Privacy Policy

1. Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide when you register for an account, use the app's features, or contact us. This may include:

• Account information: name, email address, username, and profile picture
• Authentication data: when you sign in with Google, we receive your name, email, and profile photo from Google Sign-In
• Onboarding information: date of birth and age, collected during the initial setup to personalise your experience and ensure age-appropriate use of the app
• Voice recordings: audio recordings you make during recitation practice sessions (see Section 3 for full details)
• Learning preferences and progress: your daily memorization goals, lesson structure, progress settings, Surah completion data (how much is memorized and how much remains), streak data, and session results including recitation error highlights

App Permissions

Ayafy requests the following device permissions:

• Microphone: required for live recitation practice and feedback. Audio is only captured during an active session you initiate.
• Camera: required only when you choose to take a new profile photo from within the app (Settings → Profile). The camera is never accessed passively or without your explicit action.
• Internet: required to sync your account, progress, and recitation data with our servers.

Information Collected Automatically

When you use Ayafy, we automatically collect certain technical information necessary to operate and improve the service:

• Device data: device type, operating system version, device identifiers, and hardware model
• Usage data: features accessed, session timestamps, pages viewed, and interaction patterns within the app
• Log data: IP address, error logs, and diagnostic information

Sensitive Information

Beyond voice recordings collected for recitation feedback (described in Section 3), we do not knowingly process sensitive categories of personal data such as biometric identifiers, health data, financial information, or political or religious beliefs as data categories.

2. How We Process Your Information

We process your personal information for the following purposes:

• Account creation and authentication: to create and manage your Ayafy account and enable sign-in
• Delivering app features: to provide recitation feedback, track Sabak/Sabki/Manzil progress, and personalize your memorization journey
• Improving our services: to fix bugs and improve app performance based on direct user feedback and support requests
• Customer support: to respond to your inquiries, resolve issues, and communicate important service updates
• Security and fraud prevention: to detect and prevent unauthorized access, abuse, or violations of our terms
• Legal compliance: to fulfill our obligations under applicable law

The legal bases we rely on under GDPR for processing include: contract fulfillment (Art. 6b), legitimate interest (Art. 6f), and in some cases your consent (Art. 6a).

3. Voice Recordings & AI Processing

Recitation feedback is a core feature of Ayafy. When you practice reciting Quran, the app records your voice to evaluate accuracy and provide guided correction.

What we collect

Audio recordings are captured only during active recitation sessions — when you explicitly start a Sabak or recitation practice. We do not record audio passively or in the background.

How voice data is used

• To compare your recitation against Quran-aware speech recognition models and provide real-time feedback
• To highlight errors and suggest corrections aligned with Tajweed principles
• To track your recitation progress over time within your account

AI processing

Ayafy uses a custom Quran-aware speech recognition system to analyze your recitation entirely within our own infrastructure. Your audio is not sent to any external AI or cloud provider for processing. This means:

• No third-party AI: recitation audio is processed by our own system and never transmitted to external AI providers
• No training by default: your voice recordings are never used to train or fine-tune our model without your explicit consent
• Minimal retention: audio is processed to generate feedback and is not stored beyond what is necessary to display your session results

Optional: help improve Ayafy (opt-in only)

You may choose to contribute your anonymized recitation data to help us improve the accuracy of our custom Quran speech recognition model. This is entirely optional and turned off by default — we will never use your data for training unless you explicitly enable it.

If you opt in (via Settings → Privacy → Improve Ayafy):

• A copy of your recitation audio and the corresponding Quran text is retained and used solely to train and improve our model
• All audio used for training is anonymized — your name, email, and account identifiers are stripped before any training use
• Training data is stored securely on our own infrastructure and is never shared with any third party

If you opt out (the default, or after disabling the setting):

• None of your recitation data is used for training — your audio is only processed to generate your session feedback and is not retained beyond that

You can change this preference at any time from Settings → Privacy → Improve Ayafy. If you withdraw consent, your previously contributed data will not be used in any future training runs within 90 days of opt-out.

Your control

You can delete individual session recordings or all recitation history at any time from within the app. You may also revoke microphone permission from your device settings at any time, though this will disable recitation features.

4. Sharing Your Information

We do not sell, rent, or monetize your personal information. We share data only in the following limited circumstances:

Service providers

We work with trusted third-party vendors who help us operate Ayafy, including:

• Firebase (Google): authentication, database, and cloud infrastructure
• Google Sign-In: account authentication

All service providers are contractually obligated to protect your data and use it only for the purposes we specify. We do not currently use third-party analytics or crash reporting tools.

Legal requirements

We may disclose your information if required by law, court order, or governmental request, or if we believe in good faith that disclosure is necessary to protect the safety of any person, investigate fraud, or enforce our terms.

Business transfers

If Ayafy is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice prior to such a transfer.

5. Data Storage & Transfer

Your personal information and voice recordings are stored on secure servers provided by Google Firebase, which operates infrastructure in multiple regions. Data may be processed and stored in the United States or other countries where our service providers operate.

Where data is transferred outside your country of residence, including outside the European Economic Area (EEA), we ensure appropriate safeguards are in place — including Standard Contractual Clauses or Data Processing Addendums with GDPR-compliant providers.

6. Data Retention & Account Deletion

We retain your personal information for as long as your account is active or as needed to provide you with the service. Specifically:

• Account data: retained while your account is active; permanently deleted after the 30-day grace period following an account deletion request
• Voice recordings and session data: retained until you delete individual sessions within the app, or until your account is permanently deleted
• Log and diagnostic data: retained for up to 90 days for security and debugging purposes
• Anonymized training data (only if you opted in): retained for ongoing model improvement; removed from future training runs upon opt-out or account deletion

Account deletion and 30-day grace period

You can delete your account at any time directly from Settings → Account → Delete Account within the app. When you initiate deletion:

• Immediate: your account is deactivated and you lose access to all app features
• 30-day grace period: your data is held securely for 30 days. If you sign back in during this period, your account and all data are fully restored — exactly as you left them — with no action required
• After 30 days: if you do not return within the grace period, your account and all associated personal data — including profile information, memorization progress, and recitation history — are permanently and irreversibly deleted from our systems

7. Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encrypted data transmission using TLS/HTTPS
• Secure token-based authentication via Firebase Auth
• Encrypted storage for sensitive data using device-level secure storage
• Access controls limiting who within our team can access personal data

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. By using Ayafy, you acknowledge and accept this inherent risk.

8. Children's Privacy

Ayafy is rated for users of all ages (4+) and is designed to support Quran learning for children, students, and adults alike. We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA) and applicable international laws.

For children under 13: We collect date of birth during onboarding and use it to identify users under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If a child under 13 is identified during onboarding, a parent or legal guardian must set up the account on their behalf. Additionally, Ayafy uses Google Sign-In as its only authentication method — Google's own systems further prevent children under 13 from creating a Google Account without parental approval via Google Family Link.

If you are a parent or guardian and believe your child under 13 has registered or provided personal information without your consent, please contact us immediately at hello@ayafy.com. We will promptly delete the account and any associated data.

For users 13–17: Minors between 13 and 17 may use the App with parental awareness and guidance. We encourage parents to monitor their child's use of the App.

We do not serve advertisements to any users, and we never sell data of any user — including minors.

9. Your Privacy Rights

General rights (all users)

Regardless of where you live, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate or incomplete information
• Deletion: request permanent deletion of your account and associated data
• Portability: request your data in a portable format where technically feasible

GDPR rights (EEA and UK residents)

Under the General Data Protection Regulation, you additionally have the right to:

• Right to be informed about data collection and use
• Right to restrict processing under certain conditions
• Right to object to processing based on legitimate interests
• Right not to be subject to solely automated decision-making
• Right to lodge a complaint with your local data protection authority

As a small independent developer, Ayafy qualifies for the SME exemption under GDPR and does not appoint a formal Data Protection Officer. For all privacy-related matters, contact us directly at hello@ayafy.com.

CCPA rights (California residents)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Delete personal information we have collected
• Opt out of the sale of personal information (note: we do not sell personal information)
• Non-discrimination for exercising your privacy rights

Exercising your rights

To exercise any of these rights, email us at hello@ayafy.com with the subject line "Privacy Rights Request." We will acknowledge your request within 7 business days and fulfill it within 30 days. Complex requests may take up to 60 days, in which case we will notify you of the extension.

10. Third-Party Services

Ayafy integrates with a limited set of third-party services to deliver its core features:

• Google Firebase Authentication: account creation and sign-in — Firebase Privacy
• Google Sign-In: OAuth-based account authentication — Google Privacy Policy
• Google Firebase (Firestore & Storage): database and cloud storage for your account and progress data

We do not currently use third-party analytics, advertising, or crash reporting SDKs. All recitation processing is handled by our own custom system.

Third-party services linked above have their own privacy policies. Ayafy is not responsible for the privacy practices of services outside our control.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users via email or prominent in-app notification at least 30 days prior to significant changes taking effect

We encourage you to review this policy periodically. Continued use of Ayafy after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:

We aim to respond to all privacy-related inquiries within 5–7 business days. For account deletion requests, data access requests, or any privacy concern, email us with the subject line "Privacy Request" and we will assist you promptly.