Privacy policy

Uygulama / App: İhya

Paket kimliği / Bundle ID: com.mustafasan.ihya

Yürürlük tarihi / Effective date: 14 Ağustos 2026

Son güncelleme / Last updated: 15 Ekim 2026

Summary

İhya collects no personal data and asks you for no account. There is no advertising network, analytics tool, crash reporter, or any third-party tracking kit. The one exception is legal: our server keeps a short access log of the requests it receives, as Turkish law requires; which verse you listen to is not part of that log (section 9).

The app does not need an internet connection to work. The app goes online in only five places; the first two and the fifth work only when you ask for them:

1. Verse audio. If you choose to listen to a verse, that verse's audio file is downloaded from the app's own server (ihyaa.tr). The connection is made only when you press play or download, only to that address, and only for the requested verse's file. The request carries nothing but the file name — no account, no device identifier, none of your memorization or worship records.
2. Shared Qur'an reading (section 3). If you join a group to share the thirty parts of the Qur'an, the parts you take and the nickname you choose are written to that same server. This feature is off by default; unless you create a circle or accept an invitation, not a single line is sent. Your nickname is encrypted on your device and stored unreadable on the server — the key is held only by the group that has the invitation link and is never sent to the server.
3. Version check. When the app opens, at most once every twenty-four hours, it checks whether a newer İhya version is in the store and, if so, asks you. On iPhone the request goes to Apple's public store lookup address (itunes.apple.com) and carries only the app's bundle ID (com.mustafasan.ihya). On Android the question is asked of the Play Store on your device through Google Play's in-app update interface. No personal data, device identifier or records of yours are sent, and nothing reaches us.
4. Rating window. When you finish a memorization session, when a shared Qur'an reading round is completed by a part you finished, or when you complete your daily dhikr (vird) at least seven days in a row, the store's own rating window may be requested: never in the first week after installation, then at most once every 120 days and at most once per version. On iPhone the window is shown by Apple's system, on Android by the Play Store on your device, and they decide whether to show it at all. The app sends no data while doing this. If you give a rating or write a review, you send it to the store yourself; the app never sees your rating or review.
5. Groups (section 3b). If you create a group with family or friends to finish a khatm together, read the same pages every day or reach a dhikr goal together, your display name in the group and the records you add to it (the part you took, your "I recited it" mark, your dhikr contribution) are stored on the Groups server (api.ihyaa.tr). This feature is off by default; unless you create a group or join one with an invitation, the app sends not a single request to this server. There is no account: no e-mail, phone number or password is asked for.

As with any internet request, your IP address reaches the server the request goes to (Apple or Google for the version check and the rating window); we did not want to leave that unsaid. Requests that reach our own server are kept in an access log as required by Turkish Law No. 5651; section 9 explains what, why and for how long. If you never use audio, shared reading or groups, the app never goes online except for the daily version check and the rating window.

Apart from those, everything you create in the app — memorization progress, prayer and voluntary worship records, reading position, settings — is stored only in your own device's app sandbox and stays there. The one exception is, again, your own account: on iPhone, if automatic iCloud backup is on (it is on by default), a copy of these records is written to your own iCloud Drive (section 4). That copy is between you and Apple; it never reaches us and we cannot see it.

1. Who is the data controller

The developer of İhya (contact: [email protected]) collects no identity data in any function of the app and requires no account.

Shared Qur'an reading and groups are the exceptions and we state them separately (groups: section 3b): when a user turns shared reading on themselves, the parts they take and their encrypted nickname are hosted on the ihyaa.tr server. That data is not tied to an identity, is not analysed for any purpose, and — being encrypted — the nicknames cannot be read by us (section 3). To the extent this creates any controller responsibility, the address above is the contact, including for deletion requests.

For any privacy question: [email protected].

2. Data we do NOT collect

İhya does not collect, store, or transmit any of the following:

• Name, surname, e-mail, phone number, address
• User account, device ID, advertising identifier (IDFA/GAID); no user ID either, except that if you use groups the server keeps the hash of a random key made on your device (section 3b)
• Location data (see section 4 — location is used on-device only and never saved)
• Contacts, calendar, photos, files, microphone, or camera data
• Usage/analytics data, session recordings, heatmaps
• Crash reports
• IP address, by the app itself (the app does not collect your IP or link it to any user). When you use verse audio, shared reading or groups, the request goes to our server and your IP is written to the access log the law requires; that log is never combined with any data in the app (section 9). If you use none of them, the request is never made. The daily version check and the rating window also let your IP reach Apple or Google.
• Payment or financial information (there are no in-app purchases)

The app works without sending a single line of user data from the moment it is installed; downloading verse audio, shared Qur'an reading (section 3), groups (section 3b), the daily version check (item 3 of the summary) and the rating window (item 4 of the summary) are the only reasons it ever goes online, and audio, shared reading and groups never happen unless you ask.

3. Shared Qur'an reading (hatim)

This feature is off by default. Unless you create a reading circle or join an invitation sent to you, nothing in this section happens and not a single line is sent to the server.

The feature lets a group share the Qur'an's thirty parts (juz'): each person takes one and marks it done. For that to work the group must see the same list, and the list has to live somewhere. That somewhere is ihyaa.tr — the same machine that serves verse audio.

Cloudflare sits in front of that address (section 6): your shared reading requests reach our server through Cloudflare's infrastructure. Cloudflare can see only the files holding encrypted nicknames and part states; the circle's key stays after the # in the link, so it never reaches Cloudflare either.

What is stored on the server

What is NOT stored on the server

• The circle's secret key. It lives inside the invitation link and is never sent to the server — not in the URL, not in a header, not in the body. That is why we cannot read the nicknames either.
• Your name, e-mail or phone number. There is no account.
• Your memorization progress, prayer and voluntary worship records, reading position or settings. The feature carries only the distribution of parts.
• Which verses you read. "I finished part 4" is a note to your group, not a reading log.

As with any internet request, your IP address reaches the server and is written to the legal access log (section 9). Only the folder part of the requested address is logged, not the file name: the reading's folder number appears, your device number, nickname and parts do not.

Who can see it

Only people who hold the invitation link can see your nickname and the parts you took; the key that decrypts it is inside that link. You decide who sees the link — where you share it (WhatsApp, Telegram, whatever you use) is your choice, not ours. Anyone who receives the link can join; there is no public directory, search or discovery.

Retention and how to leave

"Leave circle" in the app deletes the circle from your device. The app cannot delete your file on the server — if clients could delete, anyone who knew a folder name could wipe an entire circle. Your file is removed automatically by server-side cleanup if it is untouched for sixty days. To have it removed sooner, write to [email protected] with the circle's link and we will delete it by hand.

A warning about your backup

If you export a device backup (see the honest note in section 4), the circle's secret key is inside that file. Without it you would lose your circle when moving to a new phone. If you hand the backup file to someone, you hand them your circle link too; do it knowingly.

3b. Groups

This feature is off by default. Nothing in this section happens unless you create a group or join one with an invitation sent to you.

Groups let a group finish a khatm together, read the same pages every day and reach a dhikr goal together. For everyone to see the same list, the records have to live on a server: api.ihyaa.tr, İhya's own server. As with our other addresses, Cloudflare sits in front of it (section 6); there is no advertising or analytics provider.

No account; a key made on your device

When you create your first group or join your first invitation, your device generates a random key. The server stores only a hash (SHA-256) of this key; the key itself stays on your device and proves who you are with each request. Your name, e-mail and phone number are not asked for.

What the server stores

What the server does NOT store

• Your name, e-mail, phone number, location. There is no account.
• Your own memorization, prayer and voluntary prayer records, your own daily reading, your settings. Groups carry only the records you add to a group.
• The invite code does not reach server logs: in the invite link the code is after the # sign, and browsers do not send that part to the server.

As with any internet request, your IP address reaches the server and is written to the legal access log described in section 9. For group requests only the first part of the address enters that log (e.g. /v1/gruplar/); no group or person number does, so the log does not link an IP to a group.

Who can see it

Your display name and the records you add to a group are visible only to the members of that group. Groups are not public; there is no search or discovery. Only people who have the invite link (and the password, if the group has one) can join. The founder can renew the invite to invalidate the old link and can remove members.

How long it is kept and how to delete it

• Leave group: your membership is deleted; parts you did not read become free. What you read and contributed stays in the group as its shared effort.
• Delete my group data (menu on the group screen) and Settings → Delete everything (if you choose to include group data): your number, name and all memberships are deleted from the server; your dhikr contributions are removed from the totals. Groups you founded that have other members pass to the oldest member; groups where you are alone are deleted. This happens immediately and cannot be undone.
• If the founder deletes the group, the group and all its activities are deleted for everyone.

A note about your backup

Your group key is included in the device backup, so you stay the same person in your groups when you move to a new phone. Anyone you give the backup file to can act in groups on your behalf; do not share the file with anyone.

4. Data that stays on your device

The following is kept only on your device, in the private area the operating system reserves for the app. No other app can reach it, and neither can we.

All of this is removed from the device when you delete the app. It can also be cleared from the app's Settings screen.

An honest note about backups

If iCloud Backup (iOS) or Google Backup (Android) is enabled in your device settings, the app's on-device files may be included in that backup. That is a service between you and Apple or Google; we have no access to the backup and we do not send that data. If you prefer, you can exclude İhya from backups in your device settings.

Automatic iCloud backup (iPhone and iPad only)

So that your records can come back when you delete and reinstall the app or move to a new device, İhya on iPhone writes a backup of your records to your own iCloud Drive. It is on by default.

• What: the same file you get from Settings → Backup and data → "Back up": your memorization, prayer, voluntary worship, reading, bookmark, dhikr and vird records, your shared-reading records (including the circle's secret key, section 3) and your settings. Your recent searches and your recitation recordings are not included.
• Where: in your iCloud account, in a folder only İhya can open, as two files: the latest backup and the one before it. The file is plain JSON; we do not encrypt it, it rests under iCloud's own protection.
• When: when you leave the app, if your records changed, at most once a day.
• Who can see it: you and Apple's iCloud service. We have no access to that account; the file is never sent to us.
• Restoring: on a fresh install, if a backup is found in iCloud the app asks you; if you say "No" it will not ask again for that backup. You can also restore at any time from Settings → Backup and data → "Restore from iCloud".
• Turning it off and deleting it: the "Back up to iCloud automatically" switch under Settings → Backup and data. Turning it off does not delete the files in iCloud, and neither does deleting the app. To delete them: iPhone Settings → your name → iCloud → Manage Account Storage → İhya.

Android has no such feature; Google's automatic backup described above applies there.

Smartwatch (Apple Watch and Wear OS)

If you install İhya on your watch, the phone sends it what the watch's dhikr counter and prayer-time screens need: the coming days' prayer times and the name of the place you chose, the selected dhikr's name, today's count and target, and the interface language. From the watch, only the number of dhikr taps, their time and a random event number go to the phone; the phone records them on your device like your other dhikr records.

• How: on Apple Watch through Apple's phone–watch connection (WatchConnectivity). On Wear OS through Google Play services' watch connection (Wearable Data Layer); when the watch is not directly connected to the phone, Google may relay this data through its own infrastructure.
• Never sent to us: this data between your watch and phone never goes to İhya's server.
• Turning it off: remove İhya from your watch; the phone stops sending it data.

5. Permissions and the real reason for each

İhya never asks for permissions in a batch on first launch. Each permission is requested the first time you use the feature that needs it, after an on-screen explanation of what it is for. Every permission may be declined, and if declined the rest of the app continues to work fully.

Location (while using the app only)

• What for: Calculating prayer times for where you are.
• How it is used: Latitude and longitude are handed to an astronomical calculation running inside the device, and the times are computed there. Your location is never sent to any server, never stored, never shared.
• No background location is requested. Your location is not read while the app is closed.
• If declined: You can pick a city manually; prayer times still work.

Notifications

• What for: Prayer time reminders, the verse/hadith of the day, and memorization review reminders.
• How it works: All notifications are scheduled locally, inside the device. No push server (APNs/FCM push) is used; we never receive a notification token.
• If declined: The whole app works, you simply get no reminders.

Microphone (optional, only when you tap record)

• What for: Recording yourself reciting a memorization block from memory and comparing it with the reciter's recitation.
• How it is used: The permission is requested the first time you tap record, never at launch; the microphone is on only while recording and stops when the app goes to the background. Only the latest recording of each verse range is kept. Recordings never leave your device: they are never uploaded and are excluded from iCloud and Google backups. You can delete them one by one or all at once under Settings → Backup and data → Recitation recordings; "Delete everything" removes them too.
• If declined: Only recording is unavailable; the rest of the app works as before.

Add to Photos (write only)

• What for: Saving the hadith/verse image you compose to your gallery.
• Scope: Only the add permission is requested (iOS NSPhotoLibraryAddUsage). The app cannot read, list, or see your photos. On Android the image is saved through the permission-free MediaStore path.
• If declined: You cannot save the image, but you can still share it through the system share sheet.

Exact alarms — not requested (Android only)

This permission used to be requested; it no longer is. We kept the section instead of deleting it so the change, and what it means for you, stays visible.

• Status: İhya requests neither SCHEDULE_EXACT_ALARM nor USE_EXACT_ALARM. Neither appears in the app's permission list.
• What this means for you: Notifications are scheduled approximately. Depending on battery state and device sleep mode, the system may shift a notification a few minutes later than the intended moment. So a prayer time reminder may arrive with a small delay rather than exactly on the minute. We did not want to leave that unsaid.
• To see the exact time: Just open the app. Prayer times are computed astronomically on your device and shown to the minute; the drift applies only to when the notification fires, never to the prayer time itself.
• Why we don't request it: An exact alarm grants an app the right to wake your device from sleep. The app never used that power anywhere, and requesting an unused permission goes against keeping permissions as narrow as possible.

6. Third parties

No third party for tracking. İhya contains no advertising SDK, analytics SDK, crash reporting SDK, social media SDK, or A/B testing tool. The third-party code it uses consists only of open-source UI/database/cryptography libraries, none of which open a network connection on their own. The two exceptions are Google Play's libraries on Android: the in-app update library asks the Play Store whether a newer version exists, only for the daily version check; the in-app review library asks the Play Store for the rating window, only when that window is requested (item 4 of the summary). The Play Store handles any rating or review you give under Google Play's own terms; none of it reaches us. If İhya is installed on your watch, Android also uses Google Play services' watch connection (section 4, "Smartwatch").

There is one infrastructure provider and we state it for honesty's sake: the app's servers are ihyaa.tr (verse audio and shared reading) and api.ihyaa.tr (groups), and Cloudflare sits in front of them, so the IP address and URL of those requests pass through Cloudflare's infrastructure. Cloudflare processes them only to deliver the request to us and to protect the server from attacks.

The "Share" button opens the operating system's own share sheet. What you share and which app you send it to is entirely your choice, and that choice is not reported to us.

7. Children's privacy

İhya is not designed for children, but it is safe at any age: it shows no ads, performs no tracking and provides no in-app browser.

The exceptions are shared Qur'an reading (section 3) and groups (section 3b), and even there the surface is as small as it can be: there is no public directory, search, discovery, messaging or commenting; the only user-written text anyone can see is what the members of the group holding the invitation link wrote themselves: names, intentions and the prayer the founder added. So there is no surface on which a child could encounter a stranger. The feature is off by default.

8. Your rights (GDPR, CCPA, Turkish KVKK)

Because almost all of your data never reaches us, you do not need to contact us to exercise your rights of access, rectification, erasure, portability, and objection — you exercise all of them yourself:

• Access and portability: Your data is on your device; you can export it from the Settings screen.
• Erasure: Settings → clear data, or delete the app. Deleted data cannot be recovered, because no copy exists anywhere else.
• Objection/restriction: You may decline any permission, or withdraw it later in your device settings.

For groups (section 3b) deletion is inside the app: "Delete my group data" on the group screen or Settings → "Delete everything" removes your number, name and memberships from the server immediately; you do not need to write to us.

An additional route for shared reading (section 3). Your circle file is deleted in one of two ways:

• By you: "Leave circle" deletes the circle from your device; your file on the server is removed automatically if untouched for sixty days.
• By writing to us: To have it removed sooner, write to [email protected] with the circle's link and we will delete it by hand. The link is required because there is no account — nothing else tells us which file is yours.

Data concerning religious beliefs is a special category under GDPR Art. 9 and KVKK Art. 6. Your worship records (memorization, prayers, voluntary prayers, reading position) never leave the app under any circumstance, and that is the single most fundamental design decision behind this policy. What leaves in shared reading is not a worship record but a task list given to a group: which part you took and finished. Even so, because that information points to a religious practice it may count as a special category; that is why the feature is off by default, starts with an explicit user action, and encrypts nicknames.

9. Data security

On-device files are protected by the iOS and Android app sandbox and sit under operating-system encryption. We recommend protecting your device with a screen lock.

Audio, shared reading and the iPhone version check go over HTTPS; the version check on Android, and the rating window on both platforms, are handled by the store itself over its own connection. Shared reading adds one more layer on top: nicknames are encrypted on the device with XChaCha20-Poly1305 and the key stays inside the invitation link, never sent to the server — so even someone who compromised the server could not read the names. What is not encrypted is the part numbers and their timestamps; we say so plainly in section 3.

Server access logs (legal obligation)

For every request that reaches the ihyaa.tr server, a short record is kept. Article 5 of Turkish Law No. 5651 requires it: a hosting provider must keep "traffic information" for at least one and at most two years.

• What is logged: IP address and port, date and time, only the folder part of the requested address (e.g. /ses/qatami/; the file name — that is, which verse you listen to — is not logged), response size and duration, and the identification string of the app or browser (User-Agent).
• Why: legal obligation (KVKK art. 5/2-ç) and detecting and stopping attacks on the server (KVKK art. 5/2-f, legitimate interest).
• How long: two years, then deleted.
• Who can see it: only us. If a lawful request arrives, it is handed to the competent authority. The log is not used for analysis, profiling or advertising, and is never matched with any data in the app, an account or a device ID.
• Where: on our own servers and in our encrypted backups. Requests also pass through Cloudflare (section 6).

10. Sale and sharing of data

İhya does not sell, rent, share, or use any data for advertising. No "sale" or "sharing" occurs within the meaning of CCPA/CPRA.

11. Changes to this policy

If the policy changes, the "Last updated" date at the top of this page is updated. Should any change alter the app's data behaviour, the change will also be announced clearly inside the app and the store privacy forms will be updated the same day.

On 9 September 2026 such a change happened and we are not hiding it: shared Qur'an reading was added and, for the first time in the app's history, data created by the user (the parts they took and their encrypted nickname) began to leave the device and rest on a server. The feature is off by default; for anyone who does not turn it on, nothing changed.

On 14 September 2026 the daily version check was added (item 3 of the summary). It sends no user data; it only asks the store for its version.

On 14 October 2026 the store's rating window was added (item 4 of the summary). The app sends no data; Apple or Google shows the window, and any rating you give goes straight to the store.

On 15 October 2026 automatic iCloud backup was added on iPhone (section 4). A copy of your records goes to your own iCloud Drive; nothing reaches us. It is on by default and can be turned off in Settings → Backup and data.

12. Contact

For any privacy question: [email protected]

Veri kaynakları

Uygulamayla birlikte gelen ve tamamı cihazda duran veriler:

• Yer ve saat dilimi verisi: GeoNames (geonames.org), Creative Commons Attribution 4.0 lisansıyla. Şehir adları, koordinatlar ve IANA saat dilimleri buradan alınmıştır.
• Namaz vakitleri: Türkiye'de, Diyanet yöntemiyle, Diyanet İşleri Başkanlığı'nın ilçe ilçe yayımladığı vakit takvimi (namazvakitleri.diyanet.gov.tr) uygulamaya gömülüdür. Takvimin kapsamadığı yer ve günlerde astronomik hesap cihazda yapılır. İkisinde de hiçbir takvim servisi çağrılmaz.
• Arka plan sesleri: Tilâvet dinlerken altta çalabilen doğa sesleri uygulamanın içine gömülüdür; çalarken hiçbir adrese bağlanılmaz. Orman sesi iki kaydın karışımıdır. Kaynakları ve lisansları: "Birds In Forest (Scotland)" — BurghRecords (freesound.org/s/490846, CC0 1.0); "LateSummer quiet woods and Leaves and Wind" — kvgarlic (freesound.org/s/669113, CC0 1.0); "Ocean Waves Loop – Night" — Koops (freesound.org/s/586116, CC BY 4.0); "Campfire 01" — HECKFRICKER (freesound.org/s/729395, CC0 1.0). Kayıtlar insan sesi ya da müzik içermek üzere seçilmemiştir; arka ses isteğe bağlıdır ve varsayılan olarak kapalıdır.
• Bildirim sesleri: Uygulamanın kendi sesleri kullanılır. On kısa ses (vurus, besli, derin, billur, dingin, sekme, serpinti, cagilti, mizrap, sedef) tools/ses/uret.py ile sentezlenip uygulamanın içine gömülmüştür; hazır bir zil sesi indirilmez, çalma anında hiçbir adrese bağlanılmaz. Ezan kaydı ya da insan sesi içermez. Ses çalmak bir veri toplama değildir. Mikrofon yalnız siz ezber tekrarında kayıt düğmesine dokunduğunuzda açılır ve kayıt cihazınızda kalır (bölüm 5, "Mikrofon").
• Yazı tipleri: Kuran metni Ihya Naskh ile çizilir; SIL Global'in Scheherazade New keskisinden türetilmiştir, SIL Open Font License 1.1 ile gelir ve lisans metni uygulamanın içinde (assets/fonts/OFL-ScheherazadeNew.txt) dağıtılır. Hadis ve Latin metin Amiri ile çizilir; o da OFL 1.1 ile gelir ve lisans metni (assets/fonts/OFL-Amiri.txt) yine paketle birlikte dağıtılır. Android'de arayüz yazısı Inter ile çizilir (The Inter Project Authors, rsms/inter); OFL 1.1 ile gelir ve lisans metni (assets/fonts/OFL-Inter.txt) paketle birlikte dağıtılır.
• Kur'an meâlleri: Uygulamada açık olan iki meâl Hasan Basri Çantay ve Elmalılı Muhammed Hamdi Yazır (orijinal metin) tercümeleridir. Meâl bir mütercimin eseridir; hangi âyetin hangi meâlden geldiği okuma ekranında ve paylaşılan görselde adıyla yazar.
• Kelime kelime meal: Mushafta âyete dokununca açılan kartta her kelimenin altında yazan Türkçe ve İngilizce anlamlar Açık Kuran (acikkuran.com) kelime mealindendir; Creative Commons BY-NC-SA 4.0 lisansıyla. Kartta görünen Arapça kelimeler uygulamanın kendi mushaf metnidir; anlamlar o metnin kelimelerine eşlenmiştir.
• Sayfa düzeni: Diyanet İşleri Başkanlığı Kur'an-ı Kerim (kuran.diyanet.gov.tr). Okuma ekranındaki sayfa numaraları, "sayfa 250" araması ve ezber haritası bu 605 sayfalık düzene göredir; yalnız her sayfanın hangi âyetle başladığı alınmıştır, metin bu kaynaktan değildir.
• Hadis metinleri: Hadis kitaplığında üç eser vardır. Sünen-i Tirmizî, Abdullah Parlıyan çevirisi. Riyâzü's Sâlihîn, Abdullah Parlıyan çevirisi ("Açıklamalı Tam Riyazu's-Salihin Tercümesi"). Nevevî'nin Kırk Hadis Şerhi: Nazım Muhammed Sultan, "Ana Çizgileriyle İslam (Nevevi Kırk Hadis Şerhi)", Guraba Yayınları; kitapta mütercim adı basılı değildir, bu yüzden künyede mütercim yazılmaz. Hadis kitaplığındaki her metnin altında eserin adıyla künyesi görünür; mütercimi olan eserlerde paylaşılan görselde mütercimin adı da yazar.
• Âyet sesi (tilâvet): Üç kâri okur — Nasser Al Qatami, Yasser Al Dosari ve Mishary Rashid Alafasy; üçü de Hafs rivayetidir. Kayıtlar uygulamanın kendi sunucusunda (ihyaa.tr) barındırılmaktadır. Uygulama paketinde tek bir ses dosyası yoktur; pakette gelen şey yalnız her âyetin dosya boyunu tutan küçük bir dizindir. Bir âyeti dinlediğinizde ya da indirdiğinizde o âyetin dosyası sunucudan cihazınıza iner ve orada kalır; bir daha ağ istemez. İstekte dosyanın adından başka bir şey gitmez.