Effective date: 2026-10-13
The short version
- Your practice is personal. The account-free app keeps your plan, listening history and progress on your iPhone.
- No Murattal account is needed in version 1.0.3. Our account and cloud-practice service was retired on 6 October 2026.
- We still process some data: content requests, optional usage statistics, crash reports, purchases, messages you send us, and your email address if you ask for a guide on our website.
- No ads, sale of personal data or advertising tracking. We do not use your Qur’an activity to train machine-learning models.
Version 1.0.3 is available without a Murattal account. If you still use an older account-based version, the older-version section below explains the differences. This notice covers the app, our API, website and support.
What stays on your iPhone
In the account-free app, your onboarding answers, listening plan, sessions, progress, streaks and playback position stay on your device. Qur’an practice can reveal religious beliefs; we do not upload this practice record to our API.
Your selected apps and websites stay on-device as Apple Screen Time tokens. Prayer times are calculated on-device using location with your permission; that calculator does not send your coordinates to a prayer-time provider.
The current 1.0.3 build does not enable Murattal’s private iCloud sync. Your device’s normal backup settings may still include local app data. Do not rely on the app to sync progress between iPhones.
What leaves your device
| Data | Why and where it goes |
|---|---|
| Content requests | Our API receives the chapter, reciter or translation needed to deliver content. Audio hosts receive your IP address and the requested audio file. New app requests contain no Murattal account or installation ID. |
| Usage statistics | In 1.0.3, our API counts setup steps, permission and purchase-attempt outcomes, coarse errors and daily app opens. Payloads include the calendar day, flow version, broad cohort or install week and days-since-install range. They exclude answers, listening history, persistent identifiers and exact event times. We store daily totals, not individual event records. |
| Crash reports | When enabled, Sentry receives technical crash stacks and app-build information. The app removes user objects, request details, messages and breadcrumbs. Screenshots and session recording are disabled. |
| Purchases | Apple handles payment. RevenueCat manages Pro access and subscription analytics using purchase records and a customer ID. Fresh installations receive an SDK-generated ID; upgrades can retain a previously cached customer ID, and older purchases may remain linked to earlier customer records. We do not receive payment-card details. |
| Website guides | If you ask for a guide on our website, our API stores your email address, the guides you asked for and when you agreed to receive our emails. Resend delivers the email with the link to the guide. We do not store your IP address or browser details with it. |
| Support | We receive the messages and attachments you choose to email us. Please avoid sending sensitive information we do not need. |
Network providers necessarily receive connection information, including IP addresses. Our analytics endpoint uses addresses temporarily in memory to limit abuse; it does not write them to the analytics database. Hosting and audio providers may retain their own security or delivery logs. Anonymous event payloads do not mean every provider receives no personal data.
Your controls
- Turn off Share anonymous usage statistics in the account-free app’s Settings to stop collection and clear unsent statistics. It is on by default where enabled; previous refusals are preserved.
- Use Download my data or Delete my data in Settings for your local practice record. Manage device backups separately through Apple’s settings.
- Change location and notification permissions in iOS Settings.
- Use the Unsubscribe link in any Murattal email to leave our mailing list, or email us to have your address deleted.
- Manage or cancel Pro in Apple Account → Subscriptions. Deleting app data does not cancel a subscription.
The statistics switch does not disable subscription processing or Sentry crash reporting. It cannot remove counts already combined into anonymous totals.
Older versions and the transition
The retired service used email or Apple sign-in and stored account settings. With separate explicit consent, it also stored Qur’an plans, listening history, progress and streaks. The live account and practice tables were removed during the 6 October cutover. Older sign-in, account and cloud-practice features may no longer work; update to version 1.0.3 or later.
Older installed versions may still send setup statistics to TelemetryDeck, using a random setup identifier. Their separate, optional listening analytics uses a hashed installation identifier and coarse usage events. Those streams exclude questionnaire answers and passage identifiers. Use the older app’s Share setup statistics and Share listening analytics controls to disable them. Disabling a stream clears its unsent queue, not data already received by the provider. Those older queues expire after seven days.
Historical purchases, provider records and protected backups are separate from the deleted live account tables. Contact us about remaining personal data. We do not describe older-client or historical provider records as anonymous simply because the new app has no accounts.
Providers and international processing
We use Railway for hosting, Apple for payments and device services, RevenueCat for subscriptions, Sentry for crash reporting, and Quran Foundation and audio hosts for content. The audio hosts include verses.quran.foundation and mirrors.quranicaudio.com. Resend delivers the emails you request on our website. TelemetryDeck may still receive events from older versions; Resend also delivered sign-in emails for the retired account service.
Our primary API and database are hosted in the EU. Murattal is operated from Bosnia and Herzegovina; providers may process data in other countries, including the US. Where required, transfers use appropriate safeguards such as Standard Contractual Clauses. We may also disclose information to advisers or authorities when legally required.
The website has no analytics scripts, advertising trackers or application cookies. Its only form is the guide request, which sends the email address you type to our API. The guide-request endpoint uses addresses temporarily in memory to limit abuse, as the analytics endpoint does. Railway may log website requests for security and operations. External links have their own privacy policies. See Railway’s privacy policy.
Why we process data and how long we keep it
For EU and UK users, we rely on contract where processing is necessary to deliver requested content or paid features; legitimate interests in service security, fixing crashes, improving the app and answering support requests where applicable; and legal obligations for required records and rights requests. We rely on your consent to email you a guide and occasional Murattal updates; you can withdraw it at any time by unsubscribing. The retired cloud-practice service relied on separate explicit consent for sensitive activity. Local-first storage does not remove our responsibilities for the data providers still process.
- Local practice: until you delete it; settled sessions discard detailed event/content data after 30 days while retaining progress summaries.
- Unsent statistics in 1.0.3: up to two days, with a maximum queue of 1,000 events.
- Anonymous daily totals: retained to compare trends; currently no automatic expiry.
- Guide mailing list: your email address, until you unsubscribe or ask us to delete it. After you unsubscribe we keep the address only so that we do not email you again.
- Legacy backups: retained under the existing maximum 90-day backup policy, restricted from ordinary use.
- Crash, security, purchase and support records: retention depends on the provider, service need and applicable legal requirements. Contact us for the period applicable to your request; deleting local app data does not erase these records.
We use encrypted connections, device data protection and restricted access. No service can guarantee absolute security.
Your rights and contact
Depending on where you live, you may ask to access, correct, export or delete personal data; withdraw consent; object to or restrict processing; or appeal a decision. You may complain to your local privacy regulator. We aim to respond within 30 days, subject to applicable legal deadlines. We may need limited information to verify a request. We cannot identify your contribution within anonymous totals.
Contact: hello@murattallock.com
Operator: Mirza Ohranovic, an individual operator, N Smailagica, Sarajevo, Bosnia and Herzegovina. Murattal is not a separate legal entity. No Data Protection Officer has been appointed.
Murattal is available only to people aged 16 or older.
We update this notice when our practices change and provide prominent notice of material changes where required.