Privacy Policy
Last updated: October 2026 · applies to the hifaaz app and the website hifaaz.app
This is a translation of the German privacy policy (https://hifaaz.app/datenschutz/). If the two versions differ, the German version prevails.
1. In short
- hifaaz works without an account. There is no registration and no sign-in.
- Your learning progress, your settings and your first name stay on your device. We (the developer) do not receive this data.
- The app contains no ads, no tracking and no analytics tools from third parties.
- Your voice recordings in the test never leave your device and are only stored temporarily.
- For the recitations and the tafsir, the app loads content from external servers (EveryAyah, Quran.com, QuranEnc.com). This necessarily transmits your IP address to these servers (see section 5).
2. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Lass Khoshnaw
Tapachstr. 71A
70437 Stuttgart
Germany
Email: salaam@hifaaz.app
No data protection officer has been appointed, as the legal requirements for this are not met.
3. Data stored on your device
The app stores the following data exclusively on your device (iOS: in the app's storage; Android: in the app's preferences). It is not transmitted to us:
| Data | Purpose |
|---|---|
| First name (optional) | Greeting on the home screen |
| Learning progress (learned verses, review status, learning time per day, streak) | Continuing, daily goal, reviews, statistics |
| Settings (daily goal, reciter, audio quality, translation, appearance, reminder, etc.) | Customizing the app |
| Bookmarks and reading position | Continuing to read where you left off |
| Recent searches | Faster search |
| Downloaded recitations (only if you download surahs or the whole Quran) | Learning without an internet connection |
| Approximate location (only for the “After Fajr” reminder, see section 6) | Calculating the Fajr time |
Deletion: You can change individual data in the app (e.g. your first name, or saved surahs under Settings → Offline). All data is deleted completely when you remove the app from your device.
Device backups: If you have enabled backups on your device (iOS: iCloud Backup or a backup on a computer; Android: automatic backup to your Google account), this app data may be part of the backup. You manage these backups yourself; they are subject to the privacy policies of Apple or Google. We have no access to them.
Legal basis: Storing this information on your device is strictly necessary for the functions you request (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). We do not process any personal data in doing so.
4. Microphone and voice recordings
In test mode you can record your recitation to compare it with the reciter's. For this, the app asks once for access to the microphone. You can also use the app without recording.
- The recording is processed only on your device (showing the waveform, playing it back for comparison).
- It is not uploaded and not transmitted to us or to third parties.
- It is kept only temporarily in the app's temporary storage and is deleted as soon as you start a new recording, move on to the next verse or leave the test; the operating system automatically removes any leftover temporary files.
- There is no speech recognition or analysis on servers.
You can revoke microphone access at any time in your device settings.
Legal basis: The recording only takes place when you start it yourself (Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG); microphone access is based on your permission in the operating system.
5. Loading content from the internet
For the app to work, it loads certain content from external servers. With each request, your IP address, the time, the requested file (e.g. which verse) and technical details about the connection (e.g. operating system version) are necessarily transmitted to the respective server. Without this transmission the content cannot be delivered. We ourselves do not receive this data.
5.1 Recitations (EveryAyah)
The reciters' audio files are loaded from everyayah.com – either during playback (streaming) or when you download surahs or the whole Quran for offline use.
- Provider: The operator of everyayah.com is not named on the website; as a contact, the website refers to the Quran.com support portal (quran.zendesk.com).
- Delivery: To our knowledge, the files are delivered via a global content delivery network (CDN77, operated by DataCamp Limited, London, United Kingdom), including from servers outside the EU, e.g. in the USA.
- Privacy notice: The website does not provide its own privacy notice.
5.2 Tafsir (Quran.com and QuranEnc.com)
When you open the tafsir for a verse, the app loads the text of the tafsir you have chosen – depending on the work, via the programming interface of Quran.com (api.quran.com) or of QuranEnc.com (quranenc.com, for “al-Mukhtasar” in English, French, Turkish and Kurdish).
Quran.com:
- Provider: Quran Foundation, Inc., a non-profit organization based in New York, USA
- Provider's privacy notice: https://quran.com/privacy
QuranEnc.com:
- Provider: QuranEnc.com (Encyclopedia of the Translations of the Meanings of the Holy Quran). The website does not name an operator; among those involved, it lists the Rowwad Translation Center and the Islamic Content Service Association, both in Saudi Arabia. Contact: https://quranenc.com/en/home/contact_us
- Privacy notice: The website does not provide its own privacy notice.
Transfers to third countries: The providers are based in, or also deliver from, countries outside the European Union, in particular the USA and – for QuranEnc.com – Saudi Arabia. Your IP address is transmitted there. There is no adequacy decision of the EU Commission for Saudi Arabia. For the USA, an adequacy decision of the EU Commission (EU-US Data Privacy Framework) only covers organizations certified under it; to our knowledge, the providers named are not certified. It therefore cannot be ruled out that authorities there access this data without you having the same legal remedies as in the EU. The transfer is necessary to provide you with the function you requested (recitation or tafsir) (Art. 49(1)(b) GDPR). If you do not want this, you can use the app without these functions: the app plays surahs you have already downloaded without a connection.
Legal basis: Art. 6(1)(b) GDPR (providing the functions you use) and Art. 6(1)(f) GDPR (legitimate interest in a working app).
6. Daily reminder and location (“After Fajr”)
6.1 Notifications
If you choose a daily reminder, the app asks for permission to show notifications. Reminders are scheduled locally on your device. There is no notification server; we do not send push messages and receive no data about whether or when you see a notification.
You can turn off the reminder in the app or revoke the permission in your device settings.
6.2 Location for the Fajr time
Only if you choose the “After Fajr” reminder does the app ask for your location, to calculate the time of the Fajr prayer where you are.
- Only an approximate location is requested (iOS: reduced accuracy; Android: approximate location), and only while you are using the app.
- The calculation takes place entirely on your device. Your location is not transmitted – neither to us nor to third parties.
- The coordinates are stored locally so that the app does not have to ask again and again, and they are deleted together with the app.
- If you decline, the app reminds you at 6:00 a.m. instead.
Legal basis: Your consent via the operating system's location permission (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can revoke it at any time in your device settings.
7. Functions where you share data yourself
7.1 Suggesting improvements
Under Settings → Send a suggestion or report a bug you can write a suggestion or report a bug. The app opens your email app with the address salaam@hifaaz.app (or, if none is set up, the system share sheet). Along with your text, the app version, the operating system version and the device model are attached (so that bugs can be reproduced). Nothing is sent unless you confirm it yourself. When we receive your message, we process your email address and its content only to handle your suggestion and to reply if needed (Art. 6(1)(f) GDPR), and we delete them once they are no longer needed for this purpose.
7.2 Sharing verses
When you share a verse, the app passes the text to your device's share sheet. What happens next is up to the app you choose.
7.3 Rating hifaaz
Ratings use the function provided by Apple (App Store) or Google (Google Play). Their privacy policies apply; we only receive the public rating.
7.4 Donating to a charity
Under Settings → About you can donate to the charity Islamic Relief. When you tap it, their website opens in your browser (islamicrelief.de in German, otherwise donate.islamic-relief.org); the app does not transmit any data. The privacy notices of the organization and of the payment service used there apply to the website and the donation. We receive no information about your donation.
7.5 Instagram and TikTok
Under Settings → Follow hifaaz you will find links to our profiles. Only when you tap one does the profile open in the respective app or in your browser; from then on, the privacy policies of Instagram (Meta) or TikTok apply. hifaaz itself does not embed any functions of these networks and does not transmit any data to them.
8. App Store and Google Play
The privacy policies of Apple and Google apply to downloading and updating the app. Apple and Google may provide us with aggregated, anonymous statistics and crash reports – only if you have agreed to this on your device (iOS: “Share With App Developers”; Android: Android vitals). This information does not identify you and is used only to fix bugs.
9. Children
hifaaz is meant for everyone who wants to memorize the Quran, including children and teenagers. Since we do not collect personal data and there are no accounts, no personal information is needed to use the app. Parents can control microphone and location access in the device settings or with Screen Time / Family Link.
10. Your rights
Insofar as we process personal data about you (e.g. when you email us), you have the right to:
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on legitimate interests (Art. 21 GDPR),
- withdraw your consent with effect for the future (Art. 7(3) GDPR).
To exercise these rights, contact us at the address given above.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Baden-Württemberg (State Commissioner for Data Protection and Freedom of
Information Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de
Since the app data is stored only on your device, we cannot provide information about it or delete it – you always have full control yourself (by deleting the app).
11. This website (hifaaz.app)
The website is hosted on GitHub Pages, a service of GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, the Netherlands (part of GitHub, Inc., USA). When you visit it, GitHub processes technically necessary data – your IP address, the time, the page visited and details about your browser and operating system – to deliver the website. According to GitHub, the IP address is logged and stored for security purposes; GitHub decides how long. We ourselves do not receive this data.
This may involve a transfer to GitHub, Inc. in the USA. GitHub, Inc. is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the EU Commission.
The website sets no cookies, uses no tracking and loads no content from other servers: fonts and images are delivered with the site itself.
- GitHub's privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
12. Changes to this privacy policy
We update this privacy policy when the app, the website or the law changes. You can always find the current version at https://hifaaz.app/privacy/ and in the app under Settings → About.