Privacy Policy
Last updated: October 2026 · applies to the hifaaz app and the website daar.studio/apps/hifaaz
This is a translation of the German privacy policy (https://daar.studio/apps/hifaaz/datenschutz/). If the two versions differ, the German version prevails.
1. In short
- hifaaz works without an account. There is no registration and no sign-in.
- Your learning progress, your settings and your first name stay on your device. We (the developer) do not receive this data.
- The app contains no ads, no tracking and no analytics tools from third parties.
- Your voice recordings in the test never leave your device and are only stored temporarily.
- For the recitations, the tafsir, some translations and the transliteration, the app loads content from the internet (EveryAyah, the Quran Foundation's audio servers, our own server for Quran Foundation content, QuranEnc.com). This necessarily transmits your IP address to these servers (see section 5).
- We build no advertising profiles, sell no data and use no data to train AI.
2. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
daar.studio
Lass Khoshnaw
Tapachstr. 71A
70437 Stuttgart
Germany
Email: hifaaz@daar.studio
No data protection officer has been appointed, as the legal requirements for this are not met.
3. Data stored on your device
The app stores the following data exclusively on your device (iOS: in the app's storage; Android: in the app's preferences). It is not transmitted to us:
| Data | Purpose |
|---|---|
| First name (optional) | Greeting on the home screen |
| Learning progress (learned verses, review status, learning time per day, streak) | Continuing, daily goal, reviews, statistics |
| Settings (daily goal, reciter, audio quality, translation, appearance, reminder, etc.) | Customizing the app |
| Bookmarks and reading position | Continuing to read where you left off |
| Recent searches | Faster search |
| Downloaded recitations (only if you download surahs or the whole Quran) | Learning without an internet connection |
| Downloaded translations (French, Arabic) and transliteration from the Quran Foundation (only if you choose them) | Display without an internet connection (see section 5.2) |
| Approximate location (only for the “After Fajr” reminder, see section 6) | Calculating the Fajr time |
Deletion: You can change individual data in the app (e.g. your first name, or saved surahs under Settings → Offline). All data is deleted completely when you remove the app from your device.
Device backups: If you have enabled backups on your device (iOS: iCloud Backup or a backup on a computer; Android: automatic backup to your Google account), this app data may be part of the backup. You manage these backups yourself; they are subject to the privacy policies of Apple or Google. We have no access to them.
Legal basis: Storing this information on your device is strictly necessary for the functions you request (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). We do not process any personal data in doing so.
4. Microphone and voice recordings
In test mode you can record your recitation to compare it with the reciter's. For this, the app asks once for access to the microphone. You can also use the app without recording.
- The recording is processed only on your device (showing the waveform, playing it back for comparison).
- It is not uploaded and not transmitted to us or to third parties.
- It is kept only temporarily in the app's temporary storage and is deleted as soon as you start a new recording, move on to the next verse or leave the test; the operating system automatically removes any leftover temporary files.
- There is no speech recognition or analysis on servers.
You can revoke microphone access at any time in your device settings.
Legal basis: The recording only takes place when you start it yourself (Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG); microphone access is based on your permission in the operating system.
5. Loading content from the internet
For the app to work, it loads certain content from external servers. With each request, your IP address, the time, the requested file (e.g. which verse) and technical details about the connection (e.g. operating system version) are necessarily transmitted to the respective server. Without this transmission the content cannot be delivered. All requests are encrypted (HTTPS). We ourselves do not store this data.
5.1 Recitations (EveryAyah and Quran Foundation)
The reciters' audio files are loaded from the internet during playback (streaming) or when you download surahs or the whole Quran for offline use:
- Abdul Basit, As-Sudais, Ash-Shatri, Ar-Rifai, Al-Husary, Alafasy, Al-Minshawi and Ash-Shuraim are provided by the Quran Foundation (5.2): the file addresses come through our server, the files themselves from the Quran Foundation's audio servers (verses.quran.foundation or the mirror it specifies, mirrors.quranicaudio.com). To our knowledge, these are delivered via the content delivery network BunnyCDN (BunnyWay d.o.o., Ljubljana, Slovenia).
-
All other reciters come from everyayah.com:
-
Provider: The operator of everyayah.com is not named on the website; as a contact, the website refers to the Quran.com support portal (quran.zendesk.com).
- Delivery: To our knowledge, the files are delivered via a global content delivery network (CDN77, operated by DataCamp Limited, London, United Kingdom), including from servers outside the EU, e.g. in the USA.
- Privacy notice: The website does not provide its own privacy notice.
5.2 Tafsir, translations and transliteration from the Quran Foundation
hifaaz uses the programming interfaces of the Quran Foundation (Quran.com) in accordance with their terms of use. hifaaz is not an official app of the Quran Foundation. These interfaces provide:
- the tafsir, when you open it for a verse (at-Tafsīr al-Muyassar, Tafsīr Ibn Kathīr, Tafsīr as-Saʿdī, Ibn Kathīr abridged in English and Tefsîrî Rêber in Kurdish),
- the translations in French (Hamidullah) and Arabic (at-Tafsīr al-Muyassar), if you choose them,
- the transliteration, if you turn it on.
The app downloads translations and transliteration once and stores them on your device (see section 3). As long as there is an internet connection, it syncs them with the Quran Foundation every few days, as their terms of use require.
The app does not request this content directly from the Quran Foundation, but through a small server of our own. It manages our access credentials and passes the requests on. It stores no requests and keeps no logs. The Quran Foundation only receives our server's request (for example "tafsir for verse 2:255"), not your IP address.
Our server (Cloudflare):
- The server runs on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes your IP address and the other connection data mentioned above on our behalf (processing on behalf of a controller under Art. 28 GDPR, based on Cloudflare's data processing terms).
- We have turned off logging for our server. According to Cloudflare, it may process connection data to protect its network, for example against attacks.
- Cloudflare is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the EU Commission.
- Privacy notice: https://www.cloudflare.com/privacypolicy/
Quran Foundation:
- Provider: Quran Foundation, Inc., a non-profit organization based in the USA
- Provider's privacy notice: https://quran.com/privacy
5.3 Tafsir "al-Mukhtasar" (QuranEnc.com)
If you choose the tafsir "al-Mukhtasar" in English, French, Turkish or Kurdish, the app loads the text directly from QuranEnc.com (quranenc.com).
- Provider: QuranEnc.com (Encyclopedia of the Translations of the Meanings of the Holy Quran). The website does not name an operator; among those involved, it lists the Rowwad Translation Center and the Islamic Content Service Association, both in Saudi Arabia. Contact: https://quranenc.com/en/home/contact_us
- Privacy notice: The website does not provide its own privacy notice.
5.4 Transfers to countries outside the EU
EveryAyah (5.1) and QuranEnc.com (5.3) also deliver from countries outside the European Union, in particular the USA and Saudi Arabia. Your IP address is transmitted there. There is no adequacy decision of the EU Commission for Saudi Arabia. For the USA, an adequacy decision (EU-US Data Privacy Framework) only covers organizations certified under it; to our knowledge, these two providers are not certified. It therefore cannot be ruled out that authorities there access this data without you having the same legal remedies as in the EU. The transfer is necessary to provide you with the function you requested (recitation or tafsir) (Art. 49(1)(b) GDPR). If you do not want this, you can use the app without these functions: the app plays surahs you have already downloaded without a connection. For Cloudflare (5.2), the adequacy decision applies because Cloudflare is certified. BunnyCDN (5.1) is based in the EU; depending on your location, files may still come from servers outside the EU.
Legal basis: Art. 6(1)(b) GDPR (providing the functions you use) and Art. 6(1)(f) GDPR (legitimate interest in a working app).
6. Daily reminder and location (“After Fajr”)
6.1 Notifications
If you choose a daily reminder, the app asks for permission to show notifications. Reminders are scheduled locally on your device. There is no notification server; we do not send push messages and receive no data about whether or when you see a notification.
You can turn off the reminder in the app or revoke the permission in your device settings.
6.2 Location for the Fajr time
Only if you choose the “After Fajr” reminder does the app ask for your location, to calculate the time of the Fajr prayer where you are.
- Only an approximate location is requested (iOS: reduced accuracy; Android: approximate location), and only while you are using the app.
- The calculation takes place entirely on your device. Your location is not transmitted – neither to us nor to third parties.
- The coordinates are stored locally so that the app does not have to ask again and again, and they are deleted together with the app.
- If you decline, the app reminds you at 6:00 a.m. instead.
Legal basis: Your consent via the operating system's location permission (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can revoke it at any time in your device settings.
7. Functions where you share data yourself
7.1 Suggesting improvements
Under Settings → Send a suggestion or report a bug you can write a suggestion or report a bug. The app opens your email app with the address hifaaz@daar.studio (or, if none is set up, the system share sheet). Along with your text, the app version, the operating system version and the device model are attached (so that bugs can be reproduced). Nothing is sent unless you confirm it yourself. When we receive your message, we process your email address and its content only to handle your suggestion and to reply if needed (Art. 6(1)(f) GDPR), and we delete them once they are no longer needed for this purpose.
7.2 Sharing verses
When you share a verse, the app passes the text to your device's share sheet. What happens next is up to the app you choose.
7.3 Rating hifaaz
Ratings use the function provided by Apple (App Store) or Google (Google Play). Their privacy policies apply; we only receive the public rating.
7.4 Donating to a charity
Under Settings → About you can donate to the charity Islamic Relief. When you tap it, their website opens in your browser (islamicrelief.de in German, otherwise donate.islamic-relief.org); the app does not transmit any data. The privacy notices of the organization and of the payment service used there apply to the website and the donation. We receive no information about your donation.
7.5 Instagram and TikTok
Under Settings → Follow hifaaz you will find links to our profiles. Only when you tap one does the profile open in the respective app or in your browser; from then on, the privacy policies of Instagram (Meta) or TikTok apply. hifaaz itself does not embed any functions of these networks and does not transmit any data to them.
8. App Store and Google Play
The privacy policies of Apple and Google apply to downloading and updating the app. Apple and Google may provide us with aggregated, anonymous statistics and crash reports – only if you have agreed to this on your device (iOS: “Share With App Developers”; Android: Android vitals). This information does not identify you and is used only to fix bugs.
9. Children
hifaaz is meant for everyone who wants to memorize the Quran, including children and teenagers. Since we do not collect personal data and there are no accounts, no personal information is needed to use the app. Parents can control microphone and location access in the device settings or with Screen Time / Family Link.
10. Your rights
Insofar as we process personal data about you (e.g. when you email us), you have the right to:
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on legitimate interests (Art. 21 GDPR),
- withdraw your consent with effect for the future (Art. 7(3) GDPR).
To exercise these rights, contact us at the address given above.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Baden-Württemberg (State Commissioner for Data Protection and Freedom of
Information Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de
Since the app data is stored only on your device, we cannot provide information about it or delete it – you always have full control yourself (by deleting the app).
11. This website (daar.studio/apps/hifaaz)
The website is hosted on Cloudflare and delivered through Cloudflare's network; Cloudflare also runs the DNS for the domain daar.studio. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the website, Cloudflare processes technically necessary data – your IP address, the time, the page visited and details about your browser and operating system – to deliver it and to protect it against attacks. We ourselves do not receive this data.
This involves a transfer to Cloudflare, Inc. in the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the EU Commission.
The website sets no cookies, uses no tracking and loads no content from other servers: fonts and images are delivered with the site itself.
- Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
12. Changes to this privacy policy
We update this privacy policy when the app, the website or the law changes. You can always find the current version at https://daar.studio/apps/hifaaz/privacy/ and in the app under Settings → About.