If you create an account (optional)
An account exists only to sync between your own devices. Then:
Stored by us (on Google Firebase — processing locations in detail in section 6): your email and account ID, and your progress: goal, direction, daily amount, memorised amount, page strengths, daily reading, points, badges, streak and settings.
Still never stored by us, even with an account: voice recordings, calendar events, location.
Subscription (once subscriptions go live): handled by the app store. We store only your entitlement linked to your account — we never see your card and store no payment data.
The guest account on the website is explained in section 2 — it is such an account without an email, and everything in this section applies to it.
What is uploaded, and when
Sync runs when you sign in, when the connection returns, and when you ask for it from "My account". And only what changed is uploaded — a page that has not changed is not written again.
5) Legal basis for each collection
(For the EU GDPR and Turkiye's KVKK.)
| What is collected | Basis |
|---|---|
| Your data on your device (plan, progress, settings) | We do not have it at all — we never see it and it is never sent to us, so it is not processing carried out by us |
| Email, account id and progress in the cloud | Performance of the contract (GDPR 6(1)(b) · KVKK 5(2)(c)): you created an account to sync your devices, and there is no sync without storing |
| The guest account on the website | Performance of the contract — it is the only way to keep your progress there, because your browser keeps nothing |
| Analytics and crash reports | Your explicit consent (GDPR 6(1)(a) · KVKK 5(1)) — off by default, and you may withdraw it at any time, after which sending stops immediately |
| Technical service logs (IP address when content is downloaded) | Legitimate interest (GDPR 6(1)(f)): delivering the file to you, service security and abuse prevention |
There is no basis for "advertising" or "marketing" — because neither exists.
6) Where your data is processed, and by whom
🔴 We do not say "Europe" in general, because the services differ:
| Service | Location | Source |
|---|---|---|
| Your cloud database (Cloud Firestore) | Frankfurt — Germany (europe-west3) | verified on our own project |
| Server functions (Cloud Functions) | Frankfurt — Germany (europe-west3) | our project configuration |
| 🔴 Sign-in (Firebase Authentication) | The United States, exclusively | Google's documentation: the service runs only from US data centers and offers no region choice |
| 🔴 Crash reports (Crashlytics) | Any Google data center worldwide | Google's documentation classifies it as a "global" service |
| Analytics (Google Analytics for Firebase) | a separate Google service under its own terms, processed in its data centers | Google's documentation |
| Audio files and Mushaf fonts (Cloudflare R2 + its network) | storage in Eastern Europe, delivered over Cloudflare's global network | our bucket configuration |
Who processes your data on our behalf
| Processor | What it does |
|---|---|
| Google (Firebase) | account, sync, server functions, analytics and crash reports |
| Cloudflare | delivery of audio and model files, and temporary technical security logs |
| Apple / Google Play | the app store (download and updates, and subscriptions once enabled) |
| RevenueCat | 🔴 not enabled yet — once subscriptions are enabled it will handle purchase verification, and this table and the policy date will be updated |
Transfers outside Turkiye and Europe
Sign-in is processed in the United States, and crash reports and analytics may be processed outside Europe and Turkiye. That is an international transfer, and Google relies on its published mechanisms for it: the EU-U.S. Data Privacy Framework (DPF) and the Standard Contractual Clauses (SCCs); Cloudflare likewise.
🔴 If you do not want this transfer: do not create an account and do not consent to analytics — the app works fully without both, and your data stays on your device and never leaves it.
⚠️ This policy states facts; it is not legal advice.
7) Retention and deletion
| Your data on your device | stays until you delete it or delete the app — we hold no copy of it |
| Your voice recordings | on your device, and deleted automatically after seven days |
| Your data in the cloud (with an account) | stays as long as your account does |
| An unused guest account | it and its data are deleted after 180 days without a sign-in |
| 🔴 When you delete your account | your data is deleted from our database and then the account itself — immediately and irreversibly |
| ⚠️ And backups | backups are kept to protect against data loss, and deleted after 30 days — so a trace of what you deleted may remain in them until then, and is then gone. They are used only to recover from a failure |
| Analytics and crash reports | subject to Google's own retention periods for each; once you withdraw consent, nothing new is sent |
8) Your rights — exercised inside the app
| Right | Where |
|---|---|
| Export your data | Settings → My account → Export my data (a JSON file you keep) |
| Delete your account and data | Settings → My account → Delete account — deletes your data from our servers, then the account. Irreversible |
| Turn analytics off | Settings → Privacy — already off by default |
| Use without an account | Don't create one, or choose "Not now" |
Uninstalling the app removes everything stored on the device with it.
Rights the law gives you
For what we hold about you, you have the right of access, rectification and erasure, to restrict and to object to processing, and to port your data to another service, and to withdraw your consent at any time. Most of these you exercise yourself in Settings → My account; for anything you do not find there, write to us at the email at the end of this page — we reply within thirty days.
🔴 Right to complain: if our answer does not satisfy you, you may complain to Turkiye's Personal Data Protection Authority (KVKK — kvkk.gov.tr), or to the data protection authority of your country of residence if you are in the EU, the EEA or the UK.
9) Analytics and crash reports — only with your consent
Off by default. Not one event is sent before you opt in from Settings. Once you do, only these events are sent, anonymously and with no content:
first_open · plan_created · first_session_done · returned_day_2 · returned_day_7 · returned_day_30 · subscribed
Never sent with them: your name, email, what you memorised, any verse text, or any audio. Crash reports (Firebase Crashlytics) use the same consent and carry no personal data. Withdrawing consent stops sending immediately.
Measuring what succeeds and what fails
So we can tell where the app breaks on real devices, each core action records started, then completed, failed or timed out — under the same consent, so with no consent nothing is sent.
The actions measured are: opening the app · signing in · downloading the Mushaf · starting a memorisation session · starting review · playing recitation · recording for recitation · saving progress · completing a session · checking the subscription.
Nothing is sent with this except: the action's name and outcome, the app version, the platform, the interface language, the mode you were in (memorise, review, wird or listen), and the type of the error, not its text — because an error's text can contain a path on your device.
⚠️ "Recording for recitation" means only that the microphone started or stopped and whether that succeeded — the audio is not sent, nor what you recited, nor the mistakes detected.
10) Permissions and why
| Permission | Why |
|---|---|
| Notifications | The alarm and memorisation reminders — the core of the app |
| Exact alarm (Android) | So the alarm rings on time, not whenever the system decides |
| Full-screen intent (Android) | The alarm screen appears while the device is locked, like any alarm clock |
| Boot completed (Android) | Re-schedules your alarms after the device restarts |
| Internet | One-time Mushaf download, page fonts, audio, and sync if you have an account |
| Microphone | Requested only for recitation (once enabled); audio is analysed and stays on your device |
11) Qur'an content, fonts and their sources
| Source | What comes from it |
|---|---|
| Quran Foundation | Mushaf text · page and line layout · page fonts (QCF V2) · translations and tafsir · and streaming of its reciters |
| Quranpedia | the Hafs text bundled in the app (so the Mushaf opens with no internet) · and the mutashabihat data |
| Quranic Universal Library (QUL) | the surah-header glyphs in the Mushaf font |
All attribution is shown in the app: Settings → About.
What is downloaded from their servers (Quran Foundation content and the streaming of its reciters) carries neither your account, nor your progress, nor what you have memorised — but, as with any connection on the internet, your device's IP address and what you requested do reach them. What they do with that is governed by their policies, not ours. ⚠️ The Quranpedia text and the mutashabihat are bundled in the app, so no request is made to them at all when those are used.
12) Age
Mueeny is for adults and youth; it is not directed at children.
🔴 To create an account or to consent to analytics you must be 16 or older — anyone younger should do neither except with a guardian's permission and supervision. The app itself works fully without an account and without analytics at any age, and its data stays on the device alone.
If we learn that an account was created otherwise, we delete it and its data; a guardian may write to us at the email at the end of this page.
13) Changes and contact
If this policy changes, the date above is updated; for material changes we notify you in the app.
Publisher: Mohamed Azizi · Contact: support@mueeny.com