← Back Deutsch

Privacy Policy

Last updated: August 1, 2026 · Applies to: Iqra – Quran & Arabic Learning (Android, iOS & Web), version 1.0.5 and later.

1. Data Controller

Controller within the meaning of the GDPR:
Usman Halwani
Bonn, Germany
Email: info@iqra-app.com
Web: https://iqra-app.com

2. Plain-language summary

• Iqra requires no account. Except for optional Web TTS proxy requests described in section 3.5, no personal data reaches infrastructure operated on our behalf.
• All learning content (progress, bookmarks, settings) is stored only locally on your device.
• The app uses the internet only for: audio streaming, fonts, text-to-speech, speech recognition, and the optional retrieval of prayer times.
• For these connections, your IP address is transmitted to the respective providers.
• The app contains no advertising, no tracking, and no analytics SDKs.

3. Data we process

3.1 Data stored locally on your device

The following data is stored exclusively in your device's local storage (SharedPreferences and the Hive database) and is not transmitted to us or to any third party:

• Learning progress (completed lessons, letters, words, quiz results)
• Bookmarks and reading position in the Quran
• App settings (font size, theme, reciter, language)
• Streak data and daily learning goal
• Hifz tracker entries (memorized Surahs)
• An anonymous device hash for an optional leaderboard (see 3.4)

You can delete this data at any time via Settings → Reset Data.

3.2 Microphone & speech recognition

Sensitive permission

The app contains pronunciation exercises in which you repeat Arabic words. For this, the microphone is used (Android permission RECORD_AUDIO; iOS NSMicrophoneUsageDescription).

• Speech recognition is activated only after your explicit confirmation in an in-app dialog.
• Audio capture happens only while the recording button is active (max. 6 seconds per attempt).
• Audio is not recorded, not stored, and not sent to our servers.
• Speech recognition itself is performed by the operating system:
  • Android: via Google Speech Services. Audio is briefly transmitted to Google servers to produce text. Google's Privacy Policy applies.
  • iOS: on-device (Apple Speech) or via Apple servers. Apple's Privacy Policy applies.
• Iqra receives only the recognized text back, in order to compare your pronunciation with the target word. This comparison happens entirely on your device.
• You can revoke the microphone permission at any time in your device's system settings without losing other app functionality.

3.3 Audio recitation (streaming)

Quran audio recitations are streamed directly from everyayah.com. When streaming, your IP address is transmitted to the everyayah.com server. We do not operate that server and do not store personal data on it.

3.4 Anonymous device hash for leaderboard

On first launch the app generates a random local code (UUID) that is not linked to your identity and could be used for an optional cross-device leaderboard. In the current version this code is stored only locally and is not transmitted to us.

3.5 Text-to-speech (TTS)

Dictation exercises and some learning content use your operating system's text-to-speech via flutter_tts:

• Android: Google TTS by default. The text to be spoken may be sent to Google servers. You can choose a different on-device TTS engine in your Android system settings.
• iOS: Apple AVSpeechSynthesizer, fully on-device.
• Web: The browser's local SpeechSynthesis API is used first. If it is unavailable, the Arabic app text is sent through Iqra's serverless /api/tts proxy hosted by Vercel to Google Translate TTS. Vercel receives connection data such as your IP address; Vercel and Google receive the Arabic text. The proxy does not deliberately persist the text, but the providers may retain operational logs under their own policies.

The text being spoken contains only Arabic words, phrases or Quran verses from the app content – never personal data.

3.6 Fonts (Google Fonts)

The app loads fonts dynamically via the Google Fonts SDK. On first load this establishes a connection to Google servers and transmits your IP address. Loaded fonts are cached locally. More information: Google Privacy Policy.

3.7 Prayer times

When you open the optional prayer-times feature, the city you enter is sent together with the fixed country Germany to the AlAdhan API. AlAdhan also processes technically necessary connection data such as your IP address. Iqra does not use GPS or your device's location service. The city and retrieved prayer times are cached locally and can be deleted via Settings → Reset Data.

3.8 Local notifications

If you enable the reminder feature, the app schedules local notifications via flutter_local_notifications. These are processed exclusively on your device. No data is sent to push services (FCM, APNs).

3.9 Diagnostics from Google Play / App Store

If you installed the app via Google Play or the Apple App Store, the respective platform may, independently of us, collect anonymous crash reports and usage statistics. We only receive this data in aggregated form. The privacy policies of Google and Apple apply.

3.10 Google Analytics and Google Ads conversion measurement (Web only)

In the Web app, Google Tag Manager (container GTM-TRM3L95J) loads two Google tags: Google Analytics 4 (G-FTX9Y2V99K) and the Google Ads tag AW-18364917746. Both run in advanced consent mode with advertising and analytics consent denied by default. Tag Manager itself sets no cookies; it only controls whether and when those tags load. Before you consent, neither advertising nor statistics cookies are set; Google may receive cookieless consent and measurement signals, including technically necessary connection data. If you consent, Google LLC may process your IP address, device and browser data, pages visited, time on page, ad-click information, and conversion events, and may use cookies or similar technologies. The purposes are reach and usage measurement (Analytics) and measuring the effectiveness of our advertising (Ads). The legal basis for this consent-based processing is Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time through the Web app's permanently accessible privacy settings. The app remains fully usable without consent. For more information, see the Google Privacy Policy.

4. Data Safety overview

Data category	Collected?	Shared?	Purpose	Optional?
Personal identifiers (name, email, phone)	No	No	—	—
Approximate location (city entered manually)	Only when prayer times are used	Sent to AlAdhan	Calculate prayer times	Yes
Contacts	No	No	—	—
Microphone audio	Accessed only (not collected, not stored by us)	Sent to Google/Apple Speech for transcription only	Pronunciation exercise	Yes – feature is optional
App activity / learning progress	On-device only	No	App functionality	—
IP address	By service providers when a network feature is used	everyayah.com, Google Fonts, AlAdhan, Vercel (Web TTS), Google Ads on the Web	Audio streaming, font delivery, prayer times, Web TTS, conversion measurement	Advertising cookies and expanded Google Ads processing only after consent
Arabic TTS text	Only if local Web speech synthesis fails	Vercel and Google Translate TTS	Web speech output	Yes – feature is optional
Consent, advertising, and usage data	Cookieless consent and measurement signals on the Web; additional data and cookies only after explicit consent	Sent to Google Ads	Consent management and conversion measurement	Consent can be withdrawn at any time
Crash reports	By the platform (Google Play / Apple)	By the platform	Stability	Platform setting

5. Legal bases (GDPR)

• Art. 6(1)(a) GDPR (consent) – for microphone use, reminders you enable, and optional Google Ads conversion measurement on the Web.
• Art. 6(1)(b) GDPR (performance of a contract) – providing app features you actively use (e.g. audio streaming and prayer times).
• Art. 6(1)(f) GDPR (legitimate interest) – delivering fonts and platform diagnostics to provide a stable, readable app.

6. Recipients / third parties

• everyayah.com – Quran audio streaming.
• AlAdhan / Islamic Network – prayer-time calculation based on the city entered manually.
• Google LLC – Google Fonts, Google Speech Services (Android), Google TTS (Android, when system-default), Google Play (distribution & diagnostics), and Google Ads (cookieless consent and measurement signals on the Web; cookie-based conversion measurement only after consent).
• Vercel Inc. – hosting of the serverless Web TTS proxy and processing of technically necessary connection data.
• Apple Inc. – Apple Speech, Apple TTS, App Store (distribution & diagnostics) – iOS only.

Data may be transferred to third countries (in particular the USA) by these providers. Standard Contractual Clauses pursuant to Art. 46 GDPR and/or an adequacy decision (EU-US Data Privacy Framework) are in place with Google and Apple.

7. Retention

• Local app data: until you delete it via Settings → Reset Data or uninstall the app.
• Audio cache: until cleared via Settings → Clear audio cache.
• Third-party logs/diagnostics: per their retention policies.

8. Security

• All network requests use TLS/HTTPS.
• Data is stored only in the app's sandboxed local storage.
• Only the optional Web TTS fallback uses infrastructure operated on our behalf; its endpoint accepts short Arabic text only and does not deliberately persist request content.

9. Children & Families Policy

Iqra is suitable for all ages (rating "Everyone"). The app contains no displayed advertising, no in-app purchases, no external social-media links, and no user-generated content. The Google tag applies only to the Web app and starts with advertising and analytics consent denied; advertising cookies and expanded conversion measurement are enabled only after explicit consent. The requirements of the Google Play Families Policy and of COPPA are met.

10. Your rights (GDPR)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7(3))
• Right to lodge a complaint with a supervisory authority (Art. 77).

We do not deliberately persist Web TTS proxy requests. You can exercise these rights for locally stored data directly in the app (Settings → Reset Data) and contact us regarding provider-side processing.

11. Data & account deletion

Since the app does not require an account, no server-side deletion is necessary. To delete all data:

1. Open Settings → Reset Data in the app, or
2. Uninstall the app.

You may also send a deletion request to info@iqra-app.com.

12. Changes to this policy

This policy may be updated when app features change. The current version is always available at iqra-app.com/privacy.html. Material changes will be announced in-app.

13. Contact

For privacy-related questions: info@iqra-app.com