Privacy Policy

Who is responsible

BAD CREATIVE TECH BİLİŞİM VE YAZILIM SİSTEMLERİ LİMİTED ŞİRKETİ, Küçükbakkalköy Mah. Selvili Sk. No:4 D:48, Ataşehir / İstanbul, Türkiye, [commercial register and number], represented by [managing director].

For data-protection questions: [data protection contact]. For anything else: [email protected].

In short

There are no analytics services, no advertising and no profiling. Nothing is sold, and nothing is shared for advertising.

• Voice from the pronunciation exercise is processed on the device only, and never uploaded.
• For prayer times, location is rounded to about a kilometre, sent in the request body, not stored and not logged.
• Reminders are scheduled on the device alone; the schedule never reaches a server.
• All data is held in the European Union.

What is processed

The app can be used as a guest, with no account. A guest is pseudonymous: no email address, no name, no date of birth.

• Account: email address, password (as a hash only), date of birth, optionally first and last name, interface language.
• Learning: progress per letter, practice attempts, review schedule, XP, streak, daily statistics, badges.
• League: one week of leaderboard membership carrying either a display name ("Ayşe K.") or an anonymous code ("7F3A") — never both, and never city, school or email address.
• School: school and class membership and submitted work, where the account was issued by a school.
• Technical: session tokens and the time of the last sign-in, so that sessions can be ended.

What never leaves the device

The pronunciation exercise processes the voice on the device only. No recording is transmitted and none is stored.

Location is taken coarsely — the app deliberately asks only for approximate location — and only while the app is open. The rounded coordinate is sent in the request body so that it does not land in server logs; the server does not store it, and the device remembers only the place name and the times.

Legal bases

• Contract (Art. 6(1)(b) GDPR): account, learning progress, school features.
• Consent (Art. 6(1)(a) GDPR): location for prayer times, notifications, and for children under 16 the consent of a parent.
• Legitimate interests (Art. 6(1)(f) GDPR): protecting accounts from abuse, for example by limiting sign-in attempts.

Children under 16

For a child under 16 the app asks for a parent's email address and sends a confirmation request there. Until it is confirmed, no learning data is stored.

Consent can be withdrawn at any time — a message to [email protected] is enough. The "adult or child" step at first launch shapes the presentation and does not replace that consent.

Who else is involved

• Google Cloud (European Union region) — running the servers and storing the lesson audio.
• Google Fonts — this website still loads three typefaces directly from Google, which sends a visitor's IP address there. The app itself carries its fonts; moving the website is planned.
• Google Maps — only in the mosque search, which is not shown to children.
• An external prayer-time service — the official timetable is fetched ahead of time on the server, not on each request. No user data is sent with it.

How long data is kept

An account is deleted as soon as it is asked for. Progress, daily statistics, badges, league history, submissions, memberships and outstanding tokens are genuinely deleted; the account record itself is irreversibly anonymised so that no link remains. Every session ends at the same moment.

Session tokens expire by themselves. Revoked ones are cleared each night.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21).

Access and erasure can both be done inside the app: Profile → Settings → Privacy and data. The export is a complete JSON file. You may also complain to a data-protection supervisory authority at any time (Art. 77).

Storage in the browser and on the device

No advertising or tracking cookies are set. The app and the console store locally only what using them requires — the chosen language, settings, and learning progress for offline use. Signing in to the web console uses one strictly necessary cookie.

Changes

If this policy changes, the date above changes with it. Significant changes are announced in the app as well.