Privacy Policy

1. Who we are

This policy applies to the ZULFAA mobile app (Android package identifier com.zulfaa.app), designed and developed by MONER INTELLIGENCE SYSTEMS, which is responsible for the app and for the handling of data described here.

Privacy questions and requests can be sent to moner.intelligence@gmail.com, the same address ZULFAA publishes in Help & Support. This policy is also shown in full inside the app, where the text is the same as it is here.

2. The short version

ZULFAA works on your device first: the Qur'an, adhkar, du'as, prayer times and the qibla are all calculated and stored locally, and work offline. The app contains no analytics, tracking or advertising code, and never asks for your real name, email address, phone number or date of birth. ZULFAA does not sell your data, does not use it for advertising, and does not use tracking or analytics; it sends data to external services only where that is necessary for the functions described in this policy.

3. Competition account and username

ZULFAA uses a technical account dedicated to the competition, which does not require you to enter an email address or a password. It holds your competition participation data, such as your progress, results, balance and rank. This identifier is not shown to other users. Choosing a username remains optional for using the app in general, but it is required in order to take part in the ranked Daily Challenge. Once you choose a username it becomes public and may appear on the Honor Board beside your rank and your token balance, so it is advisable to choose a name you are comfortable showing to others.

4. What stays on your device

Kept in local storage on your device:

• your interface language;
• your prayer location, calculation method, madhhab and time adjustments;
• your live-qibla preference;
• your notification preferences;
• Qur'an reading progress, bookmarks, last position and chosen reciter;
• saved and favorited verses, du'as and adhkar;
• adhkar progress;
• your reading history;
• the technical session data required to maintain the competition account;
• a copy of the username the server last confirmed, kept so your own name is still shown to you when your account cannot be reached;
• and a short-lived cache of the tafsir passages you have opened.

None of these settings are synced between your devices or uploaded to an account. ZULFAA itself neither syncs them nor uploads them. Android's own system backup is a separate matter and is under your control: if device backup is switched on in your Android settings, the system may include this app's data in the backup held in your own Google account, and restore it when you set up a new device. That backup belongs to you and to Google, not to ZULFAA, and you can switch it off in your device's backup settings.

What is sent to external services when you use particular features is set out under Third-party services.

5. Theme preference

If you choose an appearance for the app — light, dark, or following your device setting — that choice is stored on your device only. It is not sent to any server, not linked to your account, and not synced between your devices. It is an interface preference and says nothing about you. It is erased along with the rest of this device’s data by the clear button at the bottom of the privacy page in the app.

6. Prayer location

Prayer times are calculated on your device from the coordinates of the location you choose — either through your device's location permission or by picking your city manually. The coordinates and place name are stored on your device. They are not sent to the competition server and are not linked to your account; they reach an outside service only in the case described under Third-party services.

7. Live location and compass

When you turn on live tracking on the Qibla screen, the app reads your position from the device while that screen is open, to keep the qibla direction and distance current. The bearing is computed on the device. No movement trail or location history is recorded or stored. With your permission the app may also read the device orientation sensor to point the compass; those readings are used moment to moment and are never stored. ZULFAA does not use location in the background.

8. Notifications

Your notification preferences are stored on your device, and the schedule is worked out locally from your calculated prayer times. Nothing is pushed from a server, and enabling reminders sends nothing about you anywhere. On supported Android devices ZULFAA requests notification permission only after an explicit action to allow notification delivery, never silently at startup; Android then holds the schedule, so the five daily prayers, the pre-prayer reminder, morning and evening adhkar, your Qur'an wird and Islamic occasions can still reach you while the app is in the background or closed. If you also allow the system's precise-timing capability, prayer alerts are scheduled to the minute; without it Android may deliver some of them less precisely. Prayers set to adhan mode play the ZULFAA adhan bundled with the app, from your device, offline. The web build does not raise system notifications.

These are local notifications on your device — ZULFAA does not use push notifications for owner announcements, advertising or marketing.

9. Recitation and background playback

While a recitation is playing, ZULFAA runs a media-playback foreground service on Android so the recitation can continue from one ayah to the next while the app is in the background. Android requires a visible notice in exchange, so a plain ongoing notification appears for as long as playback lasts; it carries no personal data and no playback controls — the optional home-screen player widget is what carries the controls. The service holds audio focus and nothing else: it records nothing, collects nothing and sends nothing anywhere, and it stops when playback stops. The recitation audio itself is streamed from the providers named under Third-party services.

10. Qur'an, tafsir and saved items

The Qur'an text, the English translation, the adhkar and the du'as are bundled with the app and work offline. Your reading progress, bookmarks, favorites and saved items are kept on your device. Tafsir is the exception: it is not bundled, so opening a tafsir passage fetches it from Quran.com, an external content service, and caches it on your device for at most seven days. That request carries the surah and verse reference only.

11. Daily Challenge, tokens and the Honor Board

When you take part in the ranked Daily Challenge, your participation data — the question identifier and the option you picked — is sent to the competition service. Held under your competition account, and kept between sessions: your daily attempt, the answers you gave and their results, your token balance and lifetime total, and the record of each award. The Honor Board is public: a username, the token score for the selected period and the rank can appear on it. Tokens are a score inside ZULFAA: they have no monetary value and cannot be bought, sold, transferred or exchanged.

12. Third-party services

ZULFAA contacts the following services, and only for the purposes given. When a request is made, the external service may receive technical connection information such as your device's IP address, and each service has its own privacy policy.

• Supabase — the competition backend: your competition account, username and competition data, whenever competition data is read or written.
• Photon (Komoot) — place search: the search text you type.
• Nominatim (OpenStreetMap) — reverse geocoding: the coordinates of the position being turned into a place name.
• Quran.com (Quran Foundation) — tafsir: the surah and verse reference, when you open a tafsir passage.
• EveryAyah and cdn.islamic.network — recitation audio: the surah, verse and reciter, while you play audio in the reader.

ZULFAA does not send your username or your competition account identifier to these services, except to the competition backend provider (Supabase), where it is required for the competition itself to work. The country and region lists, and the app's typefaces, are bundled with the app and need no request at all.

These providers operate their own infrastructure, which may be located outside your country of residence, so using the features above can involve an international transfer of the limited data listed for each service.

13. Permissions you control

ZULFAA may ask for three permissions, all optional: location (for prayer times and qibla), notifications (for reminders), and the orientation sensor (for the compass). The app works without them — only the related feature stops working — and you can withdraw any of them at any time in your browser or system settings.

14. Security

Every connection ZULFAA makes to an external service uses HTTPS, so the limited data described in this policy is encrypted in transit. The data kept on your device is held in the app's own private storage, protected by your device's own security.

The competition backend is protected by row-level security rules on every table, so a device can only read and write the competition records that belong to it, together with the data that is public by design, such as the Honor Board. The app ships with a publishable key only; no privileged key is contained in the app.

No system can be guaranteed to be completely secure, but because ZULFAA never asks for a real name, an email address, a phone number, a date of birth or a payment detail, there is no such information for it to hold.

15. Deleting your data

The button at the bottom of the Privacy page inside the app clears the ZULFAA data stored on that device: prayer location and settings, notification and qibla preferences, Qur'an progress, bookmarks, favorites, saved items, adhkar progress, history and interface language. It takes effect immediately and cannot be undone. It also removes the temporary tafsir cache stored on your device.

It does not delete your competition account: your competition account, username, token balance and Honor Board position are held on the server and are deliberately left in place, so that clearing one device does not silently destroy them.

Deleting the competition account is a separate action, also on that page: it permanently removes your competition account, username, token balance, token history, challenge attempts and answers, and your Honor Board position. If you use the competition features again afterwards, a new competition account is created for you and starts from zero.

16. How long data is kept

Competition data is kept only while the account is in use. A competition account that is still empty — no username, no challenge attempts or answers, no token history and a zero balance — may be deleted automatically after 60 consecutive days without activity. An account that carries a username or any competition history may be deleted automatically after 365 consecutive days without activity. Any new activity resets that period, so simply opening ZULFAA keeps an account alive.

You do not have to wait: you can delete your competition account yourself at any time, from the button at the bottom of the Privacy page inside the app. Deletion is permanent and removes the username, token balance, token history, challenge attempts and answers, and any Honor Board position. If you use the competition features again afterwards, a new competition account is created for you and starts from zero.

17. Ramadan Planner

This section appears only if the Ramadan Planner is available in your build of the app. If you use it, ZULFAA stores on the same server as your account, for you alone, one record per day of Ramadan: the answer you gave about fasting (fasting, exempt or not fasting), which of the five prayers you marked as prayed, and which of the Qur’an, dhikr, du’a and charity items you marked as done. A record is created only when you mark something yourself; the app never records a fast on your behalf, and “not answered” is its own state meaning you have not said. Each record is attached to the calendar date of the day you lived, not to a day number, because the day number is a label placed on a day afterwards. ZULFAA also stores, once for each Ramadan, the date you tell it Ramadan began for you: the app’s own estimate is a calculation, the real beginning is settled by moon sighting or by the authority you follow, and until you correct it the planner shows the estimate and says that it is one. That date comes from you — the app never works it out from your location — and it is kept on the server rather than only on this device so that the same month is numbered the same way on every device you sign in from. Changing or withdrawing it only changes how the days are labelled, and never alters, moves or deletes anything you recorded. This record describes religious practice, is never shown to anyone else, and is protected by the same row-level security as the rest of your account. So that the planner still opens without a connection, this device also keeps a copy of the dates your account last confirmed, and holds anything you mark while offline until it can be sent. Both are removed when you clear this device's ZULFAA data or when a different account signs in. You can change any day at any time, and deleting your account removes all of it. On the retention periods above: an account holding a Ramadan record or a confirmed Ramadan start is not treated as empty, so the 60-day rule does not apply to it — the 365-day rule does. You can also record in the app which religious authority you follow, or the name of your mosque. This is religious information, so it is kept on this device only unless you explicitly choose to save it to your account so that it is the same on your other devices; withdrawing that choice deletes it from the server. The mosque name is never sent to the server at all and stays on your device. None of it is sent to any third party or used for any analytics. Choosing an authority records who you follow and does not change the Ramadan dates the app shows you.

18. Umrah Savings

This section appears only if Umrah Savings is available in your build of the app. If you use it, ZULFAA stores on the same server as your account, for you alone: the amount you set as your goal, its currency, an optional target date, an optional saving plan, and every contribution you record with its amount, its date and any note you add. The progress the app shows is calculated from those figures and is not stored separately. ZULFAA is not a bank, a payment service or an investment service: it holds no payment details, connects to no bank, moves no money and holds none of your money; these are figures you type in order to keep track of savings you hold somewhere else. Because the note is free text, it is best not to type personal details into it. All of it is protected by the same row-level security as the rest of your account, so no other device can read it. So that your savings are still shown when the app opens without a connection, this device also keeps a copy of the figures the server last confirmed. That copy is replaced whenever the server answers, is removed when you clear this device's ZULFAA data or when a different account signs in, and is never sent anywhere. You can edit or delete any contribution at any time, reset the savings while keeping the goal, or delete the goal entirely, which takes its contribution history with it. Deleting your account removes all of it. On the retention periods above: an account holding a savings goal or a contribution is not treated as empty, so the 60-day rule does not apply to it — the 365-day rule does.

19. Children

ZULFAA is a general worship app and is not directed specifically at children. Ordinary use asks for no name, email address, phone number or date of birth. The only information a user intentionally makes public through the competition is the username they choose, which is shown publicly on the Honor Board, and it should not contain a real name or any other personal detail. A parent allowing a child to take part in the ranked challenge should be aware that the chosen username is shown publicly.

20. Changes to this policy

If the app's behaviour changes — a new service, a new kind of stored data, or a change to what is shown publicly — this page is updated and the last-updated date above changes with it.

21. Contact

The controls inside the app are also a direct route and need no message to anyone: you can clear your local data, and you can delete your competition account together with everything the server holds for it. If you would rather not create a public username or a competition participation record, simply do not enter the ranked challenge: your competition account stays empty, and it is subject to the retention periods described above.