Quran 360 Privacy Policy

1. Who we are

This Privacy Policy explains how Assistant App Teknoloji Anonim Şirketi (a Turkish joint-stock company) ("we", "us") handles personal data in Quran 360.

We are the data controller for the personal data described in this policy.

Registered address: Adalet Mah. Manas Blv. Folkart Towers No:39 Kapı No:2701, Bayraklı/İzmir
Mersis no: 0091109107600001
Contact: [email protected]

2. What this policy covers

This policy applies to Quran 360 only, on the platforms where it is published.

Our other applications each have their own privacy policy describing what that application collects. This policy does not describe them, and their policies do not describe Quran 360.

3. Legal bases for processing

Where the GDPR or equivalent law applies, we rely on the following legal bases:

• Performance of a contract — to provide the features you ask for, and to manage subscriptions you purchase.
• Consent — where we ask for it, such as access to device features, personalised advertising, or optional communications. You can withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.
• Legitimate interests — to keep the application secure and working correctly, to diagnose faults, and to understand how features are used in aggregate. We balance these interests against your rights, and you may object as described in section 17.
• Legal obligation — where we must retain records, such as purchase records for accounting purposes.

The specific purposes and the data involved are set out in the product section below.

4. How we handle your data

We ask for the minimum access a feature requires, at the moment the feature needs it, and we explain why at the point we ask.

We do not sell personal data.

We do not use personal data to train AI models, and we do not share it with advertising providers for that purpose.

Data is transmitted over encrypted connections.

5. Product and scope

This section describes the personal data processed in Quran 360. It covers:

• Quran 360: AlQuran English on the App Store (iPhone and iPad), including the Apple Watch app and home screen widgets
• Quran 360: English, Audio on Google Play (Android), including home screen widgets

The home screen widgets on iOS and Android make no network requests; they show information that Quran 360 has stored on your device. The Apple Watch app exchanges playback commands and status with Quran 360 on your iPhone, and downloads recitation audio from our content server (cdn.muslimassistant.com) without sending any identifier. The Apple Watch app contains no analytics or advertising SDK; when you use it, Quran 360 on your iPhone records usage events about it (see section 10).

6. Data we collect

Information you give us

• Onboarding answers (iOS). Whether the first-run screens include questions is set remotely by platform, app language and experiments we run. At present the questions are shown on iOS only; on Android the first-run screens do not include them. Where they are shown, you can answer: your name, a personal note, your motivation, the time you want to set aside, what you find difficult, the kind of support you are looking for (one of the options is "health and healing"), and the commitment you want to make. These answers are stored on our servers together with your device identifier and are used to personalise the app and to write a personal dua for you.
• Assistant messages. The questions you ask the in-app assistant and the answers it gives.
• Recitation recordings. When you use recitation check, a recording of your voice reciting a verse.
• Support messages. If you contact us by email or WhatsApp, your message and the details listed in section 11.

Information collected automatically

• Device identifier — the identifier for vendor on iOS, the Android ID on Android. We use it to manage your subscription, to link your onboarding answers on our servers, and to process deletion requests.
• Advertising identifier — the IDFA on iOS, only if you allow tracking; the Google advertising ID on Android. See section 13.
• App usage events, including events from reading, listening and worship features and the search keywords you tap in recent and top searches (see section 10).
• Session recordings (Android). Quran 360 for Android includes Microsoft Clarity. It is currently switched off, and we can switch it on remotely without an app update. When it is switched on, it records your sessions in the app — the screens you view, your taps and navigation — together with device information and your IP address (see sections 10, 11 and 13).
• Advertising interaction data — ads shown to you and your interactions with them.
• IP address, and the approximate location that Google and the advertising networks derive from it.
• Crash and diagnostic data, and on Android, performance data.
• Purchase history for Premium.
• Technical identifiers — push notification token, Firebase installation identifier, App Check token.
• App language.

Information that stays on your device

Notes you add to verses, your reading log, streaks, khatam progress, the playlists you create and playlist cover images are stored on your device.

7. Purposes and legal bases

8. Permissions

9. Your content and how it is processed

Assistant. When you send a message, the message and the last few messages of the conversation are sent to our server function on Google Cloud (United States, us-central1), which forwards them, together with our instructions for the assistant, to OpenAI (model gpt-4o-mini) to generate the answer. The request carries a random conversation-session identifier and the app language. We store each question and answer, with that session identifier, the language and the model name, in our database on Google Cloud SQL (Frankfurt, europe-west3) for 90 days to check the quality of the assistant, and then delete them automatically.

Events about your use of the assistant — for example that a message was sent or received, that the message limit was reached, or the position of a suggested question you tapped — are sent to Firebase Analytics, and their names to Meta. The text of your messages is not included in these events. On Android, when Microsoft Clarity is switched on, the messages displayed in your conversation are recorded (section 10).

Recitation check. Your recording is sent directly from the app to OpenAI's transcription service (Whisper), with the model and language settings. The recording is kept on your device only as a temporary file.

Personal dua. Your onboarding answers and the app language are sent through our server function to Google's Gemini API, which writes a personal dua for you. The request does not include your device identifier or advertising identifier. Your onboarding answers are stored in our database on Google Cloud SQL (Frankfurt, europe-west3) together with your device identifier until you delete them (section 15).

Model training. OpenAI does not use data sent through its API to train its models, and data sharing with OpenAI is switched off for our organisation. OpenAI keeps API inputs and outputs for up to 30 days to monitor for abuse. We use the Gemini API on Google's paid tier, under which Google does not use the prompts and responses to improve its products.

Playlist cover images. A cover image you choose for a playlist is copied into the app's storage on your device.

10. Religious and health-related information

Quran 360 is an application for reading and listening to the Quran. Using it may reveal information about your religious beliefs.

• Onboarding answers, where these questions are shown (section 6), describe your religious motivation and practice. If you choose "health and healing" as the support you are looking for, that answer relates to your health. These answers are stored on our servers with your device identifier and sent to Google's Gemini API to write your personal dua. They are not sent to Firebase Analytics, Meta or the advertising networks.
• Reading, listening and worship activity. Events from these features are sent to Google (Firebase Analytics) with their details. The details include: the surah, juz or verse you select, open, bookmark, share or look up in tafsir (surah name and number, verse number); the reciter you choose; the dua category or dua you open or share; the 99 Names card you open; the search keyword you tap in recent or top searches; the length of a reading streak that ends; your use of the Apple Watch app; and the name of each screen you open. Meta (Meta App Events) receives the name of each event — for example that a surah was selected or a dua was shared — without these details, subject to the consent rules in section 13.
• Session recordings (Android). When Microsoft Clarity is switched on (section 6), it records the screens you view, including the verses you read and the messages displayed in your assistant conversation. Quran 360's Clarity project uses the Balanced masking mode: text you type into input fields, numbers and email addresses are masked; other text on screen is recorded. We do not add any further masking in the app.
• Location. Quran 360 does not use your device location (section 14).

11. Service providers

Ads in Quran 360 are filled by the advertising networks listed above. Which of these networks serves a particular ad is decided at the time the ad is requested and can change.

12. Advertising and measurement

The free version of Quran 360 shows ads. Ads are delivered through Google AdMob together with the advertising networks listed in section 11.

We measure our advertising and how the app is installed through Firebase Analytics (linked to Google Ads and AdMob), Meta App Events, AppsFlyer (iOS only) and Apple Search Ads attribution (through RevenueCat).

If you subscribe to Premium, the advertising networks listed in section 11 are not started.

13. Tracking

iOS. When you open Quran 360, Apple's App Tracking Transparency prompt asks whether you allow tracking. The advertising networks start only after you have answered. You can change this choice at any time in iOS Settings › Privacy & Security › Tracking.

• If you allow tracking, your advertising identifier (IDFA) is available to Google AdMob and the advertising networks in section 11, Meta App Events, AppsFlyer and Firebase Analytics.
• If you do not allow tracking, your advertising identifier is not available to the app or to these providers. Ads are still shown. Pangle, ironSource and AppsFlyer still receive your identifier for vendor, which is not controlled by the tracking prompt.

Android. The Google advertising ID is used by Google AdMob and the advertising networks in section 11, by Firebase Analytics and, subject to the consent rules below, by Meta App Events. You can reset or delete your advertising ID in your Android settings.

Consent form in the EEA and the United Kingdom. Before the advertising networks start, Google's consent form asks for your advertising choices. Its first screen offers "Consent" and "Manage options". To refuse, choose "Manage options", where the consent purposes are switched off by default, and confirm your choices; on that screen, legitimate interest is switched on by default. The consent form is shown only when you first open Quran 360. The app has no setting for changing your choice later. To change your choice, uninstall and reinstall Quran 360: the consent form is shown again when you next open the app, and you can make a new choice. Uninstalling also removes the reading progress, notes and bookmarks stored on your device. If you have Premium, you can get it back with "Restore" in the app.

How your choice is applied:

• Google Mobile Ads, DT Exchange and ironSource read your choice from the consent signal stored on your device.
• Quran 360 passes your choice to Pangle.
• Unless you consent to Meta, Meta tracking, Meta's automatic event logging and the in-app events we send to Meta are switched off.

If you refuse, Google AdMob still requests ads, applying your choice, and DT Exchange loads its configuration but does not request ads without your consent to store information on your device. A connection to Meta (www.facebook.com) is also made after you refuse.

Outside the EEA and the UK, the consent form is not shown, and Meta App Events runs as described in section 11.

Not controlled by these choices. Firebase Analytics, Firebase Crashlytics and, on Android when it is switched on, Microsoft Clarity start when the app opens, before the tracking prompt and the consent form, and are not controlled by them. The Meta SDK contacts Meta when the app opens to load its settings, before the consent form. On iOS, these services receive your advertising identifier only if you allow tracking.

Premium. If you subscribe to Premium, the advertising networks listed in section 11 are not started.

14. What we do not do

• Quran 360 has no user accounts. We do not ask you to sign up or log in.
• We do not request location permission and do not use GPS. Approximate location derived from your IP address is described in section 6.
• We do not upload playlist cover images.
• We do not send the playlists you create — their names, surah lists or cover images — to any server. Default playlists are downloaded from our content server with only the app language in the request.
• We do not include your device identifier or advertising identifier in assistant requests.
• We do not send any identifier with recitation recordings.
• We do not send your onboarding answers to Firebase Analytics, Meta or the advertising networks.

15. Retention and deletion

How to delete your data

• In the app: Settings › Delete my data. This deletes your onboarding answers from our database, immediately and permanently, and from your device, and resets your analytics identifier so that data collected afterwards is not linked to earlier data. It does not delete analytics data already sent to Google; that data is removed at the end of the retention periods above.
• On the web: https://quran360.app/delete-data
• By email: [email protected]

Assistant questions and answers are stored only with a random session identifier, not with your device identifier, so we cannot find them in response to an individual request. They are deleted automatically after 90 days.

16. Retention

We keep personal data only as long as it is needed for the purpose it was collected for.

Data held on your device stays on your device and is removed when you delete it or uninstall the application.

Where we hold data on our systems, it is deleted within 30 days of a valid deletion request, except records we are required to keep by law — such as purchase and accounting records.

Details of what is kept, and for how long, are in the product section above.

17. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we process it
• receive your data in a portable format
• withdraw consent you have given
• lodge a complaint with a supervisory authority

To exercise any of these rights, write to [email protected]. We respond within the period required by applicable law.

If you are in Türkiye. Under Law No. 6698 on the Protection of Personal Data (KVKK), you hold the rights set out in Article 11. Applications must be made in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, and may be submitted to our registered electronic mail address:

[email protected]

Data controller registry (VERBİS) no: 72118212

You may also lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

18. International transfers

Some of the service providers described in the product section operate outside Türkiye and outside the European Economic Area.

We require these providers to apply safeguards appropriate to the data they receive.

Where the GDPR or the UK GDPR applies, transfers to providers outside the European Economic Area, the United Kingdom and Switzerland rely on an adequacy decision where one exists, or on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) included in our agreements with those providers.

19. Children

Quran 360 is intended for a general audience and is not directed at children.

We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to [email protected] and we will delete it.

Where the product processes information about a child that a parent or guardian has entered themselves, this is described explicitly in the product section above.

20. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls on our systems, and regular review of the services we integrate.

No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority where the law requires it.

21. Reporting a security or privacy issue

If you believe you have found a security or privacy issue in one of our applications, we want to hear about it.

Write to [email protected]. We will acknowledge your report and keep you informed while we investigate. We ask that you give us a reasonable period to address the issue before disclosing it publicly.

22. Changes to this policy

We update this policy when the application changes what it collects or who it shares data with.

When we make a significant change, we update the date below and, where the change is material, we tell you in the application.

Last updated: 20 October 2026