Privacy Policy and Personal Data Notice

1. In short

• You don’t need an account to use Ayanur. We don’t ask for your name, email address or phone number.
• There are no ads in the app. We don’t track you across other apps and websites, and we don’t access your advertising identifier.
• The app contains no analytics or crash-reporting tool.
• The app keeps a single place: your phone’s location or a city you picked. Prayer times, the qibla, fasting times, notifications and widgets all use it, and the calculations run on your phone; your location is not sent to a server for them. Two optional features send only your approximate area: the weather, if you turn it on (to MET Norway, the Norwegian Meteorological Institute), and Find a mosque, if you use it (to a map server). Details in 4.4, 4.8 and section 6.
• Your dhikr counts, qada and private-mode records, reading progress, saved items and settings are stored only on your phone. Only what you add to Circles you join (the juz you take and finish, your dhikr contributions, an optional dedication) is kept on our server for that circle; it is linked not to your name but to a hash of a random key your phone creates (4.9).
• Live radio and the live Kaaba streams open directly from the broadcaster’s server when you tap play; as with any internet request, the broadcaster sees your IP address (4.10).
• If you buy Premium, your purchase record is kept by our subscription provider (RevenueCat) under a randomly generated ID. The App Store or Google Play takes the payment; your card details never reach us.

2. Data controller

The data controller under KVKK and the GDPR is Ayanur.app, which provides the Ayanur app and the ayanur.app website.

• Name: Ayanur.app
• Address: 2 Nolu Erdoğdu Mahallesi, Ortahisar, Trabzon, Türkiye
• Email: support@ayanur.app

Contact: support@ayanur.app (the same address handles support and privacy). If you live in the EU/EEA you can write to this address too; your right to complain to the data protection authority of your country always remains (section 12).

3. Data that stays on your phone

The following data is kept in the app’s storage on your phone. Unless the item says otherwise, it is not sent to us, to our servers, or to any analytics or crash-reporting tool. It is deleted when you delete the app (see “Circle key” below for the iOS Keychain exception).

• Location: If you allow it, your location is stored as coordinates rounded to about 1 km, or the city you picked by hand is stored. This is the app’s only location record: prayer times, the qibla, fasting and makruh times, the calendar, notifications, widgets, the living sky and (if you turn it on) the weather all use it. If you have granted location permission and no place is saved (for example, you skipped location during setup and granted permission later in your phone’s settings, or you reset your settings), the app saves your phone’s location as your place when it opens; no permission prompt is shown and a city you picked by hand is never replaced.
• Time zone: Read from your phone’s settings and used for prayer time calculations.
• Compass sensor: Read in real time for the qibla compass; not stored.
• Settings: Theme, language, prayer time calculation method, madhab and Asr preference, notification and adhan sound preferences.
• Worship and reading records: Dhikr counts, qada tracking and worship days, Quran reading progress, bookmarks, notes and memorisation records, items you saved and your collections.
• Private-mode record: This record, which may count as health-related, stays only on your phone. It never goes to analytics, crash reports or a server.
• Share cards: Share cards and the imsakiye image are made on your phone and handed to you through your phone’s share sheet; you choose where they go. We don’t access your photos.
• Notifications and adhan: Prayer notifications, the adhan, fasting and special-day reminders, spiritual reminders and the trial reminder are scheduled on your phone; while the app is closed they are also rescheduled on your phone when your phone allows it. We don’t send notifications from a server. Adhan sounds are built into the app. On Android, a plan of prayer times for up to the next 7 days is kept on your phone for prayer alarms and the countdown notification; it is rebuilt on your phone when the phone restarts, the app is updated, or the clock or time zone changes.
• Weather cache: If you turn the weather on, the latest forecast (approximate point, temperature, conditions, precipitation; up to 3 days) is kept on your phone. It is deleted when you turn the weather off. Your phone’s operating system may also keep the latest response in its own network cache for a while.
• Circle key: If you use Circles, your phone creates a random 32-byte key and keeps it in your phone’s secure storage (iOS Keychain, Android Keystore), tied to this device only; it is not moved to another phone through backups. The key is sent to our server with each circle request; the server doesn’t store the key itself, only its hash (4.9). On Android the key is deleted when you delete the app; on iOS, Keychain items can remain on the same phone after the app is deleted, so if you reinstall the app on the same phone your circles come back. The last view of the circles you joined and dhikr contributions not yet sent are also kept on your phone.
• Cache and downloads: Downloaded content packages (Quran text, translations, hadiths, duas and so on) are kept on your phone. Recitation and dua audio you listened to may stay in your phone’s cache for a while; surah audio you download for offline listening stays on your phone until you delete it (Settings › Downloaded surahs). Your last mosque search is kept on your phone too; it is no longer shown once it is older than 30 days.
• Widgets: The content shown in widgets is prepared on your phone and kept in the app’s own area on your phone; it is not sent anywhere. Counts you make on the dhikr widget are also kept there first and added to your dhikr counter when you open the app.

Your phone’s own backup (iCloud or Google backup) may include this data, depending on your phone’s settings. Those backups are governed by Apple’s or Google’s terms; Ayanur has no access to them.

If you export your qada record or your Quran reading backup (as a file or to the clipboard), you choose where it goes; Ayanur never sends a backup to any server.

4. Data that leaves your phone

4.1 Downloading content and images

When the app opens, comes to the foreground, or when you change your language or translation, it downloads content packages (Quran text, translations, hadiths, duas, the Beautiful Names), remote settings, the lists of backgrounds and videos, and their images from our servers. These requests are for public files and endpoints. They carry no identity, location or device identifier.

We prepare the texts in the content packages on our server from sources such as Tanzil, Quran.com / Quran Foundation, Turkey’s Presidency of Religious Affairs (Diyanet), HadeethEnc and Hisnul Muslim. Your phone does not connect to these sources and no data about you goes to them (for recitation and dua audio, see 4.5).

As with any internet request, the server sees your IP address, a client description (user agent) containing app and operating system details, and the name of the requested file. The file name can reveal which language or translation package you downloaded. We don’t use this information to identify you, build a profile or find your location. It stays for a short time in the security and operations logs of our hosting providers.

Providers: Supabase (database and file storage; project hosted in the EU, Frankfurt) and Vercel (ayanur.app).

4.2 Purchases and subscriptions

The App Store (Apple) or Google Play (Google) takes the payment. Your card or payment details never reach us; they are governed by Apple’s or Google’s privacy policy.

We use RevenueCat (RevenueCat, Inc., USA) to check your subscription status, restore your purchases and find out whether you are eligible for a trial or an offer. RevenueCat receives:

• a random, anonymous user ID generated by RevenueCat,
• the store’s purchase record: product, price, currency, date, trial or offer status, store country, store transaction and order number,
• technical information needed to provide the service (for example app and operating system version, IP address).

While purchasing is switched on in the app, the app contacts RevenueCat under this anonymous ID each time it opens to fetch prices and subscription status, even if you don’t buy anything, so RevenueCat also holds an anonymous customer record without purchases. Device identifier collection and diagnostics are turned off in RevenueCat. We don’t write your name, email or any other attribute to RevenueCat. We also don’t send which feature you tapped when the purchase screen opened.

RevenueCat also notifies our server of subscription events (such as a purchase, renewal, cancellation, refund or expiry). From these notifications we keep only: the event’s ID, type and time; the app, store and environment (test or live); the product, plan, Premium entitlement and the offer shown; trial, offer, trial-to-paid conversion or family-sharing status; the renewal count; the cancellation or expiry reason; price and currency; store country; estimated tax and store commission rates; the purchase and expiry dates and the billing grace period end date; and a pseudonymous ID that links events of the same subscriber (a SHA-256 hash of the RevenueCat ID). We don’t keep RevenueCat’s raw user ID, store transaction numbers or user attributes; the notifications contain no name, email or payment details. These records are kept on our server (Supabase, EU), cannot be reached from the app, and are used to keep subscription records, produce aggregate statistics, and answer refund and support requests.

We view purchase records and aggregate revenue and subscription statistics in the RevenueCat dashboard and in our admin panel.

4.3 Notification infrastructure on Android (Firebase)

The Android version of the app includes Google’s Firebase Cloud Messaging component. This component may register an installation-specific ID (Firebase installation ID) and a notification token with Google. Today we don’t send notifications from a server and we don’t receive this token; all notifications are scheduled on your phone.

4.4 Find a mosque (optional)

When you open Find a mosque and tap “Find mosques”, nearby mosques are searched in OpenStreetMap data through the public Overpass server (overpass-api.de). Only the surroundings of the grid square you are in are sent, not your exact location. Details in section 6.

4.5 Quran recitation and dua audio

When you listen to or download a recitation, the audio files come directly from EveryAyah.com or, depending on the reciter you choose, from the Quran portal of Turkey’s Presidency of Religious Affairs (webdosya.diyanet.gov.tr; Turkish reciters and Turkish translation audio). Passage (aşr) audio in the Library is streamed from the same Diyanet server, and the prayer duas in the Library and the Prayer guide from Diyanet’s Prayer Portal (namaz.diyanet.gov.tr). These servers see your IP address and the requested file (reciter, surah, ayah or dua). Your phone does not connect to Quran.com for audio or text.

4.6 External links

The “Watch on Instagram” or “Watch on TikTok” button on a video cover, the links on the Sources screen and the source links next to content, “Open in Maps” in Find a mosque (Apple Maps or Google Maps), the “Open on the broadcaster’s website” link on the radio card (diyanetradyo.com, diyanetkuranradyo.com), the “Open on the broadcaster’s channel” link on the live Kaaba card (the broadcaster’s official YouTube channel; the YouTube app opens if it is installed) and the support link open the relevant app or website in your phone’s browser. The location opened in Maps is the location of the mosque you picked. The opened service’s own privacy policy applies. The terms of use and this privacy notice open in the in-app browser.

If you share a circle invitation, you choose where the link goes in your phone’s share sheet (4.9).

4.7 Support

If you write to support@ayanur.app, your email address and message reach us through our email service provider. We use them only to reply to you and handle your request.

4.8 Weather (optional, off by default)

The weather on the Time details screen is off by default; no request is made unless you turn it on. If you do, the app gets the forecast directly from MET Norway (the Norwegian Meteorological Institute, Norway’s government weather agency, which publishes its data openly; api.met.no). Only the following is sent:

• the latitude and longitude of the place used for prayer times, rounded to one decimal (0.1° ≈ 11 km; everyone in the same square sends the same point),
• the app description MET’s terms of service require: the app’s name and version, ayanur.app and the support address (User-Agent). No device identifier, name or account information is sent.

Requests are made only while the app is open and the Time details screen is showing, and not repeated before the period MET states in its response has passed (usually at most once every half hour). Nothing is sent to Ayanur’s servers for the weather.

According to its terms of service, MET keeps the IP address and the coordinates of requests made directly from apps in its own logs (in its data centre in Oslo); according to its privacy policy, IP addresses for services that don’t require login are kept for up to 90 days. We don’t keep or see these logs.

You can turn the weather off at any time with the same switch; the latest forecast on your phone is then deleted and no request goes to MET. The data’s licence and attribution are on the Sources screen.

4.9 Circles (optional)

Circles are invitation-only Quran completion (hatim) and dhikr circles. When you create or join a circle, open your circles, or act in one (taking, releasing or finishing a juz, contributing dhikr, reporting), requests go to our server (ayanur.app; database Supabase, EU-Frankfurt):

• Identity: We don’t ask for a name, nickname, email, phone number or account. The random key your phone creates (section 3) is sent with each circle request; the server doesn’t store the key itself, only its SHA-256 hash as the identity of your circle membership. The hash links the same phone’s memberships across circles but doesn’t identify you.
• Circle details: type (hatim or dhikr), intention (general, for the deceased, for healing, Ramadan, holy night, Friday), an optional dedication line (up to 40 characters; links, @ and phone numbers are rejected), dhikr type and target, end date, totals, member count and creation time.
• Your contributions: when you joined and left, your role in the circle (creator or member), the juz you took and finished, the amount and time of your dhikr contributions.
• Report: If you report a circle, the reason (inappropriate, advertising, other) and your membership hash are recorded; there is no free text.
• Preventing abuse: For rate limiting, the membership hash and an HMAC of your network address (the /64 prefix for IPv6), taken with a secret key on the server, are kept; the raw IP address is never written to the database. These counters are needed only for the rate-limit window (one hour or one day); expired counters are deleted during later circle requests. Our hosting provider’s (Vercel) operations logs keep the IP address and request path (including the circle code) for a short time.
• Who sees what: Anyone with a circle’s invitation link or code sees its type, intention, dedication, progress and the number of participants; nobody can see who joined. Invitation pages (ayanur.app/h/…) are closed to search engines; link previews in messaging apps show only the circle’s type. The Ayanur team sees circles and reports in the admin panel and can close an inappropriate circle or remove its dedication. Every admin action is written to an audit log.
• About dedications: Dedications are not listed publicly, but anyone who gets the invitation link sees them. We recommend not writing someone else’s full name, health condition or contact details.

You can leave a circle in the app; your contributions stay as part of the circle’s total and your membership is marked as “left”. Retention and deletion: sections 11 and 13.

4.10 Live radio and live Kaaba

The Diyanet Radyo and Diyanet Kur’an Radyo streams on the radio screen and the Masjid al-Haram and Masjid an-Nabawi streams on the live Kaaba screen (Saudi Broadcasting Authority – SBA, Quran Channel and Sunnah Channel) open only when you tap play, directly from the broadcaster’s streaming server: Diyanet’s streaming infrastructure for radio (eustr76.mediatriple.net) and the broadcaster’s content delivery network for the Kaaba streams (Globecast, via Akamai: cdn-globecast.akamaized.net). As with any internet request, these servers see your IP address, the client description and which stream you opened. Ayanur doesn’t record or alter the streams, and nothing about them goes to our server. Each stream card shows the broadcaster’s name, a link to the broadcaster’s official live page (“Open on the broadcaster’s website” / “Open on the broadcaster’s channel”) and a note that the broadcast belongs to the broadcaster (4.6). The streaming servers’ logs are governed by the policies of the broadcasters and delivery providers.

5. Instagram and TikTok data

• We use Instagram API with Instagram Login only to read posts from our own Instagram account (@ayanurapp): post ID, link, type, date and cover image. Captions and comments are not retrieved.
• We don’t access your Instagram or TikTok account. There is no sign-in with these accounts in the app. We don’t receive your likes, views or follow lists.
• We copy cover images to our own storage. If a post is deleted on the platform, we delete its cover too.
• Our team adds TikTok videos by hand using their links. The title and author name from TikTok’s public oEmbed service appear only in our admin panel.
• There is no embedded Instagram or TikTok player in the app. When you tap the watch button, the post opens on Instagram or TikTok. Your activity there is governed by Meta’s or TikTok’s privacy policy.

Deleting Instagram data

Because we only read posts from our own account through Instagram, we hold no user’s Instagram data; there is no user data to delete. If you have a request anyway, write to support@ayanur.app.

6. Location

• We use location only while the app is open. We don’t ask for background location permission.
• One place: The app keeps a single place record (section 3) and every feature uses it. If you chose your phone’s location and permission is on, the place is refreshed quietly when the app opens, at most every 6 hours or when your time zone changes; a change of less than 5 km leaves the times as they are. A city you picked by hand never changes by itself.
• For prayer times and the qibla, approximate accuracy is enough: the phone’s last known location is used first; if there is none, a single low-accuracy reading is taken. Find a mosque takes a more precise reading at that moment (within a few hundred metres) to calculate distances to mosques; that reading is not saved, doesn’t change your saved place and stays on your phone, and only the grid area described below leaves it.
• We don’t use Apple’s or Google’s place-name service to find your city name (those services send coordinates to their servers). We pick the nearest city from a list built into the app.
• Weather (if you turn it on): Your place, rounded to 0.1° (≈ 11 km), is sent to MET Norway (4.8).
• Find a mosque: Your exact location is not sent to the map server. Your location is snapped to a grid square: about 2.2 km north to south, widened east to west according to latitude so that it is at least 4 km² everywhere (about 2.2 × 3.4 km in Istanbul). A search area around that square is sent; everyone in the same square sends the same area. Distances and ordering are calculated on your phone. As with any internet request, the server sees your IP address. You can also search using your saved place without granting location permission. We don’t keep, and can’t see, the Overpass server’s logs; they are governed by the operator’s policy.
• You can turn location permission off in your phone’s settings at any time and pick your city by hand.

7. Permissions

• Location (only while using the app): For prayer times, the qibla, fasting times, the living sky and widgets; and for the optional weather and Find a mosque. Asked during setup, on the Location screen or in Find a mosque; you don’t have to grant it.
• Compass sensor: For the qibla compass. No separate permission is asked; if you granted location permission, the compass also uses your phone’s heading to find true north.
• Notifications: For prayer notifications and the adhan, fasting and special-day reminders, spiritual reminders and the trial reminder. Asked during setup, in notification settings or when you turn on a reminder (for example the trial reminder); you don’t have to grant it.
• Alarms and reminders (Android): For delivering prayer notifications and the adhan on the minute. Asked in notification settings.
• Run at startup (Android): For rebuilding prayer alarms and widgets after a restart, an app update, or a clock or time zone change. Granted by the system; not asked.
• Foreground service – media playback, and keep awake (Android): For keeping Quran listening, live radio and the optional full adhan going while the screen is locked, and keeping the phone awake while the adhan plays. Granted by the system; a “Stop” button shows in the notification while playing.
• Add to photos (iOS): For saving a share card to your photos. iOS asks when you pick “Save Image” in the share sheet.

The app does not read your photos. Camera, microphone, contacts, calendar, background location and advertising ID permissions are not used. Contacts and calendar permissions are never requested. On Android the camera, microphone, photo and media reading, legacy storage, background location and advertising ID permissions are removed from the app even if an included library requests them.

8. Ads, tracking and profiling

• The app contains no ads and no advertising technology.
• The app does not track you as Apple defines it, so it does not show the App Tracking Transparency prompt on iOS and does not access the advertising identifier (IDFA). On Android the advertising ID permission is removed from the app.
• We don’t sell your data and don’t share it with data brokers.
• We make no automated decisions about you and build no profiles.

9. Legal bases and special categories of data

• Purchase record and subscription events (RevenueCat and our server): To provide and restore the subscription and determine offer eligibility. KVKK Art. 5(2)(c) (formation and performance of a contract); GDPR Art. 6(1)(b).
• Aggregate purchase statistics: To evaluate the service and pricing. KVKK Art. 5(2)(f) (legitimate interest); GDPR Art. 6(1)(f).
• Server and provider logs: To deliver content, keep the service secure and prevent abuse. KVKK Art. 5(2)(f); GDPR Art. 6(1)(f).
• Find a mosque search: To run the search you asked for. KVKK Art. 5(2)(c); GDPR Art. 6(1)(b).
• Weather (approximate location to MET Norway): To show the weather you turned on. Your explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)); you can withdraw it at any time by turning the weather off, which does not affect processing before that.
• Circles (membership hash, contributions, dedication): To provide the circle you joined or created. KVKK Art. 5(2)(c); GDPR Art. 6(1)(b).
• Circle rate limiting and reports: To prevent abuse and remove inappropriate content. KVKK Art. 5(2)(f); GDPR Art. 6(1)(f).
• Android notification ID (Firebase): To run the notification infrastructure. KVKK Art. 5(2)(f); GDPR Art. 6(1)(f).
• Support messages: To answer your request. KVKK Art. 5(2)(c) and 5(2)(f); GDPR Art. 6(1)(b) and 6(1)(f).
• Legal obligations: To respond to official requests and keep records. KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c).

How data is collected: Data is collected electronically and automatically when you use the app and the website (requests your phone or browser sends, purchase records from the store and RevenueCat), and by email when you write to us.

Special categories of data: Using Ayanur, buying Premium or joining a circle may allow an inference about your religious belief (KVKK Art. 6, GDPR Art. 9). A circle’s “for the deceased” or “for healing” intention and its dedication line may also contain information about someone else’s health or death. That is why we designed the app this way: we don’t ask for an account; we don’t collect your name or email; your worship, reading and private-mode records never reach us or our servers; your purchase record and circle membership are kept only under random IDs and are not matched to your identity; the dedication line is kept short and doesn’t accept links or contact details. We don’t use this data to draw conclusions about your religious belief or health.

Do you have to give us data? No. Providing personal data is not a statutory or contractual requirement. If you don’t allow location, you pick your city by hand; if you don’t turn on the weather or use Find a mosque or Circles, the rest of the app works the same. If you buy Premium, the purchase record and the anonymous ID are needed for us to provide the subscription; without them Premium can’t be offered. The anonymous ID sent to RevenueCat when the app opens, to fetch prices and subscription status, is also part of how the app works. If you join a circle, your membership hash and contributions are needed for the circle to work.

10. International transfers

Some of the providers we use to run the service are outside Turkey:

• Supabase, Inc.: Database and file storage (including circle data and subscription events). Project in the EU (Frankfurt); company in the USA.
• Vercel, Inc.: Hosting ayanur.app and its endpoints (including circle requests). Company in the USA.
• RevenueCat, Inc.: Subscription infrastructure. USA.
• Google (Firebase): Android notification infrastructure. USA and other countries.
• Overpass server (OpenStreetMap data, overpass-api.de): Optional mosque search; the app connects directly.
• MET Norway (Norwegian Meteorological Institute): Optional weather; the app connects directly. Norway (EEA).
• EveryAyah.com: Recitation audio; the app connects directly.
• Presidency of Religious Affairs (webdosya.diyanet.gov.tr, namaz.diyanet.gov.tr): Recitation, translation, passage and dua audio; the app connects directly. Located in Turkey; listed here to show that the server sees your IP address.
• Diyanet radio streaming infrastructure (mediatriple.net): Live radio stream; the app connects directly.
• SBA stream, Globecast / Akamai content delivery network: Live Kaaba stream; the app connects directly. Broadcaster in Saudi Arabia; delivery network global.

Apple and Google run store and payment processing under their own responsibility. We don’t transfer data to the audio, streaming, map and weather servers the app connects to directly; your phone makes the request, for an action you started, and the server sees your IP address.

Transfers out of Turkey follow KVKK Article 9; transfers from the EU to third countries follow GDPR Chapter V. You can write to us to find out which safeguard a transfer to a given provider relies on.

11. Retention

• Data on your phone: Until you delete it or remove the app.
• Weather: The latest forecast on your phone until you turn the weather off; it stops being shown after 12 hours. For MET’s logs, see 4.8.
• Purchase record (RevenueCat) and subscription events (our server): For as long as the subscription relationship lasts and legal obligations require; deleted on request except where the law requires us to keep it.
• Anonymous record without purchases (RevenueCat): Updated for as long as you use the app. Once you remove the app, the ID is deleted from your phone; the record stays at RevenueCat but is no longer updated and can’t be linked to anyone.
• Circles: Circles and contributions are kept after a circle closes or ends; they are not deleted automatically today. To have a circle you created deleted, use the route in section 13.
• Circle rate-limit counters: Deleted during later circle requests once the rate-limit window (one hour or one day) has passed.
• Circle reports: For as long as the circle concerned is kept.
• Server and provider logs: For the hosting provider’s log retention period.
• Support emails: For as long as needed to answer and resolve your request; we delete them sooner if you ask.
• Find a mosque: We don’t store searches; the last search on your phone stops being shown after 30 days.

12. Your rights

Under KVKK Article 11 you have the right to learn whether your data is processed; to request information if it is; to learn the purpose of processing and whether data is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction under the conditions of KVKK Article 7; to request that these actions be notified to third parties who received the data; to object to an adverse outcome arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

If you are in the EU/EEA, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection under GDPR Articles 15–22. Where processing relies on your consent, you can withdraw it at any time.

How to apply: Write to support@ayanur.app with the subject “Personal data request”. KVKK requests can also be made by the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We reply free of charge within 30 days at the latest.

Because we don’t know who you are, we may ask for your store order number to find your purchase record (on Google Play it starts with “GPA.”; on the App Store it is the order ID on your receipt). We don’t ask for identity documents beyond that. If you haven’t bought anything, we have no information that links RevenueCat’s anonymous record to you, and we don’t collect extra data to link it (GDPR Art. 11). Your circle membership is also linked only to the key on your phone; since we don’t keep the key, we can’t match your contributions in a circle to you by email. If you send us the code of a circle you created, we can remove its dedication, close it or delete it.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (KVKK); in the EU/EEA, to the data protection authority of your country.

13. Deleting your data

• Data on your phone: Deleting the app is enough. Without deleting the app, you can reset your settings in Settings › Reset settings, and delete all private-mode records with “Turn off private mode” on the private-mode screen. Share cards saved to your photos, files you exported and surah audio you downloaded must be deleted separately (surah audio: Settings › Downloaded surahs).
• Weather: Turn the weather off; the latest forecast on your phone is deleted.
• Circles: You can leave a circle in the app. To have the dedication of a circle you created removed, or the circle closed or deleted, write to support@ayanur.app with the circle code.
• Purchase record: Write to support@ayanur.app with the subject “Data deletion request” and your store order number. We delete your record at RevenueCat and the subscription events on our server within 30 days at the latest, except where the law requires us to keep them, and let you know. Cancel your subscription in the store first: deleting the record does not cancel the subscription. For the deletion to be complete, also remove the app from your phone: while the anonymous ID stays on your phone, the next time you open the app a new, empty record is created at RevenueCat under that ID, and if you tap “Restore purchases” your purchase moves to that new record from the store’s records. For Apple’s and Google’s own purchase records, contact them.
• Anonymous record without purchases: When you remove the app, the ID is deleted from your phone; the record at RevenueCat remains but is no longer updated and can no longer be linked to anyone. If you restore the app from your phone’s backup (iCloud or Google backup), the ID may come back too.
• Support messages: Deleted on request.
• Android notification ID: Reset when you remove the app or clear its data.
• Account: Ayanur has no accounts, so there is no account to delete. Circle membership is not an account.

14. Children

Ayanur is a general app that anyone can open; it has no section aimed at children. Because there are no accounts, analytics or ads, we don’t ask anyone, including children, for personal information such as a name or email. Purchases are made through the store account holder. Parents can approve purchases with Apple’s Ask to Buy and Google Play’s family settings. If you think your child has emailed us, write to us and we will delete it.

15. Security

• All connections between the app and servers are encrypted (HTTPS), including connections to the weather, streaming and audio servers.
• Downloaded content packages are verified with a SHA-256 checksum before they are installed.
• Secret keys are kept only on the server and are not inside the app. The admin panel requires two-step verification.
• The circle key is kept in your phone’s secure storage; the server stores not the key itself but only its hash, and only a secret-keyed hash of your network address. The app has no direct access to the circle tables; only the server writes to them, through audited functions.
• Other data on your phone is protected by the operating system’s device encryption; Ayanur does not add its own encryption.

No method is perfectly secure. If a breach occurs, we will notify the Turkish Personal Data Protection Authority and you as required by law.

16. The ayanur.app website

The website has no ads, no analytics and no tracking cookies. Fonts are served from our own site. Our hosting provider (Vercel) keeps technical logs containing IP address and browser information, as with any website. This page and the terms of use use your browser’s language preference to choose which language to show; the preference is not stored. Circle invitation pages (ayanur.app/h/…) use no cookies, are closed to search engines and send no referrer on links to other sites; a page shows the circle’s type, intention, dedication, progress and number of participants. Because the circle code is in the page address, it appears in hosting logs. The admin panel is only for the Ayanur team, and session cookies are used only there.

17. Changes

We may change this notice. We will announce important changes in the app or on the website. The current date is shown at the top.

18. Contact

For any privacy question or request: support@ayanur.app