Privacy Policy

1. Who we are

This policy applies to the ZULFAA mobile app (Android package identifier com.zulfaa.app), designed and developed by MONER INTELLIGENCE SYSTEMS, which is responsible for the app and for the handling of data described here.

Privacy questions and requests can be sent to moner.intelligence@gmail.com, the same address ZULFAA publishes in Help & Support. This policy is also shown in full inside the app, where the text is the same as it is here.

2. The short version

ZULFAA works on your device first: the Qur'an, adhkar, du'as, prayer times and the qibla are all calculated and stored locally, and work offline. The app contains no analytics, tracking or advertising code, and never asks for your real name, email address, phone number or date of birth. ZULFAA does not sell your data, does not use it for advertising, and does not use tracking or analytics; it sends data to external services only where that is necessary for the functions described in this policy.

3. Competition account and username

ZULFAA uses a technical account dedicated to the competition, which does not require you to enter an email address or a password. It holds your competition participation data, such as your progress, results, balance and rank. This identifier is not shown to other users. Choosing a username remains optional for using the app in general, but it is required in order to take part in the ranked Daily Challenge. Once you choose a username it becomes public and may appear on the Honor Board beside your rank and your token balance, so it is advisable to choose a name you are comfortable showing to others.

4. What stays on your device

Kept in local storage on your device:

• your interface language;
• your prayer location, calculation method, madhhab and time adjustments;
• your live-qibla preference;
• your notification preferences;
• Qur'an reading progress, bookmarks, last position and chosen reciter;
• saved and favorited verses, du'as and adhkar;
• adhkar progress;
• your reading history;
• the technical session data required to maintain the competition account;
• a copy of the username the server last confirmed, kept so your own name is still shown to you when your account cannot be reached;
• and a short-lived cache of the tafsir passages you have opened.

None of these settings are synced between your devices or uploaded to an account. ZULFAA itself neither syncs them nor uploads them. Android's own system backup is a separate matter and is under your control: if device backup is switched on in your Android settings, the system may include this app's data in the backup held in your own Google account, and restore it when you set up a new device. That backup belongs to you and to Google, not to ZULFAA, and you can switch it off in your device's backup settings.

What is sent to external services when you use particular features is set out under Third-party services.

5. Prayer location

Prayer times are calculated on your device from the coordinates of the location you choose — either through your device's location permission or by picking your city manually. The coordinates and place name are stored on your device. They are not sent to the competition server and are not linked to your account; they reach an outside service only in the case described under Third-party services.

6. Live location and compass

When you turn on live tracking on the Qibla screen, the app reads your position from the device while that screen is open, to keep the qibla direction and distance current. The bearing is computed on the device. No movement trail or location history is recorded or stored. With your permission the app may also read the device orientation sensor to point the compass; those readings are used moment to moment and are never stored. ZULFAA does not use location in the background.

7. Notifications

Your notification preferences are stored on your device, and the schedule is worked out locally from your calculated prayer times. Nothing is pushed from a server, and enabling reminders sends nothing about you anywhere. On supported Android devices ZULFAA requests notification permission only after an explicit action to allow notification delivery, never silently at startup; Android then holds the schedule, so the five daily prayers, the pre-prayer reminder, morning and evening adhkar, your Qur'an wird and Islamic occasions can still reach you while the app is in the background or closed. If you also allow the system's precise-timing capability, prayer alerts are scheduled to the minute; without it Android may deliver some of them less precisely. Prayers set to adhan mode play the ZULFAA adhan bundled with the app, from your device, offline. The web build does not raise system notifications.

These are local notifications on your device — ZULFAA does not use push notifications for owner announcements, advertising or marketing.

8. Recitation and background playback

While a recitation is playing, ZULFAA runs a media-playback foreground service on Android so the recitation can continue from one ayah to the next while the app is in the background. Android requires a visible notice in exchange, so a plain ongoing notification appears for as long as playback lasts; it carries no personal data and no playback controls — the optional home-screen player widget is what carries the controls. The service holds audio focus and nothing else: it records nothing, collects nothing and sends nothing anywhere, and it stops when playback stops. The recitation audio itself is streamed from the providers named under Third-party services.

9. Qur'an, tafsir and saved items

The Qur'an text, the English translation, the adhkar and the du'as are bundled with the app and work offline. Your reading progress, bookmarks, favorites and saved items are kept on your device. Tafsir is the exception: it is not bundled, so opening a tafsir passage fetches it from Quran.com, an external content service, and caches it on your device for at most seven days. That request carries the surah and verse reference only.

10. Daily Challenge, tokens and the Honor Board

When you take part in the ranked Daily Challenge, your participation data — the question identifier and the option you picked — is sent to the competition service. Held under your competition account, and kept between sessions: your daily attempt, the answers you gave and their results, your token balance and lifetime total, and the record of each award. The Honor Board is public: a username, the token score for the selected period and the rank can appear on it. Tokens are a score inside ZULFAA: they have no monetary value and cannot be bought, sold, transferred or exchanged.

11. Third-party services

ZULFAA contacts the following services, and only for the purposes given. When a request is made, the external service may receive technical connection information such as your device's IP address, and each service has its own privacy policy.

• Supabase — the competition backend: your competition account, username and competition data, whenever competition data is read or written.
• Photon (Komoot) — place search: the search text you type.
• Nominatim (OpenStreetMap) — reverse geocoding: the coordinates of the position being turned into a place name.
• Quran.com (Quran Foundation) — tafsir: the surah and verse reference, when you open a tafsir passage.
• EveryAyah and cdn.islamic.network — recitation audio: the surah, verse and reciter, while you play audio in the reader.

ZULFAA does not send your username or your competition account identifier to these services, except to the competition backend provider (Supabase), where it is required for the competition itself to work. The country and region lists, and the app's typefaces, are bundled with the app and need no request at all.

These providers operate their own infrastructure, which may be located outside your country of residence, so using the features above can involve an international transfer of the limited data listed for each service.

12. Permissions you control

ZULFAA may ask for three permissions, all optional: location (for prayer times and qibla), notifications (for reminders), and the orientation sensor (for the compass). The app works without them — only the related feature stops working — and you can withdraw any of them at any time in your browser or system settings.

13. Security

Every connection ZULFAA makes to an external service uses HTTPS, so the limited data described in this policy is encrypted in transit. The data kept on your device is held in the app's own private storage, protected by your device's own security.

The competition backend is protected by row-level security rules on every table, so a device can only read and write the competition records that belong to it, together with the data that is public by design, such as the Honor Board. The app ships with a publishable key only; no privileged key is contained in the app.

No system can be guaranteed to be completely secure, but because ZULFAA never asks for a real name, an email address, a phone number, a date of birth or a payment detail, there is no such information for it to hold.

14. Deleting your data

The button at the bottom of the Privacy page inside the app clears the ZULFAA data stored on that device: prayer location and settings, notification and qibla preferences, Qur'an progress, bookmarks, favorites, saved items, adhkar progress, history and interface language. It takes effect immediately and cannot be undone. It also removes the temporary tafsir cache stored on your device.

It does not delete your competition account: your competition account, username, token balance and Honor Board position are held on the server and are deliberately left in place, so that clearing one device does not silently destroy them.

Deleting the competition account is a separate action, also on that page: it permanently removes your competition account, username, token balance, token history, challenge attempts and answers, and your Honor Board position. If you use the competition features again afterwards, a new competition account is created for you and starts from zero.

15. How long data is kept

Competition data is kept only while the account is in use. A competition account that is still empty — no username, no challenge attempts or answers, no token history and a zero balance — may be deleted automatically after 60 consecutive days without activity. An account that carries a username or any competition history may be deleted automatically after 365 consecutive days without activity. Any new activity resets that period, so simply opening ZULFAA keeps an account alive.

You do not have to wait: you can delete your competition account yourself at any time, from the button at the bottom of the Privacy page inside the app. Deletion is permanent and removes the username, token balance, token history, challenge attempts and answers, and any Honor Board position. If you use the competition features again afterwards, a new competition account is created for you and starts from zero.

16. Children

ZULFAA is a general worship app and is not directed specifically at children. Ordinary use asks for no name, email address, phone number or date of birth. The only information a user intentionally makes public through the competition is the username they choose, which is shown publicly on the Honor Board, and it should not contain a real name or any other personal detail. A parent allowing a child to take part in the ranked challenge should be aware that the chosen username is shown publicly.

17. Changes to this policy

If the app's behaviour changes — a new service, a new kind of stored data, or a change to what is shown publicly — this page is updated and the last-updated date above changes with it.

18. Contact

The controls inside the app are also a direct route and need no message to anyone: you can clear your local data, and you can delete your competition account together with everything the server holds for it. If you would rather not create a public username or a competition participation record, simply do not enter the ranked challenge: your competition account stays empty, and it is subject to the retention periods described above.