Privacy Policy

1. Who we are

Nesiha App (“Nesiha”, “we”, “our”, “us”) operates the Nesiha mobile application (Android application ID nesiha.app) and the website www.nesiha.app, including the API at api.nesiha.app.

This policy describes what information leaves your device, what stays on it, who receives it, how long we keep it, and how you can delete it. It is written to match the current shipped app — including Google Play Data safety, Apple App Privacy, and account-deletion rules.

Privacy questions: support@nesiha.app or info@nesiha.app.

2. Quick summary

• Signing in with Google is required. We receive your email, name, and profile photo URL (email and profile scopes only).
• We store your Nesiha profile (name, country, optional phone) and favourites on our servers.
• Prayer Times and Qibla use precise location on your device. We do not upload GPS coordinates to Nesiha servers.
• If you tap Masjid Finder, the app can open Google Maps with your coordinates. That request goes to Google, not to Nesiha.
• Camera is a live Qibla background only. We do not record, save, or upload frames.
• Book screenshots you save go to your photo library on the device. We do not upload them.
• Adhan alerts are local alarms (not remote push). When you enable them, the app schedules exact prayer-time alarms on your device, may show a full-screen Adhan screen, play Adhan audio, and vibrate. After reboot they can be rescheduled on the device. We do not use Firebase Cloud Messaging or other push vendors.
• To keep prayer times accurate when the phone clock is wrong, the app may briefly contact public HTTPS sites only to read a network clock (HTTP Date). That is not analytics and is not sent to Nesiha servers.
• We do not sell personal information. We do not show ads. We do not use advertising IDs. We do not embed analytics or crash-reporting SDKs.
• We do not use generative AI. See AI Transparency.
• Delete your account in the app (Profile → Delete account) or at nesiha.app/delete-account.

3. What “collect” means here

For this policy and for store forms, collected means information that is transmitted off your device — to Nesiha or to a third party. Information that is only processed or stored on the device is described separately and is not collected by Nesiha.

4. Information we collect (leaves the device)

4.1 Account and profile

You must sign in with Google to use the app. We use Google Sign-In with email and profile scopes only (not contacts, calendar, Drive, or other Google data). We create a session with our authentication provider, Supabase. We collect:

• Email address
• Name from your Google account
• Profile photo URL from Google (a link — we do not download or store the image file, and this is not access to your camera roll)
• Authentication identifiers (Google account ID, Supabase user ID, Nesiha user ID, and session tokens)
• First name, last name, and country you enter during onboarding
• Phone number, only if you add one later in Profile (optional)
• Last sign-in time

4.2 Favourites (app activity)

If you heart or save a book, audio item, or video, we store that favourite on our servers and link it to your account so it is available when you sign in on the same account.

4.3 Messages you send us

• Website or in-app contact: name, email, subject, and message.
• In-app feedback: the message text you submit (the current app does not attach your account ID to feedback).
• Website account-deletion requests: name, email, and request details.

4.4 Technical data needed to run the service

When the app or website talks to our servers (api.nesiha.app), standard request logs may include IP address, date and time, requested URL, HTTP status, app or browser version, and basic device or network information. We use this to operate, secure, and debug the service — not for advertising, ranking, or profiling.

Library catalog data (Quran metadata, books, audio, video, reciters) is downloaded so the app can work. That catalog is not personal data about you.

4.5 Location sent to Google Maps (only if you use Masjid Finder)

Prayer Times and Qibla keep coordinates on the device. Masjid Finder is different: if you allow location and tap to open nearby mosques, the app opens Google Maps (external Maps app or browser) with a mosque search that includes your latitude and longitude. Google then processes that request under Google’s privacy policy. Nesiha does not receive or store those coordinates on our servers.

If you deny location, Masjid Finder can still open a general mosque search without your coordinates.

4.6 Network time check (clock sync for prayer / Adhan)

Prayer times and Adhan scheduling should follow real-world time, not a wrong phone clock. When the app syncs trusted time, it may send a short HTTPS request to a public endpoint (for example Google, Cloudflare, or Apple) and read only the HTTP Date response header. Those hosts may receive your IP address and user-agent under their own policies. Nesiha does not upload your location, account, or prayer schedule in that request, and we do not store the network time result on Nesiha servers — only a clock-offset may be cached on your device.

5. Information processed on your device (not uploaded to Nesiha)

The following is accessed or stored locally (for example in on-device cache). We do not send it to Nesiha servers unless this policy says otherwise.

• Precise location (while using the app): Prayer Times and Qibla. Coordinates may be cached on the device for those features. Not used in the background to track you. Not uploaded to Nesiha.
• Camera: live rear-camera preview behind the Qibla compass. We do not record, store, analyse, or upload frames. The camera is not used for identification, scanning, or AI.
• Photos / media library: if you take a screenshot of a book in the PDF reader, it can be saved to a Nesiha album in your gallery. Those images stay on your device unless you share them yourself.
• Notifications, exact alarms, full-screen Adhan, vibration, and wake lock: When Adhan alerts are enabled, the app schedules local alarms for upcoming prayers, may wake the device, vibrate, play Adhan audio from app assets, and show a full-screen Adhan alarm UI (Android full-screen intent where allowed). Alerts can be rescheduled after reboot using on-device receivers. Sound choice, on/off, and wallpaper stay on the device. We do not send remote push notifications and we do not upload Adhan audio or alarm history to Nesiha.
• Trusted clock offset: after a network time check, a skew value may be stored on the device so Adhan still fires at the correct real-world moment if the system clock is wrong.
• Compass / motion sensors: used on-device to point the Qibla compass (including tilt-aware heading where available).
• Reading progress, Mushaf bookmarks, theme, language, Adhan settings, last reciter, and offline downloads: stored locally. Reading progress and bookmarks are not synced to our servers.
• Cached library content: Quran, Hadith, duas, books, banners, and media files may be cached so the app works offline. This is catalog content, not a profile of you.
• Signed-in session cache: a copy of your profile and session may be stored locally so the app can open faster. It is removed when you sign out or delete the account.
• Text-to-speech: Asma ul Husna pronunciation uses your device’s speech engine. Audio is generated on the device and is not sent to Nesiha or to an AI provider.
• Background audio: Quran and other audio can continue while the app is in the background via a media playback foreground service. That is playback of library audio, not microphone recording.

6. App permissions and why we ask

You can deny optional permissions. Prayer Times falls back to a default location until you allow location. Qibla and nearby-mosque search will not work fully without location. Camera is optional for the compass background. Core library browsing still works.

We do not request contacts, SMS, call logs, microphone, Bluetooth, or advertising ID. We do not use App Tracking Transparency / IDFA. We do not track you across other companies’ apps or websites.

7. How we use information

• Create and maintain your account and keep you signed in
• Complete onboarding and show your name in the app
• Save and restore your favourites
• Provide Quran, books, audio, video, Hadith, duas, and other library content
• Calculate prayer times and schedule optional Adhan alarms on your device
• Sync a trusted clock offset on-device so Adhan is less affected by a wrong phone clock
• Respond to contact, feedback, and deletion requests
• Keep the service secure, prevent abuse, and fix bugs
• Check for app updates through Google Play on Android
• Comply with law where required

We do not use your data to build advertising profiles. We do not sell or “share” personal information for cross-context behavioural advertising (CCPA/CPRA). We do not use your personal data to train generative AI models.

8. Legal bases (EEA/UK and similar laws)

Where GDPR or similar law applies, we process personal data on these bases:

• Contract: account, sign-in, favourites, and delivering the app you asked for.
• Consent: optional phone number; optional device permissions (location, camera, notifications, exact alarms, full-screen Adhan, photos); Masjid Finder opening Maps with your coordinates; enabling Adhan alerts.
• Legitimate interests: security logs, abuse prevention, answering support messages, and on-device clock sync needed to deliver prayer times/Adhan you requested.
• Legal obligation: where we must keep a limited record of a deletion request or respond to lawful process.

Nesiha is an Islamic learning app. We do not ask you to declare your religion as a profile field. Using the app may indicate an interest in Islamic content; we process that only to provide the educational service you requested, not to profile or target you.

9. Sharing and third parties

We share information only as needed to operate Nesiha, at your request, or as required by law. We do not sell personal information. We do not share data with data brokers or ad networks.

• Google Sign-In / Google Play services: authentication. Google also processes data under its own policy. (Google Privacy Policy)
• Supabase: authentication and session management for your Nesiha account. (Supabase Privacy Policy)
• Google Maps: only if you use Masjid Finder. The app opens Maps with a mosque search (and your coordinates if you allowed location). Google then processes that request.
• Google Fonts / public HTTPS for fonts or clock sync: the app (google_fonts) and website (fonts.googleapis.com) may load fonts from Google. Separately, the app may contact public HTTPS hosts only to read an HTTP Date header for Adhan/prayer clock sync (section 4.6). Those hosts may receive your IP address and user-agent.
• Google Play In-App Updates: on Android installs from Play, the app may check Play for a newer version.
• Hosting / infrastructure: website, API, and database hosts process data only to provide those services.
• In-app WebView: Privacy Policy, Terms, How it works, Donate, and similar links open in an in-app browser with JavaScript enabled. If you open a third-party page (for example Buy Me a Coffee), that site may set its own cookies and collect data under its policy. We do not control it.
• Share sheet: if you share a book PDF or the app listing, the system share sheet sends the content you chose to the app you pick. That recipient is not Nesiha.
• Buy Me a Coffee: donations leave Nesiha. We do not receive your payment card details.
• App stores: Google Play and Apple may collect crash, ANR, and install diagnostics for apps they distribute. We may review those reports in the store consoles. That is not an analytics SDK we embedded in the app.
• Legal: we may disclose information if required by law, to protect users, or to protect Nesiha.

10. What we do not collect or do

• No advertising, no ads personalization, no advertising ID collection
• No third-party analytics or crash SDKs in the current app (no Firebase Analytics, Crashlytics, Sentry, Mixpanel, Facebook SDK, or similar)
• No background location tracking
• No remote push / FCM Adhan — Adhan is scheduled on the device only
• No access to contacts, SMS, call logs, or microphone
• No uploading of camera images or gallery screenshots to Nesiha
• No sale of personal information
• No tracking users across apps and websites for advertising
• No generative AI and no sending personal data to AI providers

If we add analytics, crash reporting, ads, remote push, or generative AI later, we will update this policy and Play / App Store disclosures before those features ship.

11. Retention

• Account, profile, and favourites: until you delete your account.
• Contact, feedback, and deletion-request messages: as long as needed to handle the request and keep a limited security/compliance record.
• Server logs: for a limited period needed for security and operations.
• On-device data: until you clear app cache, uninstall the app, or delete the relevant files from your device.

12. Security

We use HTTPS. App traffic to our API is on encrypted connections. Admin access to account and support data is restricted. Session tokens are stored by the authentication SDK on the device. No method of transmission or storage is 100% secure. Please keep your Google account protected; Nesiha sign-in depends on it.

13. Your rights and choices

Depending on where you live (including the EEA/UK, California, and other regions with similar laws), you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing, and to withdraw consent.

• Update name, country, and phone in the app profile.
• Revoke location, camera, notification, photo, exact-alarm, or full-screen-intent permission in system settings.
• Turn off Adhan alerts in Adhan Settings (stops future local schedules).
• Disconnect Google access to Nesiha from your Google account permissions.
• Delete your account and associated data (see below).

California / similar US state laws: we do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics for advertising. To exercise other rights, contact support@nesiha.app or use the contact page. You will not be discriminated against for exercising privacy rights.

14. Deleting your account

In the app: Profile → Delete account. That removes your Nesiha profile, favourites, and the linked sign-in record.

Without signing in: use the delete account page. You do not need to log in on the website. Web requests are processed within 30 days.

Deletion does not remove public library content (Quran, books, media). We may keep a limited record that a deletion request was received, as needed for security or legal compliance. On-device data (downloads, reading progress, Adhan settings) is removed when you uninstall the app or clear its storage.

15. Children

Nesiha is a general-audience Islamic learning app. It is not directed at children under 13, is not part of Google Play’s Designed for Families / Families policy programme, and is not in the Apple Kids category. We do not knowingly collect personal information from children under 13.

You must be at least 13 (or the minimum age in your country to have a Google account and use this type of service) to create a Nesiha account. Where local law requires a higher age (for example 16 in some EEA countries) without parental consent, that higher age applies. If you believe a child has provided personal data, contact us and we will delete it.

16. International processing

We and our processors (including Google and Supabase) may process data in countries other than yours. Where required, we rely on appropriate safeguards provided by those services (such as their standard contractual clauses or equivalent).

17. Google Play Data safety (declare the current app this way)

This section is for Play Console. It reflects the current app. If a feature changes, update both this policy and the Data safety form before release. Do not declare data types the app does not transmit off the device.

• Collected by the app (transmitted off device): name; email address; user IDs; other info (country); phone number (optional); app interactions (favourites); other user-generated content (feedback and contact messages).
• Location: precise location is used on-device for Prayer Times and Qibla (not stored on Nesiha servers). Precise location is transmitted to Google Maps only if the user opens Masjid Finder with location allowed. Declare precise location as collected and shared, optional, user-initiated, purpose: app functionality. Nesiha does not store GPS.
• Photos and videos: not collected. Gallery save is on-device only. The Google profile photo URL is account info (a link), not Photos data. Do not declare Photos as collected.
• Camera: not collected. Live preview only; no frames leave the device.
• Audio files / microphone: not collected. Library audio is content playback. No microphone permission.
• Calendar: not collected. Adhan uses local notifications / exact alarms and optional full-screen intent, not the device calendar and not USE_EXACT_ALARM.
• Full-screen intent / alarms: declare Adhan as an alarm-style core use of full-screen intent in Play Console when required. Permission is for prayer Adhan the user enabled — not for ads, spam, or unrelated alerts.
• Contacts: not collected.
• Device or other IDs: user IDs (Google / Supabase / Nesiha). Advertising ID: no.
• Shared: account data with Google (sign-in) and Supabase (auth). Location with Google Maps only if the user opens Masjid Finder. Fonts may send IP to Google.
• Purposes: app functionality, account management, and customer support. Not advertising. Not analytics (no analytics SDK). Not fraud prevention beyond ordinary security logs.
• Sold / ads / ads personalization / other sharing for advertising: no.
• Optional: location, camera, notifications, exact alarms, full-screen Adhan intent, photos save, and phone number are optional or permission-gated. Adhan stays off until the user enables it.
• Deletion: yes — in-app and at https://www.nesiha.app/delete-account (no website login required; processed within 30 days).
• Data encryption in transit: yes (HTTPS).

18. Apple App Privacy (declare the current app this way)

Apple’s “collect” means data transmitted off the device, not data that stays on the device. For App Store Connect privacy nutrition labels:

• Data Used to Track You: none. Do not declare tracking. The app does not use the Advertising Identifier or App Tracking Transparency.
• Contact Info: Email Address and Name (linked to identity; used for App Functionality / Account). Phone Number if the user adds it (optional).
• Identifiers: User ID (linked to identity; App Functionality / Account).
• User Content: Other User Content (feedback / contact messages).
• Location: declare Precise Location only if you treat Masjid Finder’s Maps URL as collection (transmitted to Google at the user’s request). Prayer Times and Qibla location that never leaves the device should not be declared as collected. Camera preview that never leaves the device should not be declared as collected. Photos saved only to the library should not be declared as collected.
• Usage Data / Diagnostics / Advertising Data: none from Nesiha SDKs. Store crash reports collected by Apple are Apple’s processing, not an in-app diagnostics SDK.
• Sensitive Info / Surroundings / Health / Financial: none collected by Nesiha.

19. Website

The website is informational. It does not require an account. We do not run advertising pixels or third-party analytics on the site at the time of this policy.

• Theme preference: stored in the browser as localStorage key theme (light/dark). It does not identify you.
• Google Fonts: Inter is loaded from Google Fonts. Google may receive your IP address.
• Contact and delete-account forms: we store the fields you submit (section 4.3).
• Newsletter UI: a newsletter box may appear on some blog pages. It is not connected to an email list at this time, so submitting it does not store an address with Nesiha. If we start a real newsletter, we will update this policy first.
• Hosting: the host may process standard server logs (IP, user-agent, requested URL) to deliver the site and protect it from abuse.

Essential storage (theme) is used to remember your display preference. Because we do not use non-essential tracking cookies, we do not show a marketing-cookie banner. You can clear site data in your browser at any time.

20. Changes

We may update this policy when the app or the law changes. The date at the top will change. Material changes will be posted on this page and, where appropriate, noted in the app. Continued use after an update means you accept the revised policy.

21. Contact

Privacy questions: support@nesiha.app or info@nesiha.app. You can also use the contact page.