Privacy Policy

Effective Date

2026-05-25

Last Updated

2026-10-10

App

Rawha: Quran & Prayer Times

Publisher and data controller

Ridvan Kizil, Türkiye, publishing as Rawha ("we", "us", "our")

Contact

privacy@rawhaapp.com

This Privacy Policy explains what information Rawha collects, how it is used, with whom it is shared, and the choices you have. By using Rawha you agree to this policy. If you do not agree, please do not use the app.

1. Summary (Plain English)#

2. Information We Collect#

2.1 Information you provide#

• Account information (only if you create an account): email address and an optional display name. Rawha has no photo upload — your avatar is the first letter of your name, or an emoji you pick for group features.
• Quran activity synced to your account (only while signed in): bookmarks, your last reading position and reading streak, and verse reminders — including any short reflection or action plan you type into a reminder. These are stored in your account so they follow you across devices.
• AI features (important — please read): Rawha includes several optional AI features powered by Anthropic (Claude): the Mental Wellbeing companion, AI mood reflection, the morning / evening spiritual guides, the prayer and memorization coaches, and Ask-AI on a verse. When you use any of these, the text you type — including anything you choose to share about your feelings, mental health, or personal situation — together with any relevant verse reference and your recent conversation history, is sent to our server and then to Anthropic to generate a response, with your account ID attached for rate limiting. Because some of this text can reveal information about your health or state of mind, we treat it as sensitive (special-category) data under GDPR Article 9 and only process it with your explicit consent, which the app asks for before your first AI message and which you can withdraw at any time (§6). You are never required to use these features, and you should not enter anything you are not comfortable sharing with an AI service.
• Recitation check (optional): Recitation Practice lets you record yourself reciting one verse. The recording stays on your phone unless you tap "Check my recitation". If you do, that recording (audio, at most 30 seconds) — and nothing else: no name, no email, no other data — is sent to our server and forwarded to ElevenLabs, a speech-to-text provider, which transcribes the words you recited so the app can show which of the verse's words it heard. This is a word check, not a judgement of your pronunciation or tajweed. We do not store the audio or the transcript; the only record we keep is a timestamp against your account for rate limiting. ElevenLabs' own retention applies to what it receives — see its Privacy Policy. The check is covered by the same explicit consent as the other AI features (§6). After the check, the app keeps the recording on your phone only so you can play it back, and deletes it when you leave the screen.
• Membership (optional): If you buy a membership for the AI features, the purchase is made through Apple or Google. We receive and store whether your account has an active membership, which plan, when it renews or ends, and whether it is in a free trial — never your card number, billing address or store account email. To connect the purchase to your account we give the store-billing service (RevenueCat, §4) your Rawha account id.
• Your acceptance of the Terms: when you accept the Terms of Service we record the version you accepted, the date and time, your app version, platform (iOS/Android) and app language, and attach it to your account. We keep it as evidence of the agreement; it is deleted with your account. We do not record your IP address for this.
• AI usage counters: to apply the free allowance and the member limits we keep a count of your AI requests and the size of each (number of tokens) — never their content — in a ledger only our server can read.
• Group features: If you create or join a Family Circle or Group Khatmah, your display name, avatar emoji, and the prayers / Juz you have completed within that group — plus any du'a or dedication you choose to share — are visible to the other members of that group.
• Free text you save (not sent to AI): journal entries, mood check-ins, intentions, and reflections you write are stored only on your device and are not uploaded — unless you send that text into an AI feature, a verse reminder, or a group feature, in which case the paragraphs above apply.

2.2 Information collected automatically#

• Device identifier: a randomly generated app-install ID (device_id) used to recognise your device across app launches. It is not your hardware identifier and it is reset when you reinstall the app.
• Location (only with your permission, foreground only): used for prayer times, Qibla direction, and the mosque finder. Your location is never stored on our servers. Three services receive it directly from your device, without any account identifier attached: your phone's operating-system geocoder (Apple on iOS, Google on Android) receives your precise coordinates to turn them into the city name shown on the prayer-times card; the Aladhan prayer-times API receives your coordinates rounded to about 1 km, and — only when you open the mosque finder — an OpenStreetMap Overpass mirror receives your coordinates and the search radius you chose. See §4.
• Crash reports: if the app crashes, it stores an anonymous crash report — the error message, a stack trace, coarse breadcrumbs (which screens were opened), app version and build, platform, OS version, device model, locale, and a random per-session ID that is not linked to your account — in our Supabase project. Reports never contain message text, journal content, or your identity; the app scrubs user content before anything leaves the device. Apple and Google may separately collect OS-level crash logs under their own policies if you opted into sharing them.

2.3 Information we do not collect#

• We do not access your contacts, photo library, calendar, SMS, call logs, browser history, or other apps.
• The microphone is used only if you choose to record your own recitation practice. The recording stays on your device unless you tap "Check my recitation", in which case only that clip is sent for transcription as described in §2.1 — it is never uploaded in the background or without that tap.
• We do not use the IDFA / Advertising ID.
• We do not use third-party advertising or analytics SDKs.

3. How We Use Information#

We use the information described above only to:

1. Provide core features (prayer times, Qibla, Quran reading, bookmarks and reading progress, journal, notifications).
2. Power the optional AI features described in §2.1.
3. Enable optional social features (Family Circle, Group Khatmah).
4. Send notifications you have opted into (prayer reminders, daily streak, group activity).
5. Maintain app stability, fix crashes, and prevent abuse (including rate-limiting AI requests).
6. Comply with legal obligations.

We do not use your data for advertising, profiling, or sale to third parties.

4. Third-Party Services#

The table below lists every outside service the app sends data to, and exactly what each receives.

We have no control over how Apple, Google, Anthropic, ElevenLabs, or the other services above process data they receive from your device; their own privacy policies govern that processing.

5. Storage & Security#

• Local data (journal, mood check-ins, intentions, streak counters, settings, the cached adhan audio) is stored in your device's app sandbox.
• Account data on Supabase is protected by TLS in transit and encryption at rest, with row-level security so that each user can read only their own rows (and, for groups, only the groups they belong to).
• We retain account data for as long as your account exists. Group Khatmah and Family Circle data are retained while the group exists.
• AI conversation history is retained. Your messages to AI features and the responses are stored in your account (the ai_conversations record) so the chat has context and history, and are kept until you delete your account (see §10) or ask us to remove them. Separately, Anthropic processes each message to generate the response under its own terms; see Anthropic's Privacy Policy. We do not use your AI conversations to train any model, and we do not sell them.
• Anonymous crash reports are deleted automatically after 30 days.
• Recitation recordings are not stored by us. When you tap "Check my recitation", the clip passes through our server to ElevenLabs and is discarded; neither the audio nor the transcript is written to our database. On your phone the file is kept only until you leave the screen.

No system is perfectly secure. You are responsible for the security of the device you use Rawha on.

6. Your Rights#

Depending on where you live, you may have rights under GDPR (EEA / UK), CCPA (California), LGPD (Brazil), PIPEDA (Canada), and similar laws, including:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate data.
• Deletion: ask us to delete your account and personal data (see §10).
• Portability: request a machine-readable export.
• Objection / restriction: object to certain processing.
• Withdraw consent: for processing based on consent — location and notifications (in your OS settings) and the AI features, including the recitation check (Profile → Withdraw AI consent, stop using them, or ask us to delete your conversation history).

To exercise any of these rights, email privacy@rawhaapp.com. We will respond within 30 days.

The legal bases for our processing under GDPR are: (a) your consent (location, notifications, the recitation check) and, for the AI features, your explicit consent under Article 9(2)(a) because your messages may reveal health information; (b) performance of a contract (running your account, sync, and groups); and (c) our legitimate interest in keeping the service stable and secure (crash reports, abuse prevention).

7. Children's Privacy#

Rawha is intended for users aged 13 and older (or the higher minimum age of digital consent in your jurisdiction). When you sign in you confirm that you meet this requirement.

• We do not knowingly collect personal information from children under 13 (or the applicable minimum age) without verifiable parental consent.
• If we learn that we have collected personal information from a child below that age, we will delete it.
• A parent or guardian who believes their child has provided us with personal information may email privacy@rawhaapp.com to request deletion.

8. International Transfers#

Your data may be processed in the United States and other countries where our service providers operate. We rely on Standard Contractual Clauses or equivalent safeguards for transfers out of the EEA / UK.

9. Notifications, Location & Microphone Permissions#

• Notifications are off by default. You explicitly grant permission. You can revoke it at any time in your OS settings.
• Location is requested only when you use the prayer-time, Qibla, or mosque-finder features. We use it only while the app is in the foreground. You can revoke it at any time in your OS settings.
• Microphone is requested only if you use the recitation practice recorder. Audio stays on your device and is transmitted only if you tap "Check my recitation" (§2.1), and then only that clip, only to ElevenLabs via our server.

10. Account & Data Deletion#

You can delete your account and all server-side data at any time:

In the app: open the Profile tab, scroll to the bottom, tap Delete Account, then confirm. Your account and its server-side data are deleted immediately. By email: send a deletion request from your account email to privacy@rawhaapp.com with the subject "Delete my Rawha account". We will process it within 30 days and confirm by email.

After deletion:

• Your profile, bookmarks, reading progress, reminders, group memberships, AI conversation history, and push tokens are erased from our active systems (immediately for in-app deletion; within 30 days for email requests).
• Backups containing residual data are rotated out within 90 days.
• Your local data (journal, mood check-ins, settings) is independent — clear it by uninstalling the app.

A standalone copy of these instructions is published at the URL in §13 so that people without the app can still request deletion.

11. Changes to This Policy#

We may update this Privacy Policy when the app changes. We will revise the "Last Updated" date and, for material changes, post an in-app notice and/or email you. Continued use after the change means you accept the revised policy.

12. Open Source#

Rawha uses open-source software and openly licensed content listed on our Open-Source Licenses page. None of these libraries receive personal data from us.

13. Hosted URLs#

This policy is published at:

• https://rawhaapp.com/legal/privacy

Account deletion instructions:

• https://rawhaapp.com/legal/delete-account

14. Contact#

Data controller: Ridvan Kizil, Türkiye (publishing as Rawha) Email: privacy@rawhaapp.com