Zolaal sends you one verse of the Qur'an each day. To do that we need very little about you, and this policy sets out exactly what we hold, why we hold it, who else sees it, and how to make us delete it. You can use the app without giving us an email address at all.
Who we are
Zolaal ("Zolaal", "we", "us") is a mobile application and website that delivers a single Qur'anic verse each day with translation and transliteration.
The data controller responsible for your personal information is:
بوصلة الحلول الذكية ذ.م.م
Contact: Contact@Zolaal.com
If you have any question about this policy, or you want to exercise any of the rights described in Section 10, write to us at the email above and we will respond within 30 days.
The short version
- You can use Zolaal without an account. Choose "Skip for now" at the welcome screen and we never learn your email address.
- We ask for an email address only to sign you in. There is no password: we email you a six-digit code.
- We never ask for your phone number, your location, your contacts, your photos, or your camera or microphone.
- We do not sell or rent your personal data, to anyone, ever.
- We do not show you advertising and we do not share your data with advertising networks or data brokers.
- We never see your card details. Subscriptions are charged by Google Play, which tells us only whether your subscription is active.
- You can have everything deleted by emailing us. See Section 11.
Information we collect
3.1 Information you give us
| Data | Why we have it | Required? |
|---|---|---|
| Email address | To send your sign-in code and to identify your account across devices | Only if you choose to create an account |
| Display name | To address you by name in the app | No, always optional |
| Feedback message | To answer you and to fix what you tell us is broken. You may include an email address so we can reply | Only if you send feedback |
| Invite code | To credit the person who invited you, if you entered their code | No |
3.2 Information collected automatically
| Data | Why we have it |
|---|---|
| Push notification token | A device identifier issued by Firebase Cloud Messaging. Without it we cannot deliver your daily reminder. We store it with the platform (Android or iOS), your chosen language, and the date it was last seen |
| Usage events | Which screens you open and which features you use, for example that a verse was viewed, an invite was tapped, or a purchase was completed. These are recorded through Google Analytics for Firebase |
| Device and app information | Collected by Google Analytics for Firebase as standard: an app instance identifier, device model, operating system version, app version, and an approximate region derived from your IP address. On Android this may include a resettable advertising identifier |
| IP address | Recorded in server logs whenever your device contacts us, for security and abuse prevention |
| Subscription status | Whether your trial or subscription is active, and when it renews |
We do not use the advertising identifier for advertising, we do not build advertising profiles, and we do not share it with any advertising network or data broker.
3.3 Information that stays on your device
The following is stored locally on your phone and is never transmitted to us: the date you first opened the app (used to run your 14-day trial), your theme setting, your chosen app and translation languages, your notification preferences, your device's time zone (used to schedule the reminder at the right local hour), and any feedback still waiting to be sent because you were offline.
3.4 What we never collect
We do not collect your phone number, your date of birth, your postal address, any government identification, your precise or approximate GPS location, your contacts, your photos, your files, or any access to your camera or microphone. We do not track you across other apps or websites. We do not collect any special category data such as health information.
How we use your information
- To run the app: showing you the day's verse in the language you chose.
- To sign you in: emailing a one-time code and keeping you signed in afterwards.
- To send your daily reminder: if, and only if, you allowed notifications.
- To manage your trial and subscription: tracking whether your access is active, and honouring referral rewards.
- To answer you: replying to feedback and support requests.
- To improve the app: looking at aggregate usage to see which features earn their place and where people get stuck.
- To keep the service safe: detecting abuse of the sign-in system, and complying with the law where we are required to.
We do not use your data for advertising, for automated decision-making, or for profiling that produces legal effects.
Legal basis for processing
Where the UK GDPR, the EU GDPR, or a comparable law applies to you, we rely on the following legal bases.
| What we do | Legal basis |
|---|---|
| Delivering the app and your daily verse | Performance of a contract |
| Emailing your sign-in code | Performance of a contract |
| Sending push notifications | Your consent, given through your device's notification permission and withdrawable at any time |
| Managing subscriptions and referral rewards | Performance of a contract |
| Usage analytics | Our legitimate interest in understanding and improving the app, balanced against your privacy; where local law requires consent for analytics, your consent |
| Security, fraud and abuse prevention | Our legitimate interest in protecting users and the service |
| Keeping financial records | Compliance with a legal obligation |
Where we rely on legitimate interests you may object at any time. See Section 10.
Who we share data with
We do not sell your personal data, and we have never sold or shared it for cross-context behavioural advertising. We share it only with the service providers below, each of which processes it on our instructions under a data processing agreement.
| Provider | What it does for us | What it receives |
|---|---|---|
| Supabase, Inc. | Account database and sign-in | Email address, display name, referral records, feedback, push tokens |
| Google (Firebase Cloud Messaging) | Delivers push notifications | Push token, message content |
| Google (Analytics for Firebase) | Usage analytics | Usage events, app instance ID, device and app information |
| Google Play Billing | Takes payment for subscriptions | Handled entirely by Google under its own privacy policy; we receive only your subscription status |
| RevenueCat, Inc. | Validates purchases and tracks entitlement | An anonymous app user identifier, purchase receipts, device platform |
| Resend, Inc. | Delivers our transactional email | Your email address and the content of the message |
| Cloudflare, Inc. | Hosts and protects zolaal.com | IP address and request metadata for visitors to the website |
We may also disclose information where we are legally required to: in response to a court order, a lawful request from a public authority, or where disclosure is necessary to protect our rights or someone's safety.
If Zolaal is ever transferred to another owner, your data may transfer with it. We would tell you before that happened and you would keep every right in Section 10.
International data transfers
Our service providers are established in, or operate infrastructure in, countries outside the United Kingdom and the European Economic Area, principally the United States. Where personal data is transferred out of the UK or EEA, that transfer is covered by the European Commission's Standard Contractual Clauses together with the UK Addendum, or by another transfer mechanism recognised under applicable law, and by any additional safeguards the receiving provider has put in place.
How long we keep data
| Data | Retention |
|---|---|
| Account details (email, display name) | For as long as your account exists, then deleted within 30 days of a deletion request |
| Push notification tokens | Until you turn notifications off, uninstall the app, or delete your account, whichever comes first |
| Feedback messages | Up to 24 months, so we can follow up on what you reported |
| Usage analytics | Event-level data is retained for up to 14 months. Aggregate figures that identify no individual may be kept indefinitely |
| Referral records | For as long as your account exists |
| Records of payments | Up to 7 years, where tax and accounting law requires us to keep them |
| Server and security logs | Up to 90 days |
How we protect your data
- Everything travelling between your device and our servers is encrypted in transit using TLS.
- Data held in our database is encrypted at rest by our hosting provider.
- There are no passwords to steal: signing in uses a short-lived code sent to your email.
- Database access is governed by row-level security rules, so one account cannot read another's data.
- Access to production systems is limited to those who need it and protected by multi-factor authentication.
No system is perfectly secure. If a breach ever affects your personal data and is likely to put your rights at risk, we will notify you and the relevant supervisory authority as the law requires.
Your rights
Wherever you live, you can ask us to show you the data we hold about you, correct it, or delete it. Email Contact@Zolaal.com and we will respond within 30 days, free of charge.
If you are in the UK, the EEA, or Switzerland
Under the UK GDPR and the EU GDPR you have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your data protection supervisory authority; in the United Kingdom that is the Information Commissioner's Office at ico.org.uk.
If you are in California
Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and why, the right to delete it, the right to correct it, and the right to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of. We will never discriminate against you for exercising any of these rights.
Everywhere else
If your local law grants you rights beyond these, we will honour them. Ask us and we will tell you how.
Deleting your account and your data
You can have your account and everything attached to it erased at any time.
To request deletion, email Contact@Zolaal.com from the address you signed in with, with "Delete my account" as the subject. We do not ask you for a reason.
Within 30 days we permanently delete your email address, your display name, your push notification tokens, your referral record, and any feedback you sent us. Your analytics events are already stored without your name or email attached; those age out on the schedule in Section 8. We keep records of any payment you made only for as long as tax law obliges us to, and nothing else.
Deleting your account does not cancel a Google Play subscription. Cancel that separately in the Play Store under Payments and subscriptions, otherwise it will keep renewing.
If you would rather just stop the daily message, turn notifications off in Settings. That needs no account deletion and takes effect immediately.
Children
Zolaal is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal data from a child under 13, and we have not designed the app to appeal to them specifically. If you believe a child has given us personal data, write to Contact@Zolaal.com and we will delete it promptly.
Changes to this policy
We update this policy when what we do with your data changes. The effective date at the top always tells you which version you are reading, and we keep the previous wording on request. If a change materially affects your rights we will tell you in the app or by email before it takes effect, rather than expecting you to notice.
Contact us
Questions, requests, or complaints about privacy all go to the same place:
Email: Contact@Zolaal.com
Response time: within 30 days