Privacy Policy

Last updated: October 17, 2026

This Privacy Policy explains how Duha ("the app", "we", "us"), a mobile application by kodmap, handles information when you use it on iOS and Android. Duha has no account and no sign-in. Your prayer times are computed on your device, and your worship records stay there.

The short version. Duha is free, ad-free and works offline. We do not ask for your name, email or phone number, and we never sell your data. Your prayer logs, bookmarks, tasbih counts and other worship records are stored only on your device. What does leave your device: usage analytics and crash reports (Google Firebase), your subscription record (RevenueCat and the app stores), a push-notification token, ad-measurement events (Meta SDK), and the network requests that certain features make — the mosque finder, Qur'an audio and translation downloads, and the system's own place-name lookup. Each is described below. You can turn analytics, crash reporting and the Meta SDK off with Share usage data in the app's Settings, and on iOS your advertising identifier is used only if you allow tracking; section 9 lists all your choices.

1. Information we process

  • Your worship data — prayer logs and streak, Qur'an bookmarks and last-read position, tasbih (dhikr) counts, khatm (hatim) progress, fasting log, and your settings such as calculation method and reciter. All of this is stored locally on your device in the app's own database. It is not uploaded to us. (Some actions are also counted in analytics — see section 4.)
  • Location — used to calculate prayer times, point the Qibla compass toward the Kaaba, and pick a suitable calculation method for your country. Your coordinates are stored on your device and are not sent to us. They do reach other services in the specific cases listed in section 2. If you do not grant location access, Duha uses a default location (Istanbul), and you can grant access later in your system settings.
  • Usage analytics and crash reports — via Google Firebase. See section 4.
  • Subscription status — whether you have an active Duha Plus subscription, via the Apple App Store or Google Play and our subscription processor RevenueCat. See section 5. We never see or store your payment card details.
  • Push-notification token — see section 6.
  • Install source & ad measurement — when you first open the app we record how it was installed (for example an ad campaign, an App Store / Google Play search, or a web link), using the Google Play Install Referrer on Android and Apple's AdServices framework on iOS. We also use the Meta SDK to measure the performance of our ads on Facebook and Instagram (app installs and a few key in-app events, linked to a pseudonymous device identifier). On iOS, your advertising identifier (IDFA) is used only if you allow tracking — see section 4a.

2. When your location leaves your device

Duha never sends your location to us. It does reach the following services:

  • Place name. When the app gets a location fix, it asks your phone's system geocoder (Apple on iOS, Google on Android) to turn the coordinates into a city and country name. That lookup is performed by Apple or Google under their own privacy terms.
  • Mosque finder. When you open the mosque finder, the app sends your precise coordinates to the Overpass API (overpass-api.de), a public OpenStreetMap service, to find mosques within about 5 km. The request carries no identifier of ours, but like any web request it reveals your IP address. If you never open the mosque finder, this request is never made.
  • Maps. On iOS the mosque finder shows an Apple Maps (MapKit) map around you, loaded from Apple. When you tap for directions, the app hands the mosque's location to Apple Maps or Google Maps, which then work under their own terms.

Your coordinates are not included in analytics events or crash reports. Note that Google Analytics, like any internet service, sees your IP address and derives an approximate region (such as country or city) from it.

3. Content you download

Qur'an recitations are streamed and, when you choose, downloaded from everyayah.com. Translations and tafsir are fetched on demand from api.quran.com, cdn.jsdelivr.net and quranenc.com. These requests carry no identifier of ours, but each host sees the request and your IP address, as with loading any web page.

4. Analytics, crash reporting and identifiers (Google Firebase)

Duha uses Google Firebase. None of it shows you ads; how we measure our own ads is described in section 4a.

  • Firebase Analytics — which screens are opened and which features are used, so we know what to improve. Besides screen views and the onboarding and Duha Plus purchase steps, a few events describe how you use the app's worship features: that a prayer was marked (with the prayer's name and how it was marked), that a surah was marked as read (with the surah number), that a dhikr goal was reached, and which Esma category or mood was chosen. Events do not contain your location, the text of your bookmarks, or your full prayer history. Purchase events include the product, price, currency and store transaction ID.
  • Firebase Crashlytics — when the app crashes, the stack trace, device model, OS version and app version, so the bug can be found.
  • Firebase Remote Config — the app downloads settings from us (for example, whether an update is required). The request carries the Firebase installation ID, app version and device language.
  • Firebase App Check — confirms requests come from a genuine copy of the app, using Apple App Attest on iOS and Google Play Integrity on Android.

Identifiers. Firebase assigns your install a random app-instance identifier. Analytics and crash reports are additionally tagged with the anonymous RevenueCat user ID described in section 5, so analytics, crash reports and your subscription record share one random ID. That ID identifies an installation of the app, not you: it is not linked to your name, email or phone number, and reinstalling the app produces a new one. On Android, the Firebase and Meta SDKs can also read the device's Google advertising ID; Duha shows no ads, and you can delete or reset that ID in your Android settings. On iOS, the advertising identifier (IDFA) is available only if you allow tracking — see section 4a.

4a. Tracking & advertising identifiers (App Tracking Transparency)

On iOS, Duha asks for your permission once, with Apple's App Tracking Transparency (ATT) prompt, near the end of the welcome screens (or, if you finished them before this was introduced, once after the app opens). What happens next depends on your answer:

  • If you tap “Allow” — your device's advertising identifier (IDFA) is shared with Meta (Facebook) through the Meta SDK and used to measure and attribute our ads on Facebook and Instagram, that is, to learn which ad led to an install or a purchase. RevenueCat also records your device identifiers (the IDFA and the IDFV, Apple's identifier for vendors) with your subscription record, so that a purchase can be attributed to the ad campaign that brought you to the app. Your location and worship records are never shared with Meta, Duha shows no ads, and we do not sell these identifiers.
  • If you tap “Ask App Not to Track” — nothing changes. The IDFA is not accessed, and our ads are measured only with aggregated, privacy-preserving methods: Apple's SKAdNetwork, Meta's Aggregated Event Measurement and Google's on-device conversion measurement.

If you have turned off Share usage data in the app's Settings, the prompt is not shown at all.

Changing your mind. On iOS, open Settings > Privacy & Security > Tracking and switch Duha off (or turn off “Allow Apps to Request to Track” for every app); sharing stops from that moment. Android has no tracking prompt: on Android, the device's Google advertising ID is passed to the Meta SDK, to measure our own ads, only while you have left Share usage data on (turning it off stops this on that device); the Firebase SDK may also read it, and you can delete or reset it in Settings > Google > Ads (on some devices Settings > Privacy > Ads).

5. Purchases and subscription (RevenueCat)

Duha Plus is sold through the Apple App Store and Google Play. We use RevenueCat to check your subscription. RevenueCat receives the store's purchase records for your Duha Plus purchases, an anonymous app user ID it generates (not tied to your name or email), basic device and app information (OS, app version, country, and the IP address of the request), and these attributes from the app: whether you have Duha Plus, whether onboarding is finished, whether you have reached the app's activation milestone, a count of key actions, how many times and for what reason the Duha Plus screen was shown, your push-notification token (section 6), the last notification or link campaign you opened (section 6a), and — on iOS, only if you allow tracking — your device identifiers (IDFA and IDFV, section 4a). We use these to know whether to unlock Duha Plus and to choose which in-app messages and notifications are relevant to you.

6. Notifications

  • Prayer and adhan reminders are scheduled as local notifications on your device. They do not involve our servers.
  • Push notifications. Duha uses Firebase Cloud Messaging (FCM), which gives your install a push token. The app subscribes that token to a general topic and to a topic for your app language, so we can send announcements in your language. The token is also stored with your RevenueCat record, so we can send a notification to groups of users defined by the attributes in section 5 (for example, users who have not finished onboarding). Notifications are shown only if you allow them; you can turn them off at any time in your system settings.

6a. Campaign & notification measurement

When you open Duha from a push notification, from one of the reminder notifications described in section 6b, or from a link, we record which campaign it belonged to — a campaign identifier, its type and its source (for example a push notification, a reminder or a link) — in Google Analytics for Firebase and as an attribute of your subscription record at RevenueCat. For the next 72 hours, that campaign identifier is attached to a few in-app events (the Duha Plus screen being shown, a purchase being started or completed, and reaching a key milestone in the app), so we can tell whether a campaign was useful, including whether it led to a purchase. The campaign identifier describes the message or link, not you, and it never contains anything you created in the app.

6b. Reminder notifications scheduled on your device

Duha can schedule a few reminder notifications locally on your device — they are not sent from a server: for example a reminder if you have not opened the app for a few days, a reminder to finish setting up the app if you left the welcome screens halfway, a note shortly before a free trial ends, or a reminder a day after you looked at Duha Plus without subscribing. They appear only if you have allowed notifications; the inactivity reminders are re-planned every time you open the app, so they do not reach someone who is using it; and they never contain prices or discount offers. Opening one is measured as described in section 6a. You can turn them off at any time with Suggestions & reminders in the app's Settings, or by turning off notifications for Duha in your system settings.

These are separate from your prayer and adhan reminders, which keep working when Suggestions & reminders is off.

7. What we do not do

We do not collect your name, email address, phone number or contacts. Duha has no account, so there is no profile with your identity in it. We show no ads and do not sell your data. Your data is not used to track you across other companies' apps or websites, with one exception that you control: on iOS, if you allow tracking, your advertising identifier is shared with Meta to measure our own ads (section 4a).

8. Third-party services

Duha relies on these providers, each under their own privacy terms:

  • Google Firebase (Analytics, Crashlytics, Remote Config, App Check, Cloud Messaging) — sections 4 and 6.
  • RevenueCat — subscription management and purchase attribution, sections 5 and 6a.
  • Apple App Store / Google Play — payment processing and subscription billing.
  • Apple / Google system geocoding and maps — section 2.
  • Overpass API (OpenStreetMap) — the mosque finder, section 2.
  • everyayah.com, api.quran.com, jsDelivr, quranenc.com — content downloads, section 3.
  • Meta Platforms (Meta SDK / App Events) — measuring the performance of our ads on Facebook and Instagram and, on iOS only if you allow tracking, attributing them with your advertising identifier (section 4a).

9. Legal basis and your choices (GDPR / UK GDPR)

If you are in the EU, the UK or Switzerland: the requests needed to deliver the features you use (sections 2, 3 and 6, and the subscription check in section 5) are necessary to provide the app to you (Art. 6(1)(b)). Analytics and crash reporting (section 4) are based on our legitimate interest in understanding how the app is used and why it crashes, so we can fix and improve it (Art. 6(1)(f)). Campaign measurement (section 6a) and reminder notifications (section 6b) rest on the same legitimate interest. Sharing your advertising identifier on iOS (section 4a) happens only with your consent (Art. 6(1)(a)), given in the App Tracking Transparency prompt, which you can withdraw at any time.

Your choices:

  • Share usage data — turning off Share usage data in the app's Settings stops Google Analytics, Firebase Crashlytics and the Meta SDK together on that device. The choice is re-applied every time the app starts.
  • Tracking — on iOS, allow or decline tracking in the App Tracking Transparency prompt, and change it at any time in Settings > Privacy & Security > Tracking. On Android, delete or reset your advertising ID in Settings > Google > Ads.
  • Notifications — turn off reminder notifications with Suggestions & reminders in the app's Settings, or turn off all notifications for Duha in your system settings. Prayer and adhan reminders are managed separately in the app.
  • Object by contacting us (section 13). Because we do not know who you are, tell us something that lets us find your install — the store order number of a Duha Plus purchase is the most reliable — and we will delete the matching analytics, crash and subscription records and stop processing them.
  • Uninstall Duha. This stops all collection; a new install gets new random identifiers.
  • Deny or revoke location access (the mosque finder then cannot search near you).

10. Your rights

Wherever you live, you can ask us to confirm what we hold, to correct it, to delete it, or to stop processing it, and you may complain to your local data protection authority. Your worship records never leave your device, so they are already in your hands; for analytics, crash and subscription records, write to the address in section 13 — see also Data Deletion.

California residents: we do not sell personal information. If you allow tracking on iOS, your advertising identifier is disclosed to Meta to measure and attribute our own ads; you can stop this at any time in Settings > Privacy & Security > Tracking, which also serves as your opt-out of “sharing” as that term is used in the CCPA/CPRA. The contact address in section 13 is your request channel.

11. Retention

Worship records stay on your device until you delete them or uninstall the app. Analytics and crash data are kept by Firebase for the limited periods set in our Firebase project and are then deleted automatically. Your subscription record is kept by RevenueCat and the app stores for as long as needed to manage the subscription and to meet legal and accounting obligations.

12. Children

Duha is suitable for all ages but is not directed at children under 13, and we do not knowingly collect personal information from children.

13. Changes and contact

If this policy changes materially — in particular if we begin collecting a new category of data or add a provider — we will update this page and change the date above.

Questions or requests: kodmapdev@gmail.com, or use our Contact page.