Gizlilik Politikası

Introduction

At Minara ("App", "we", "our"), we respect your privacy. This Privacy Policy explains how your personal data is collected, used, shared, and protected when using the Minara app.

This is an information notice. Using the App or reading this notice does not mean you consent to any processing that relies on explicit consent. Analytics and crash reporting (Section 10) start only after you give separate, explicit consent inside the App. If you do not consent, no feature of the App is restricted.

1. Data We Collect

1.1. Automatically Collected Data

• Location Data: GPS coordinates for calculating prayer times and qibla direction
• Country Code: SIM card or location-based country detection for correct calculation methods
• Device Information: OS version, app version, device language
• Usage Data and Crash Reports: In-app interactions, feature usage statistics and crash reports (Firebase Analytics, Firebase Crashlytics). Collected only with your explicit consent; see Section 10.
• Ad Measurement Data: Advertising identifier, app installs and opens, subscription purchases. Shared with Meta only with your permission; see Section 10.7.

1.2. User-Provided Data

• Identity Information: When you sign in with Apple, Google or Facebook (name, email)
• Phone Number: If you use phone sign-in
• Worship Data: Personal prayer tracking, tasbeeh counts, favorite duas
• Preferences: App settings, notification preferences

2. How We Use Your Data

We use the data we collect for the following purposes:

• Core Functionality: Calculating prayer times, showing qibla direction
• Personalization: Location-specific notifications, verse of the day
• Authentication: Account creation and secure sign-in
• Data Synchronization: Syncing your worship data across devices
• App Improvement: Performance analysis, fixing errors and improving the user experience. Analytics and crash reports for this purpose are processed only with your explicit consent (Section 10).
• Ad Measurement: Measuring which Instagram or Facebook ad led you to the App. Only with your permission (Section 10.7).
• Technical Support: Troubleshooting and responding to user requests

3. Data Sharing

We never sell your data. We only share with third parties in the following cases:

3.1. Service Providers

• Firebase (Google): Authentication, database, notifications; if you consent, analytics (Firebase Analytics) and crash reporting (Firebase Crashlytics). Google acts as a data processor for these services.
• Apple/Google: Minimum data required for Sign In services
• Meta (Facebook): Data required for the "Continue with Facebook" sign-in option and, only if you allow it, ad measurement data. See Sections 10.6 and 10.7.
• Aladhan API: Anonymous location for prayer time calculations

3.2. Legal Obligations

• Court orders or legal requirements
• Violation of terms of service
• Protection against security threats

4. Data Security

We take the following measures to protect your data:

• Encryption: All sensitive data is stored encrypted
• HTTPS: All network communication is protected with SSL/TLS
• Firebase Security Rules: Database access control
• Token-Based Authentication: Secure session management
• Regular Security Updates: Software updates

5. Data Retention Period

• Active Accounts: As long as your account is active
• Inactive Accounts: Data may be deleted after 2 years of inactivity
• Deleted Accounts: Permanently deleted within 30 days
• Analytics and Crash Reports: Analytics data is deleted after 14 months and crash reports after 90 days (Section 10.4). Because this data is not linked to your account, deleting your account does not delete it separately; it is deleted automatically at the end of these periods.
• Legal Requirements: May be retained longer if legally required

6. User Rights (KVKK & GDPR)

You have the following rights:

• Right of Access: Learn what data we store
• Right of Rectification: Correct inaccurate information
• Right of Erasure: Delete your account and data
• Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to data processing
• Restriction of Processing: Request suspension of processing in certain cases
• Withdrawal of Consent: Withdraw your consent to analytics and crash reporting at any time under Profile → Privacy & Legal
• Right to Complain: Lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or the data protection authority of your EU country

To exercise your rights: destek.minaraapp@gmail.com

7. Children's Privacy

Minara does not knowingly collect data from users under 18. If you are a parent or guardian and notice that your child has provided data without permission, please contact us.

8. Location Data Details

Why Do We Need It?

• Calculate prayer times based on your coordinates
• Determine qibla direction
• Select the appropriate calculation method for your country

How Is It Used?

• Only requested when necessary (one-time or while using)
• Continuous background tracking is not performed
• Not sold to third parties or used for marketing
• Cached and may be updated 1-2 times per day

How Do You Control It?

• iOS Settings → Minara → Location → "While Using the App"
• You can revoke permission at any time (some features will not work)

9. Notifications

Permission and Use

• Permission is requested for prayer time reminders
• Verse of the day sharing (optional)
• Important app updates

How to Disable

• iOS Settings → Notifications → Minara → Disable
• In-app Settings → Notifications

10. Analytics, Crash Reports and Ad Measurement

To improve the App and fix errors, we use Google's Firebase Analytics (Google Analytics) and Firebase Crashlytics. Because the way you use the App and your setting preferences (including your prayer-time calculation method) can reveal your religious beliefs, we treat this data as a special category of personal data and process it only with your explicit consent.

10.1. Explicit Consent

• Off by default: Unless you consent, analytics and crash reporting are switched off on both iOS and Android.
• Asked with a short question: When you first install the App, right after the notification permission request, you are asked for your consent with the "App feedback" question (Allow / Don't allow); users who skip the introduction or installed the App earlier see the same question on the home screen. Details of what is collected are on this page.
• Only you can turn it on: Consent is given only by an explicit choice of yours inside the App (tapping "Allow" on this question or switching on the "App feedback" toggle in Profile). Using the App does not count as consent.
• Withdraw at any time: You can withdraw your consent at any time by switching off the "App feedback" toggle under Profile → Privacy & Legal. When you withdraw, crash reports still waiting on your device that have not yet been sent are deleted as well.
• Saying no restricts nothing: If you do not consent, or you withdraw your consent, the App sends no usage data or crash reports to Firebase Analytics or Firebase Crashlytics. No feature of the App depends on this consent.
• Events held until you decide: Until you decide, at most 100 usage events and the segment information created while the App stays open are kept only in your device's memory. If you consent, they are sent too; if you do not consent, or the App is fully closed, they are deleted and sent nowhere.
• One consent: Analytics and crash reporting share the same consent; you are not asked separately for each.

10.2. What We Collect If You Consent

• Screens and features used: Which screens you open and which features you use. This includes the use of worship features, for example: marking a prayer as performed (which prayer, and whether it was marked on time), memorisation (hifz) sessions (surah, number of verses and accuracy rate), dhikr sessions (dhikr type and whether the target was reached; count and duration only as ranges), Quran reading and listening (surah, where the surah was opened from, reading mode, reciter, adding a bookmark; number of verses read and duration only as ranges), viewing duas, hadiths and the Names of Allah and adding a dua to favourites (dua category, hadith section or the index number of the Name), sending a dua request (without its content), joining a group khatm or a dhikr group and completing a group khatm (with the group's identifier and how many days the khatm took; we do not match this identifier with account data).
• Time spent in the App: How long sessions and screens stay in the foreground. Google Analytics measures this per screen automatically, including time spent on worship screens such as the Quran reader.
• App events: Events Google Analytics records automatically, such as first open, session start, app and operating system updates, and notifications being received and opened (on Android also the App being uninstalled and its data being cleared); progress through the introduction screens; results of permission prompts (including, for location, whether precise location was granted); how long the first prayer-time table took to appear and which kind of location it used; the default city being used when no location could be found (with the reason); setting up the adhan notification schedule (number of scheduled notifications) and, on Android, a prayer notification reaching the device (which prayer it was for); the App being opened from a notification, widget, Live Activity, Spotlight or a link; taps on the buttons of the weekly Friday event screen; sign-in method and new account creation (such as Apple, Google or phone; without account details) and a guest user tapping the sign-in button on the profile screen; opening the qibla compass; nearby places searches (place type and a range for the number of results; no location is sent); creating and sharing a share card (content type); subscription screen interactions and purchase events (plan type; Google Analytics may also record purchases automatically with product ID and price; no payment details are sent); the type of error shown to you (no error text is sent); where you gave consent (the question during the introduction, the question on the home screen or the setting).
• Setting preferences: When you change a setting, which setting you changed and the value you chose (for example theme, Quran font and reading mode, adhan sound, notification and reminder preferences). This includes your prayer-time calculation method (for example Diyanet, ISNA, Umm al-Qura, Tehran or the Shia Ithna Ashari method). Your calculation method can indirectly reveal your religious beliefs; so, like the rest of the analytics data, this value is treated as special category data and is collected only with your explicit consent. For some settings, such as Quran font size, Hijri date adjustment and time format, only the fact that the setting changed is sent, not its value.
• Segment information: Whether you have Premium, whether you are a guest or signed in (not who you are), notification permission status, whether adhan notifications are scheduled on the device or by the server, which kind of location the prayer times use (GPS, a manually chosen city or the default; not the location itself), app language, a range for the number of installed widgets.
• App and device information: App version, device model, operating system and version, device language.
• Approximate location: Country and region level, derived by Google from the IP address of your connection. Google Analytics does not log or store IP addresses.
• Crash and error reports (Firebase Crashlytics): When the App crashes, the type and message of the error and a stack trace showing where in the code it occurred; for some errors the App catches, the type of error and a stack trace (for these errors the text of the error message is not sent). App language, Premium status and the device's technical state (for example device model, OS version, free memory) are added to the reports. Crashlytics may also attach the analytics events recorded just before a crash.
• Installation identifiers: Randomly generated identifiers specific to this installation of the App (Google Analytics app instance ID, Firebase installation ID and Crashlytics installation ID). They link events from the same installation and are renewed when you delete and reinstall the App. The Firebase installation ID is also created, independently of consent, so that other Firebase services such as notifications can work; if you do not consent, it is not used for analytics or crash reporting.

10.3. What We Do Not Collect

• Your name, email address, phone number and account ID are not added to analytics data or crash reports. No user ID is sent to Google Analytics; analytics data is not linked to your account.
• No precise location (GPS coordinates) is sent.
• No search text is sent; only the section searched and whether results were found.
• The text or ID of a dhikr you created is not sent; only the type "custom dhikr" is sent.
• The text of your dua requests and notes, and the text of error messages shown to you, is not sent.
• No advertising identifier (iOS IDFA, Android advertising ID) is added to analytics data or crash reports. The advertising identifier is shared only with Meta, and only if you allow ad measurement in Section 10.7.
• Analytics data is not used for advertising, marketing, sale or personal profiling. We do not link Google Analytics to advertising services, we keep ad-personalization signals off, and we look at the data as aggregate statistics, not to follow individual people.

10.4. Processor, Location and Retention

• Processor: Through Firebase Analytics and Firebase Crashlytics, Google processes this data on our behalf and on our instructions, as a data processor.
• Where it is processed: Google Analytics and Crashlytics data may be processed on Google's global infrastructure, including in the USA and other countries outside the EU (Section 11).
• BigQuery copy: A copy of the raw analytics events is stored in a BigQuery dataset in our own Google Cloud project, in the EU region (europe-west1, Belgium). This copy also contains the pseudonymous installation identifiers, is not joined with your account data and is deleted after 14 months.
• Retention: Event-level and installation-level data in Google Analytics is deleted after 14 months. After that, only aggregate report figures that do not relate to a person (for example the total number of users per day) may remain. Crashlytics keeps crash reports for 90 days.

10.5. Legal Basis

Our legal basis for analytics and crash reporting is your explicit consent: for special categories of personal data, Article 6(3)(a) of the Turkish Personal Data Protection Law (KVKK); Articles 6(1)(a) and 9(2)(a) GDPR. Storing and reading the installation identifiers on your device for this purpose also relies on this consent. You can withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it. When you withdraw consent, sending new data stops; data already sent is deleted at the end of the periods in Section 10.4.

10.6. Facebook (Meta) SDK

Meta's Facebook SDK is in the App for two purposes: the "Continue with Facebook" sign-in option and, only if you allow it, ad measurement (Section 10.7). The SDK's automatic app event logging and advertising ID collection are off by default: they are switched off in the App's configuration before the SDK starts, and switched on only if you allow ad measurement. Even so, and even if you never sign in with Facebook or allow ad measurement, the SDK may connect to Meta's servers each time the App opens to fetch its configuration and may send a technical event reporting that it was initialised. Through these connections your IP address, technical information such as the app and SDK version, device model and OS version, and a random identifier the SDK creates on your device may reach Meta. These connections do not depend on your analytics consent or your ad measurement permission. If you sign in with Facebook, Meta passes us the information needed for sign-in (for example name and email). Meta processes this data under its own privacy policy.

10.7. Ad Measurement (Meta)

We promote Minara with ads on Instagram and Facebook. To measure which ad led you to the App, we switch on the Facebook SDK's automatic app events and advertising ID collection only if you allow it. We are aware that the fact that you use a religious app may allow an inference about your religious beliefs; this is why ad measurement happens only with your explicit permission.

• How we ask: On Android, with an "Ad measurement" question in the permissions step of the introduction (Allow / Don't allow); on iOS, with Apple's app tracking permission prompt. It is off by default; not allowing it does not restrict any feature.
• What goes to Meta if you allow it: Your device's advertising identifier (iOS IDFA, Android advertising ID), app installs and opens, subscription purchases (product, amount and currency), and technical information such as IP address, device model, operating system and app version.
• What does not: Your worship records, dhikr counts, prayer-time calculation preferences, location, dua requests and notes are not sent to Meta for this measurement. We do not record any custom event about your in-app behaviour through the Facebook SDK.
• How to withdraw: On Android, with the "Ad measurement" switch in Profile → Privacy & Legal; on iOS, with the "Allow Tracking" switch in Settings → Minara (the "Ad measurement" row in Profile opens this page). When it is off, no new data is sent. On Android, deleting your account also withdraws this permission.
• Meta's role and processing location: Meta processes this data under its own privacy policy to measure the results of our ads and improve ad delivery, and may act as a separate data controller for this processing. The data may be processed in countries outside the EU, including the USA.
• Legal basis: Your explicit consent: Article 6(3)(a) KVKK and, for transfers abroad, Article 9 KVKK; Articles 6(1)(a) and 9(2)(a) GDPR. Accessing the advertising identifier on your device also relies on this permission. You can withdraw your permission at any time; withdrawal does not affect the lawfulness of processing carried out before it.

11. International Data Transfers

Your data is stored on Firebase (Google Cloud) servers. These servers may be located in Europe, the USA, or Asia. For transfers outside the European Economic Area, the Standard Contractual Clauses (SCCs) included in Google's data processing terms apply.

The BigQuery copy of analytics data is kept in the EU (europe-west1), while Google Analytics and Crashlytics processing may take place in other countries, including the USA (Section 10.4). When you sign in with Facebook, sign-in data is transferred to Meta; if you allow ad measurement, the data in Section 10.7 is also transferred to Meta.

12. Privacy Policy Changes

We may update this policy from time to time. For significant changes:

• Email notification
• In-app notification
• 30 days advance notice

The last update date is always indicated at the top.

13. Contact

For your questions:

• Email: destek.minaraapp@gmail.com

You can use the same email address for KVKK/GDPR requests.