Ilmify Privacy Policy

Who Is Responsible

Ilmify is provided by a private individual, not a company. The person responsible for processing your personal data (the “controller”) is:

Jason Omar Turkmani
Etzmattrain 32
3322 Urtenen-Schönbühl
Switzerland
Email: Jason.omar.turkmani@gmail.com

This policy is written to meet the Swiss Federal Act on Data Protection (FADP, in German “revDSG”) and, for people in the European Union and the European Economic Area, the EU General Data Protection Regulation (GDPR).

Ilmify has not appointed a representative in the EU. Its processing of personal data about people in the EU is occasional and low-risk: almost everything stays on your device, the shared totals are anonymous, the Community account holds no name or email address, and payments are handled by Apple (Art. 27(2)(a) GDPR). Wherever you live, including in the EU, the EEA and Switzerland, you can contact the controller directly by email at the address above. There is no data protection officer; the controller handles privacy requests personally.

Ayah Check

The ayah check listens while you recite one ayah, then shows words where your recitation may differ from the text. It uses the microphone only while you recite, for at most five minutes per check. The audio is kept in memory and checked on your device by a recognition model supplied with the app. It is not saved as a file, not sent to the developer or to any recognition service, and not used for recitation donation.

So that you can see how earlier checks went, the app keeps a history on your device: which ayah you checked, when, how the check ended, and the kind and word position of each finding, including findings you marked as “This wasn’t a mistake”. It contains no audio and no transcript. It keeps at most the 10 most recent checks of each ayah and 1,000 checks in total; older entries are removed as new checks are added. The history is not sent to the developer, is not included in learning backups and is removed by the all-learning-data erase control.

The only information from the ayah check that leaves your device is the number of findings shown each day, as part of the anonymous totals described below, unless you turn those off.

Recitation Playback And Downloads

Ilmify can play recordings of Qur’an recitation by well-known reciters, ayah by ayah. These recordings are not hosted by Ilmify. The app fetches them directly from EveryAyah.com, a third-party website that publishes them. When you play a recitation, the app requests each ayah’s audio file from EveryAyah, including the next few ayat in advance so that playback continues smoothly. If you download a surah, the app requests all of its files and EveryAyah’s list of checksums used to verify them.

As with any website, EveryAyah’s servers receive your IP address, the time of each request and the files requested. The file names show the reciter and the surah and ayah being played or downloaded. The requests also carry standard technical details and an app label, “Ilmify (iOS app; Qur’an recitation playback)”. Ilmify does not send EveryAyah your name, an account, a device identifier or any other learning data. Ilmify does not receive EveryAyah’s server records and does not control how long EveryAyah keeps them; EveryAyah may process them in other countries.

You can turn off playback over mobile data in the playback options. Downloads use Wi-Fi only unless you change that setting. Recitations you have played are kept temporarily on your device (up to about 200 MB, oldest removed first). Downloaded surahs are kept until you delete them in Downloads. These files are excluded from device backups and from Ilmify learning backups. They contain only the published recitation, never your voice.

Playback does not use the microphone. When you start read-along or an ayah check, playback pauses so that the recording is not mixed with your own recitation.

Qur’an Sync With iCloud

Optional Qur’an sync keeps the following the same on your iPhone and iPad when they are signed in to the same iCloud account: your Qur’an highlights, bookmarks, notes and ayah folders, your reading position, and some reader display settings, such as appearance, font, page design and frame theme. Text size, layout and other settings that depend on the screen stay on each device. Memorize progress, read-along records, ayah-check history, My progress counts, microphone audio and all other learning data are not synced.

Sync uses Apple’s iCloud (CloudKit). It stores this data in the private database of your own iCloud account, where it counts toward your iCloud storage. The Ilmify app on your signed-in devices reads, writes and deletes this data only to keep your devices the same. Ilmify’s developer and its service providers cannot access it, and it is never sent to an Ilmify server or to any other third party. Apple stores it under the iCloud terms and Apple’s privacy policy. Your notes and the names and contents of your folders are encrypted on your device before they are uploaded; if you turn on Advanced Data Protection for iCloud, only your devices hold the keys to them. The other synced items (which ayat you highlighted or bookmarked, your reading position and reader settings) are protected by iCloud’s standard data protection. Sync status and errors are shown only on your device; Ilmify does not collect sync statistics or reports.

Sync is off until you turn it on in Data & Privacy (“Sync with iCloud”). When it first runs on a device, and again each time you turn it back on, the app saves a safety copy of your Qur’an marks, notes, synced reader settings and reading position as they were before the merge, on that device only. Safety copies are removed once they are older than 30 days (checked after each successful sync and when sync is turned off), and erasing all learning data in Data & Privacy removes them at once. Turning sync off stops syncing on that device; your data stays on the device and in iCloud.

Erasing all learning data in Ilmify erases this device only and turns sync off; it does not delete the copy in iCloud, so it cannot erase your other devices. To delete the synced copy, turn sync off on your devices and delete Ilmify’s data in your device’s iCloud storage settings (Settings > your name > iCloud > Manage Storage). Restoring a learning backup while sync is on makes your Qur’an marks and notes on your other devices match the backup. If you sign out of iCloud or a different iCloud account signs in on the device, sync turns off on that device and Ilmify does not upload your data to the other account.

Anonymous Totals (My Progress)

My progress shows counts of your activity in Ilmify: time in the Qur’an tab (and, within it, time Recited aloud and time Read silently), ayat read, the number of Arabic letters in those ayat, ayah checks done and the findings they showed, read-along sessions started, time in the Learn tab, Learn lessons finished and reviewed, prayer lessons completed, Learn to Pray guides started, dhikr counted and shares. These counts are kept on your device and in learning backups you export, and the all-learning-data erase control removes them. They count actions in the app only. They do not measure worship or anything outside Ilmify.

To show totals for everyone who uses Ilmify, and to understand which features are used, the app sends Ilmify a short report. This is on by default, and you can turn it off at any time (see below). The app sends at most one new report a day. Each report contains:

• the counts above for completed days that have not been sent yet (at most the last seven days, time in whole minutes, each count capped per day), with the date of each of those days;
• for those days, how often each feature of the app was used (for example, opening the Qur’an search, or which starting place the first-launch questions suggested) and which QuranEnc translation books were opened;
• for those days, read-along measurements summed per day, never audio, recognised words or which ayah you recited: how many read-along sessions ran in each mode (Recite along, Memorize, Test) and in which length range; how often the speech check heard speech or no speech; ranges for the typical piece length, input level, level boost, recognition delay and time to the first followed word; how many words were followed; and how many recognised results could not be placed in the text, by reason;
• only in a report that carries these read-along measurements, the device’s broad class: for an iPhone its chip generation (or “other” if it is not recognised), for an iPad or Mac only “iPad” or “Mac”, for any other device “other”, together with a memory-size band, never the device model;
• a snapshot of which app settings are switched on, and the translation chosen to show inside the Qur’an reader;
• the app version and a random report code.

The report code is made new for each report and is reused only when that same report is sent again after a failed attempt, so that it is counted once; it does not link reports to each other, to you or to your device. A report contains no name, account, Apple ID, device or advertising identifier, installation code, location, time of day, list of ayat, notes, search text, recording or any other text you wrote. The device’s broad class is shared by many devices and is not an identifier. It is never linked to your Community account. Only days from the day sharing starts on your device are sent; days while sharing was off, and counts that were erased or restored from a backup, are never sent. If a report cannot be delivered, the app tries the same report again later, for up to six days, and then drops it.

Reports go over an encrypted connection to a small service that Ilmify runs on Cloudflare (Cloudflare Workers and a D1 database). The service checks each report and stores it as cleaned-up data, without your IP address or the request headers. Several times a day it adds the reports of each completed day to daily sums for all users together (the read-along measurements are also summed by device class and by app version); at that point the settings snapshot, the chosen translation and the device class are removed from the stored reports. The stored reports and their codes are deleted after about 90 days (a scheduled clean-up deletes them once they are more than 90 days old and have been added to the sums, so deletion can take a little longer). The daily sums have no automatic expiry. Because reports are not linked to you, Ilmify cannot tell which report came from you. It therefore cannot show you, correct or delete your individual report. The totals are approximate: for example, a report that never arrives is not counted. The combined totals are shown in the app and may be shown on Ilmify’s website.

Cloudflare, Inc. runs the infrastructure for this service. To deliver reports it necessarily receives your IP address and technical connection details. Ilmify’s service does not store them and is set up without request logging. Cloudflare processes connection data as Ilmify’s service provider and, to operate and protect its network, under its own terms; what Cloudflare itself records and how long it keeps it are described in the Cloudflare Privacy Policy. Cloudflare may process data in other countries, including the United States. While sharing is on, opening My progress also fetches the current totals from the same service; that request contains no counts.

Turning it off: switch off “Share anonymous totals” in Settings, in the Privacy section. The app then deletes any report that has not been sent yet and sends nothing more; a report that was already on its way at that moment may still arrive and be counted. Turning it off also stops the feature-use counts and read-along measurements on your device. While sharing is off, the app also does not fetch everyone’s totals. If you turn it on again, only days from that day on are sent. Your own counts in My progress stay on your device either way.

Although Ilmify cannot link a report to you, we treat reports as personal data to be safe. A report carries no identifier and cannot be attributed to a person, so its counts of Qur’an and other religious activity in the app do not reveal any individual’s religious belief; we nevertheless apply the safeguards described above. The legal basis is Ilmify’s legitimate interest in understanding, in aggregate, how the app is used and in showing shared totals (Art. 6(1)(f) GDPR; Art. 31(1) FADP). You can object at any time by turning the switch off.

Groups In The Community Tab (Optional Account)

Groups are optional, in Ilmify versions that offer them. Everything else in Ilmify works without an account. To use groups, you sign in with Apple, confirm that you are 16 or older and agree that Ilmify may store your time with the Qur’an for the groups you join. Ilmify does not ask Apple for your name or email address.

What is stored on Ilmify’s server

• Your account: a random account number; a scrambled form (a keyed hash) of the number Sign in with Apple gives Ilmify, never that number itself; the username and colour you choose; your “Show my time in groups” choice; the version of the terms you agreed to; when you created the account, when you last changed your username, when Apple last confirmed your sign-in, and the last day you used groups; and a random number for each of your devices (at most 5), made by the app and not an Apple or advertising identifier.
• Your time with the Qur’an: for each day, two numbers counted on your device. Recited is time reciting aloud while read-along, Memorize mode or Mutqin follows your recitation. Read is time reading silently with a Qur’an page open on screen; nothing is counted while the device is idle or locked or Ilmify is in the background. The two numbers are never added into one score. They are sent only while you are signed in, “Show my time in groups” is on and you are in at least one group. No ayah, surah, page or time of day is sent, and each day counts for at most 6 hours per measure. For each group you currently belong to, a monthly aggregate also keeps your contribution from the day you joined during that joining month. It contains the same two time totals, not reading details, and is deleted when you leave the group, turn sharing off or delete your account.
• Your groups: the groups you create or join, their names and invite codes, the settings their creator chooses (whether the group appears on the monthly board, its area and a monthly goal) and, in a shared khatmah, the juz you take or mark as read.
• Reports and blocks you make, and short-lived counters used to limit misuse.
• Account security: a digest of an Apple revocation notification to prevent duplicate processing, and a temporary revocation cutoff keyed by the same Apple-account hash already used for your account. These security records hold identifiers and timestamps, not Qur’an time, reading details or recordings.

Your prayer check-ins, achievements, personal goals and records, which ayat you read, and any recordings are never sent to this server. The anonymous totals report (see Anonymous Totals) is handled by a separate service and is never linked to your account.

Who sees what

• Members of your groups see your username and colour, that you are a member and the day you joined, and, in a shared khatmah, which juz you took or read. No individual time row is displayed: a group shows only its members’ time together this month, Recited and Read side by side, and each total appears only once at least 3 members have that kind of time this month. Your time counts in a group from the day you joined it. When someone joins or leaves, the change in a total can still hint at that person’s time since they joined.
• The monthly board lists only groups whose creator turned on “Show this group on the monthly board”, that have at least 3 members and at least 3 members with time this month. It shows each group’s name, number of members, area (if set) and time together this month. There is no individual time ranking. Group members are listed by username.
• Groups near you: a group’s creator can give it a coarse area, either a country or a city of 300,000 people or more (city list from GeoNames). A group that appears on the monthly board and has an area can be found and joined by people who choose that area. Whoever joins this way becomes a member and sees what every member sees (usernames, colours, the day each member joined, the group’s totals); the group screen tells its members while the group can be found this way. The area you choose for yourself is kept on your device and sent only with a request for the groups there or for the monthly board filtered to that area; it is not stored with your account. The first suggestion is the country set in your device’s region settings, read on the device. Ilmify does not use GPS and does not ask for location permission.
• Invitations: anyone with a group’s invite link or code can join it until its creator closes the group to new members. The invite web page shows no group details.
• Reports: a reported name can be hidden. It is hidden automatically only after reports from people close to it (members of the group, or people who share a private group with that person) or from many people; other reports are reviewed by us. The reported person is not told who reported it.

Service provider and transfers

The groups server (ilmify-community.89tq2ph8mv.workers.dev) runs on Cloudflare (Workers and D1), which hosts it for Ilmify as its service provider. Ilmify’s groups server is set up without request logging. Your IP address is used briefly in memory to limit misuse and is not stored by Ilmify; Cloudflare processes it as the host. Cloudflare may process data in other countries, including the United States. Apple provides Sign in with Apple under its own privacy policy.

Legal basis

The account and groups are provided because you ask for them (Art. 6(1)(b) GDPR). Because time with the Qur’an can reveal religious belief, Ilmify stores it only with your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) FADP), which you give when you sign in. You can withdraw it at any time by turning off “Show my time in groups” or deleting your account. Reports, blocks and misuse limits rely on our legitimate interest in keeping groups safe (Art. 6(1)(f) GDPR; Art. 31(1) FADP).

How long it is kept

• Each day’s two numbers: 62 days. Monthly totals, including current groups’ joining-month contributions: the current month and the 12 months before it.
• An account not used for 24 months is deleted with its linked data.
• A group with no activity for 365 days is deleted.
• Misuse counters: 7 days. A username you give up stays reserved for you for 30 days.
• Reports and blocks: until the account that made them, the reported account or the reported group is deleted.
• Deleted data can remain in Cloudflare’s database recovery copies for up to 7 days.
• Apple revocation cutoffs are set to expire 75 minutes after receipt; notification digests expire after the signed notification’s 24-hour validity window. Both are removed by the next successful daily cleanup after expiry, which can be later. These limited security records can remain after account deletion; 75 minutes is not a maximum storage guarantee.

Your choices

• Show my time in groups: turning it off in Account deletes your time from the server at once; your groups’ totals then no longer include you.
• Leave a group at any time, and change your username once every 30 days.
• Download my data in Account gives you a file with everything the server holds about your account.
• Delete account: in the Community tab, tap your name, then Delete account. Ilmify asks you to confirm with Apple once more so that it can revoke Sign in with Apple, then removes your account and its linked data: your time, memberships, devices, and blocks and reports by or about you. A group you created passes to the member who joined it first, or is deleted if nobody else is in it. In a shared khatmah, juz you took become free again, and juz you read stay read without your name. The temporary security records described above can remain until their cleanup.
• If you stop using Sign in with Apple with Ilmify in your Apple Account settings, Apple tells Ilmify. A revocation that can be safely matched to the current account deletes it in the same way. If the order of a revocation and the current account’s Apple authorization is ambiguous, Ilmify keeps the account and groups, signs out all devices, turns time sharing off and removes uploaded time. A fresh Apple sign-in issued after that revocation is required to recover access; time sharing stays off. A verified newer Apple sign-in protects the account from an older notification.
• Signing out removes the account from this device only. Erasing learning data in Data & Privacy does not delete your account; use Delete account.

Improve Our System For Everyone (Recitation Donation)

“Improve our system for everyone” is recitation donation, in Data & Privacy, in Ilmify versions that offer it. Donating needs an iCloud account. From Ilmify 1.4, donation is strictly opt-in: it stays off until you give your explicit consent, and nothing is kept or sent for donation without it. There is no pre-ticked box and no switch that is already on.

Ilmify asks with one full-screen pop-up, “Help improve Ilmify”: at the end of setup or, if you finished or left setup earlier, once later. It asks you to donate your recitations so that Mutqin, Ilmify’s own recitation recognition, gets better for everyone; it says that they are used only to improve recognition and that you can turn donating off in Settings, and its “Details” link opens the full information in the app, which matches this section. You choose “Yes, I’ll donate (I’m 16+)” or “Not now”. The pop-up cannot be swiped away, and nothing in it is preset. Tapping “Yes, I’ll donate (I’m 16+)” is your explicit consent and your confirmation that you are 16 or older. If you tap “Not now”, donation stays off and nothing is collected through it; the app may ask once more later, after a few recitations, and then never again. You can turn donation on or off at any time in Settings or under Menu > Data & Privacy > “Improve our system for everyone”; turning it on there shows the same pop-up, unless you had already said yes and only paused donating, in which case it simply resumes. Turning donation off is free and changes nothing else in Ilmify.

When you tap “Yes” in the pop-up, your device records your consent, with the version of the consent wording you saw and the moment you tapped “Yes”. Each recording keeps these facts, and its upload states them: the consent basis (explicit consent), the confirmed minimum age (16) and the version of the consent wording. If you agreed on the consent screen of an earlier Ilmify version (rather than leaving donation on by default), that explicit consent still counts and you are not asked again; your device’s record of it and your uploads state explicit consent and the confirmed age, but no wording version, because that screen did not record one. If the consent terms change in substance, recordings kept under the earlier terms are not sent, and you are asked again.

If donation was on by default for you in Ilmify 1.3

Ilmify 1.3 turned donation on by default, after a setup notice, for people who confirmed there that they were 16 or older. Ilmify 1.4 no longer does this. If donation was on for you only in that way, it no longer counts: nothing more is kept or sent under it from the first time you open Ilmify 1.4, and you are asked with the pop-up described above (after “Not now”, once more after a few recitations, then never). Recordings still waiting on your device that were not yet sent are not sent: if you tap “Not now” when the pop-up asks, they are deleted from your device, and a later “Yes” does not bring them back; if you tap “Yes, I’ll donate (I’m 16+)” before that, your consent covers them too, and they are sent and used like any recording kept after your consent. Recordings already sent under the 1.3 setting were sent on the basis the 1.3 policy named, Ilmify’s legitimate interest (Art. 6(1)(f) GDPR; Art. 31 FADP). Ilmify no longer relies on it to use them: they are only stored, kept apart, and are not used for training or evaluation, until you have them deleted or Ilmify deletes them. You can have them deleted at any time as described under “Pausing, deleting and withdrawing” below.

What is collected

• Audio: recordings of the Qur’an recitations you make with the microphone in read-along (including Memorize mode) while donation is on, as 16 kHz mono audio. Recordings shorter than two seconds are not kept, and at most ten minutes of each session is kept.
• Related details: the Qur’an ayah and page shown, the calendar day of the recording (not the time), its length, the app version, whether the app came from TestFlight or the App Store, the device type (iPhone or iPad), the major iOS version and the version of the donation terms. From Ilmify 1.4 also the consent basis (explicit consent), the confirmed minimum age (16) and, where recorded, the version of the consent wording you saw.
• A random donor code: created for this purpose. It is not your name, Apple ID, email address, contacts or location. Apple’s CloudKit also attaches its own pseudonymous, app-specific user reference to each upload. Ilmify cannot see your Apple ID from it and does not keep it when downloading recordings.

No transcript and no result of Ilmify’s on-device recitation check is sent. Recordings from the ayah check and from search by reciting are never donated, and live correction sends nothing by itself.

Other voices nearby, such as family or children, can be recorded too, so donate when you recite alone. While a recitation is being kept for donating, the reader shows “Donating this recitation”.

A voice recording is personal data, and donated recordings are grouped under your donor code. We therefore treat them as linked to you, and Ilmify’s App Store privacy details say so. We do not use them to identify who is speaking.

How it is sent and stored

After your consent, recordings are sent automatically over Wi-Fi or mobile data (including Personal Hotspot), so donating may use your mobile data. While Low Data Mode is on, or if you have turned off mobile data for Ilmify in iOS Settings, recordings wait for another connection. They are sent only while you are signed in to iCloud. They go to Ilmify’s storage in the public database of Apple’s CloudKit, which Apple operates as Ilmify’s hosting provider. Only the Ilmify team can read them; CloudKit’s access rules stop other users from seeing or hearing them. Apple may process this data in other countries, including the United States.

A copy of each recording stays on your device until you delete it. These copies are kept in Ilmify’s private app storage with file protection, are excluded from device backups and are not included in Ilmify learning-backup exports. So that you can withdraw later, even after reinstalling the app, your donor code and a list of your uploads are also kept in your own private iCloud database, which Ilmify cannot read, and the donor code is kept in your device’s keychain, which iCloud Keychain syncs to your other devices if you use it. Both are deleted when you withdraw.

The app limits how much it collects: about 100 MB or 60 recordings a day, about 500 MB in total for each installation, and at most about 500 MB or 1,000 recordings kept on the device. When a limit is reached, the app stops keeping new recordings for donation and says so on the donation screen.

How it is used

Only to test and improve how Ilmify follows and checks recitation, for example how well it notices missed, wrong or extra words and vowel marks. This includes training and evaluating Ilmify’s own recognition models, such as those behind Mutqin, read-along and live correction. Recordings are processed on computers controlled by Ilmify’s developer. They are not sold, not shared with other companies, not used for advertising or tracking, not sent to third-party AI or speech-recognition services, and not used to identify speakers.

Legal basis

Your explicit consent only (Art. 6(1)(a) GDPR). Because a Qur’an recitation can reveal religious belief, it is explicit consent to the processing of sensitive data (Art. 9(2)(a) GDPR; Art. 6(7) Swiss Federal Act on Data Protection). For recordings kept or sent from Ilmify 1.4 on, Ilmify does not rely on any other legal basis, and nothing is kept or sent for donation without your consent. Recordings already sent under the 1.3 on-by-default setting are only stored, kept apart and unused, as described above. You can withdraw your consent at any time. Withdrawing does not affect processing that took place before.

How long it is kept

We keep your recordings until you delete them or withdraw, or until they are no longer needed to improve Ilmify’s recitation checking, whichever comes first. We review whether they are still needed at least every 5 years. You can delete them at any time. When they are no longer needed or you ask for deletion, they are deleted from CloudKit and from Ilmify’s computers, including downloaded copies. Withdrawal notices (a donor code and recording names, no audio) are kept as long as Ilmify keeps any donated recordings, so that withdrawn recordings stay deleted, for example if an older copy is restored from a backup.

Age

Donating is only for people aged 16 or older. Tapping “Yes, I’ll donate (I’m 16+)” in the pop-up confirms this together with your consent; donation is never on, and nothing is sent, without that confirmation. If you are younger than 16, tap “Not now”, or turn donation off. If we learn that someone younger donated, we delete those recordings. A parent or guardian can ask for this by email, with the donor code shown in the app.

Pausing, deleting and withdrawing

• Turn it off: turn off “Donate my read-along recitations” on the donation screen (Menu > Data & Privacy > “Improve our system for everyone”), or turn donating off in Settings. It is one tap. Nothing new is kept or sent until you turn it on again with your consent. This is free.
• Delete a single recording: it is deleted from your device at once. If it was already sent, its copy is deleted from CloudKit the next time the app can reach iCloud, and it is never sent again.
• “Withdraw and delete everything”: deletes all your donation recordings from your device at once and turns donation off (withdrawing your consent if you gave it). As soon as the device is online and signed in to the same iCloud account, the app deletes your recordings from CloudKit and leaves a withdrawal notice for Ilmify. Recordings made before you withdraw are never sent afterwards. Because this cannot be undone, the app first explains that it is permanent and asks you to type a word to confirm (DELETE in English, LÖSCHEN in German, SUPPRIMER in French, حذف in Arabic). “Withdraw earlier donations” asks the same.
• Erasing all learning data in Data & Privacy also withdraws the donation in the same way.
• After deleting the app or on a new device: install Ilmify, sign in to the same iCloud account and tap “Withdraw earlier donations”.
• Deletion request by email: the donation screen has “Email a deletion request”, which opens an email to Jason.omar.turkmani@gmail.com with your donor code filled in. You can also write yourself, with the donor code shown in the app after your first donation. Ilmify deletes every recording linked to that code, including downloaded copies, within 30 days and confirms by email. A parent or guardian can request this too.

Copies Ilmify has already downloaded are deleted at its next data update, within 30 days. This includes recordings sent from another iCloud account, which the app itself cannot delete. Models that were already trained are not retrained, but your recordings are left out of all further training and evaluation.