← Back Deutsch

Privacy Policy

Last updated: September 27, 2026 · Applies to: Iqra – Quran & Arabic Learning (Android, iOS & Web), version 1.0.5 and later.

1. Data Controller

Controller within the meaning of the GDPR:
Usman Halwani
Bonn, Germany
Email: info@iqra-app.com
Web: https://iqra-app.com

2. Plain-language summary

• Iqra works without an account. Optional email/password accounts use Firebase Authentication; no names, email addresses or Firebase user IDs are sent as Iqra Analytics parameters.
• Your complete learning progress, bookmarks, and settings stay on your device. If mobile usage analytics is enabled, only the controlled events described in section 3.9 are transmitted.
• The app uses the internet for optional services such as audio streaming, text-to-speech, speech recognition, prayer times, and – only after technical production approval and your explicit permission – Firebase Analytics.
• Network connections involve technically necessary connection data. Google Analytics may derive coarse geographic information from network data; Iqra does not send GPS coordinates as Analytics parameters.
• The app contains no displayed advertising, uses no advertising ID, and does not use personalized advertising. Mobile analytics is off by default, may be refused, and can be withdrawn at any time in Settings. Refusing does not restrict the app.

3. Data we process

3.1 Data stored locally on your device

The following data is stored exclusively in your device's local storage (SharedPreferences and the Hive database) and is not transmitted to us or to any third party:

• Learning progress (completed lessons, letters, words, quiz results)
• Bookmarks and reading position in the Quran
• App settings (font size, theme, reciter, language)
• Streak data and daily learning goal
• Hifz tracker entries (memorized Surahs)
• An anonymous device hash for an optional leaderboard (see 3.4)

You can delete this data at any time via Settings → Reset Data.

3.2 Microphone & speech recognition

Sensitive permission

The optional pronunciation exercises in the Android and iOS apps use your microphone after your confirmation and system permission.

• Recording starts when you tap the record button. In this exercise path, Iqra does not save a persistent audio file or send audio or recognized text to its own servers.
• Recognition uses the operating system's speech service. On Android, the service depends on the device and its configuration, for example Google Speech Services. On iOS it is Apple Speech.
• This path does not enforce on-device-only recognition. Audio may be sent to the speech service's servers. This does not establish whether or how long the provider stores it. The service's terms and your system settings apply. For Google Speech Services, see the Google Privacy Policy; for Apple Speech, see the Apple Privacy Policy.
• The app receives the recognized text and compares it locally with the target word.
• You can revoke microphone permission at any time in your system settings.

3.3 Audio recitation (streaming)

Quran audio recitations are streamed directly from everyayah.com. When streaming, your IP address is transmitted to the everyayah.com server. We do not operate that server and do not store personal data on it.

3.4 Anonymous device hash for leaderboard

On first launch the app generates a random local code (UUID) that is not linked to your identity and could be used for an optional cross-device leaderboard. In the current version this code is stored only locally and is not transmitted to us.

3.5 Text-to-speech (TTS)

Dictation exercises and some learning content use your operating system's text-to-speech via flutter_tts:

• Android: Google TTS by default. The text to be spoken may be sent to Google servers. You can choose a different on-device TTS engine in your Android system settings.
• iOS: Apple AVSpeechSynthesizer, fully on-device.
• Web: The browser's local SpeechSynthesis API is used first. If it is unavailable, the Arabic app text is sent through Iqra's serverless /api/tts proxy hosted by Vercel to Google Translate TTS. Vercel receives connection data such as your IP address; Vercel and Google receive the Arabic text. The proxy does not deliberately persist the text, but the providers may retain operational logs under their own policies.

The text being spoken contains only Arabic words, phrases or Quran verses from the app content – never personal data.

3.6 Fonts (Google Fonts)

The app loads fonts dynamically via the Google Fonts SDK. On first load this establishes a connection to Google servers and transmits your IP address. Loaded fonts are cached locally. More information: Google Privacy Policy.

3.7 Prayer times

When you open the optional prayer-times feature, Iqra requests prayer times for the saved place. Berlin is the default if you have not entered a place. For a new request, the complete place or address you entered is sent to the AlAdhan API. Requests are not restricted to Germany. A city is sufficient; you do not need to enter a precise private address. AlAdhan also receives technical connection data such as your IP address. Iqra does not access GPS or your device's location service for this feature.

The input and returned prayer times are cached locally. A matching daily cache avoids a new request. You can delete the local data through Settings → Reset Data. This reset does not delete any data held by AlAdhan or its other providers. The scope and duration of provider retention are not confirmed here.

3.8 Local notifications

If you enable the reminder feature, the app schedules local notifications via flutter_local_notifications. These are processed exclusively on your device. No data is sent to push services (FCM, APNs).

3.9 Mobile usage analytics with Firebase Analytics

Depending on the app version and production approval, Iqra may use Google Analytics for Firebase to understand technical app usage, improve features and stability, and identify which parts of the app are used. Collection is disabled by default and is enabled only when the production build gate is also enabled and you explicitly agree. You may refuse or withdraw permission at any time under Settings → Privacy Policy → Usage analytics; the app remains fully usable without permission.

• Typical SDK data: app launches, sessions, engagement, app/platform and device information, a random app-instance identifier, and coarse geographic information derived by Google from network data.
• Custom events: screen and section views, Quran/Surah/Ayah opens, audio actions, bookmark actions, lessons, quizzes, progress views, language changes, and use of search.
• Controlled parameters: fixed screen, section, lesson, quiz, and reciter IDs; Surah/Ayah numbers; language code; result count; and completion/quiz percentages.
• No free-form search text, names, email addresses, Iqra user IDs, or GPS coordinates are sent as custom Analytics parameters.
• Advertising ID, ad storage, ad user data, and ads personalization are disabled. The data is not used for personalized advertising.

3.10 Diagnostics from Google Play / App Store

If you installed the app via Google Play or the Apple App Store, the respective platform may, independently of us, collect anonymous crash reports and usage statistics. We only receive this data in aggregated form. The privacy policies of Google and Apple apply.

3.11 Google Ads conversion measurement (Web only)

In the Web app, Google tag AW-18364917746 loads in advanced consent mode with advertising and analytics consent denied by default. Before you consent, no advertising cookies are set; Google may receive cookieless consent and measurement signals, including technically necessary connection data. If you consent, Google LLC may process your IP address, device and browser data, pages visited, ad-click information, and conversion events, and may use cookies or similar technologies. The purpose is to measure the effectiveness of our advertising. The legal basis for this consent-based processing is Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time through the Web app's permanently accessible privacy settings. The app remains fully usable without consent. For more information, see the Google Privacy Policy.

3.12 Optional account with Firebase Authentication

Iqra can be used as a guest. If you create an email/password account, Google Firebase Authentication processes your email address, Firebase user ID, authentication credentials and optional display name to register you, sign you in, restore your session and manage the account. Iqra does not use these data for advertising or send them as Analytics parameters. Learning progress, language, settings, Hifz and downloaded audio remain on this device and are not synchronized through this account.

4. Data Safety overview

Data category	Collected?	Shared?	Purpose	Optional?
Email address, Firebase user ID, optional display name	Yes, if you create an account	Google/Firebase as authentication service provider; further disclosure requires separate review	Registration, sign-in and account management	Account is optional; these data are required for an email account except display name
Place or address entered (depending on the input, a city or a precise place)	Sent to AlAdhan when the feature is used	Sent to AlAdhan; no confirmed retention period	Calculate prayer times	Yes, the feature is optional
Contacts	No	No	—	—
Microphone audio	Processed by the system speech service; no persistent recording by Iqra	Sent to the system speech service and, for server-based recognition, its servers	Pronunciation exercise	Yes, the feature is optional
App activity / learning progress	On-device only	No	App functionality	—
App interactions / session data	Yes, only when mobile Firebase analytics is enabled in the distributed build and the user has agreed	No if Google acts solely as processor/service provider; legal confirmation required	Analytics, stability, feature improvement	Optional; refusal and withdrawal are available at any time without restricting functionality
Device or other IDs	Yes, random app-instance/installation identifier when analytics is enabled	As above, subject to contract and account review	Installation and session analytics	As above
Approximate location from network data	Yes, country/region information may be derived server-side when analytics is enabled	As above, subject to contract and account review	Analytics	As above
IP address	By service providers when a network feature is used	everyayah.com, Google Fonts, AlAdhan, Vercel (Web TTS), Google Ads on the Web	Audio streaming, font delivery, prayer times, Web TTS, conversion measurement	Advertising cookies and expanded Google Ads processing only after consent
Arabic TTS text	Only if local Web speech synthesis fails	Vercel and Google Translate TTS	Web speech output	Yes – feature is optional
Consent, advertising, and usage data	Cookieless consent and measurement signals on the Web; additional data and cookies only after explicit consent	Sent to Google Ads	Consent management and conversion measurement	Consent can be withdrawn at any time
Crash reports	By the platform (Google Play / Apple)	By the platform	Stability	Platform setting

5. Legal bases (GDPR)

• Art. 6(1)(a) GDPR (consent) – for microphone use, reminders you enable, and optional Google Ads conversion measurement on the Web.
• Art. 6(1)(b) GDPR (performance of a contract) – providing app features you actively use (e.g. audio streaming and prayer times), including an email account you choose to create.
• Art. 6(1)(f) GDPR (legitimate interest) – delivering fonts and platform diagnostics to provide a stable, readable app.

Legal review remains open: This policy does not assert a new legal basis for mobile Firebase analytics. The technical implementation requires explicit permission and supports withdrawal at any time. Before production activation, it must still be confirmed whether this consent model is legally sufficient in every target region and for the mixed child/adult audience. The production build gate remains disabled until then.

6. Recipients / third parties

• everyayah.com – Quran audio streaming.
• AlAdhan / Islamic Network – prayer-time calculation using the complete place or address entered.
• Google LLC – Firebase Authentication (optional accounts), Google Fonts, Google Speech Services (when selected as the Android system speech service), Google TTS (Android, when system-default), Google Play (distribution & diagnostics), Google Analytics for Firebase (mobile usage analytics only when collection is enabled), and Google Ads (cookieless consent and measurement signals on the Web; cookie-based conversion measurement only after consent).
• Vercel Inc. – hosting of the serverless Web TTS proxy and processing of technically necessary connection data.
• Apple Inc. – Apple Speech, Apple TTS, App Store (distribution & diagnostics) – iOS only.

Data may be transferred to third countries (in particular the USA) by these providers. Standard Contractual Clauses pursuant to Art. 46 GDPR and/or an adequacy decision (EU-US Data Privacy Framework) are in place with Google and Apple.

7. Retention

• Local app data: until you delete it via Settings → Reset Data or uninstall the app.
• Audio cache: until cleared via Settings → Clear audio cache.
• Firebase Authentication account data: until the account is deleted; provider operational logs may follow separate retention rules.
• Firebase Analytics when collection is enabled: event data is currently retained for 2 months and user data for 14 months; the user-data period currently resets on new activity. These settings do not affect all aggregated standard reports.
• Third-party logs/diagnostics: per their retention policies.

8. Security

• All network requests use TLS/HTTPS.
• Learning data and settings are stored in the app's local sandbox; account data is processed by Firebase Authentication.
• Only the optional Web TTS fallback uses infrastructure operated on our behalf; its endpoint accepts short Arabic text only and does not deliberately persist request content.

9. Children & Families Policy

Iqra is suitable for all ages (rating "Everyone"). The app contains no displayed advertising, no in-app purchases, no external social-media links, and no user-generated content. On Google Play, the declared target audience includes children aged 6 and over. Production mobile analytics remains disabled until Google Play Families requirements, Apple's requirements, the applicable legal basis, and any necessary age/consent model have been confirmed.

10. Your rights (GDPR)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7(3))
• Right to lodge a complaint with a supervisory authority (Art. 77).

We do not deliberately persist Web TTS proxy requests. You can exercise these rights for locally stored data directly in the app (Settings → Reset Data) and contact us regarding provider-side processing and any Analytics data already transmitted.

11. Data & account deletion

Signed-in users can delete their Firebase account in the app under Settings → Account → Delete account. The app may ask for your current password to confirm a recent sign-in. The Firebase Authentication account, email address, user ID and optional display name are deleted. Signing out alone does not delete the account.

To request deletion outside the app, use Iqra account deletion requests or email info@iqra-app.com from your account address. Do not send your password. We verify account ownership before deleting the Firebase account. No separate user records in Firestore, Realtime Database or Firebase Storage are used by this app version.

Learning progress, language, settings, quiz and Hifz data and cached audio remain on your device because they are not linked to the Firebase user ID. Remove them separately with Settings → Reset Data and Settings → Clear audio cache, or uninstall the app. Provider logs and legally required records, if any, follow their applicable retention rules; Iqra has not established an exact provider-log period here.

Resetting local data does not automatically delete Analytics data already transmitted. Analytics uses a separate app-instance identifier and is not linked to your Firebase user ID by Iqra; contact us about a deletion request with the information available.

12. Changes to this policy

This policy may be updated when app features change. The current version is always available at iqra-app.com/privacy.html. Material changes will be announced in-app.

13. Contact

For privacy-related questions: info@iqra-app.com