Privacy Policy
Hidaya: The Islamic Path (Android and iPhone app, com.roninzak.hidaya)
Last updated: 17 September 2026. Effective: 17 September 2026.
The short version. Hidaya calculates your prayer times, the Qibla direction, and your reminder alarms entirely on your phone. None of that is sent anywhere.
Signing in with Google, or with Apple on iPhone, is required to use the app, so you do have an account with us. Your account holds your sign-in details, your onboarding answers, and a dated record of the worship you log, so that your streak and saved items follow you to a new phone. You can delete all of it from inside the app at any time.
There are no ads, no advertising identifiers, no analytics, and no crash reporting in this app. We do not sell your data and we do not share it with anyone for their own purposes.
1. Who we are
Hidaya: The Islamic Path is published by Zakaria Marsli, an individual developer based in Ireland. For the purposes of the EU General Data Protection Regulation (GDPR), Zakaria Marsli is the data controller for the personal data described in this policy.
For any privacy question, request, or complaint, contact hidayamobileapp@gmail.com. This is the same address used for the "Reach out" option inside the app, and it is monitored.
2. What stays on your device
Hidaya was built to work offline. The following happen entirely on your phone, and the results are not transmitted to us or to anyone else:
- Prayer times. Calculated on the device from your coordinates using a standard astronomical library. Your coordinates are not sent to us to work this out.
- The Qibla compass. Calculated on the device from your coordinates and your phone's compass sensor.
- Prayer reminders and the adhan. Scheduled as local alarms by your phone's operating system. Hidaya does not use push notifications, and no notification token is generated, stored, or sent anywhere.
- The Quran text and translation. Bundled inside the app.
- Du'a images you save or share. Written to your own photo gallery. Nothing is uploaded.
- Excused days. If you mark a day as excused, that mark is stored only on your device. It is never sent to our servers and does not sync between devices.
3. Your account
Hidaya requires you to sign in before using the app: with Google on Android, and with Google or with Apple on iPhone. There is no guest mode. We mention this plainly because it means every user of Hidaya has an account, and therefore has data stored on our servers.
Signing in is handled by Google Sign-In or Sign in with Apple, and by Supabase Auth, our authentication provider. When you sign in with Google, Google provides us with, and our authentication provider stores:
- your email address and whether Google has verified it,
- your Google account name,
- the URL of your Google profile picture,
- a stable identifier for your Google account.
When you sign in with Apple, Apple provides us with, and our authentication provider stores:
- your email address, or, if you choose "Hide My Email", a private relay address that Apple forwards to you,
- your name, which Apple sends only the first time you authorise Hidaya,
- a stable identifier for your Apple ID.
With Sign in with Apple we also keep one server-side token from Apple, used for a single purpose: when you delete your account, we use it to tell Apple to revoke Hidaya's access to your Apple ID (section 13). Nothing else reads it.
We use these to identify your account and to show you which account you are signed in as. We do not use your email address for marketing, and Hidaya sends no marketing email of any kind. We never receive or store your Google or Apple password.
4. What we store on our servers
Our backend runs on Supabase. Each of the following is tied to your account and protected by row-level security, meaning our database will only ever return your rows to you.
| What | Details | Why |
|---|---|---|
| Sign-in details | The items listed in section 3. | To identify your account. |
| Profile | The first name you type during onboarding, and your answers about your goal, your current prayer rhythm, and your experience with the Quran. If you choose to answer the optional question about whether you are a woman or a man, that answer is stored too. Any of these can be skipped. | To adapt what the app shows you. |
| City and country | The name of your city and your two-letter country code. Not your coordinates. See section 5. | To show you which location your prayer times are set to. |
| Your activity log | A dated, timestamped record of what you log in the app: which prayers you marked, which daily ayah, hadith, dhikr or surah you read, tasbih rounds you completed, items you shared, and days you marked as fasting. Each entry records the date, the time it was logged, and whether it counted toward your streak. | To calculate your streak and consistency, to award milestone gifts, and to restore your progress if you change phone. |
| Saved items and settings | Your bookmarked ayahs and hadith, your progress through the adhkar, your saved surahs, your tasbih settings and lifetime dhikr counts, and your chosen theme. | To restore them on another device. |
| Entitlement | Whether you have the lifetime unlock, which product you bought, and when your free trial started. | To know whether to unlock the paid features. |
About the activity log. This is a record of religious practice, which is a sensitive category of personal data. We want to be direct about that rather than bury it. It is stored so that your streak survives a lost or replaced phone. It is never sent to any analytics service, any advertising network, or any other third party, because the app contains none. If you would rather it did not exist, you can delete your account at any time from inside the app, and it is removed. See section 13.
5. Location
Hidaya asks for your location while you are using the app so it can work out your prayer times and the Qibla direction. You can decline and pick a city from a list instead. There is no background location access.
Here is exactly what happens to it:
- Prayer times and Qibla are computed on your device. Your coordinates are not sent to us for this.
- Your city name is looked up by your phone's operating system. To turn coordinates into a city name, the app uses the operating system's geocoding service. On Android this means Google receives the coordinates, and on iPhone Apple does, as part of providing that operating system service. This is a function of the device, not of our servers.
- Only the city name and country code reach our servers. Your coordinates are never stored in our database.
- Weather uses a rounded, approximate point. To show the local weather on the home screen, the app requests it from Open-Meteo, a weather service. Before the request is made, your coordinates are rounded to roughly one kilometre. Only that rounded point is sent, along with nothing that identifies you or your account. Open-Meteo receives no name, email, account identifier, or device identifier from us.
Your coordinates are also kept in your device's own storage so the app works offline.
6. Purchases and the free trial
Hidaya is free to download and includes a 7 day free trial. It offers one optional purchase: a one-time lifetime unlock. There is no subscription.
Purchases are processed by Google Play on Android and by the App Store on iPhone, and managed through RevenueCat, a purchase infrastructure provider. When you buy or restore a purchase, RevenueCat receives your account identifier from us (the internal identifier for your Hidaya account, not your name or email) along with the purchase and receipt information from the store. RevenueCat then tells our server whether to unlock the paid features.
The free trial is tracked by our server from the day your account is created. No payment details are asked for, and nothing is charged when it ends.
Your payment card details are handled by Google Play or by Apple and never reach Hidaya or our servers.
7. Voluntary donations
The app has an optional "Support Us" screen where you can give a voluntary donation. A donation unlocks nothing and gives no benefit inside the app.
If you choose to donate, the app sends only the amount and currency you selected to our server, which creates a checkout session with Stripe. You then complete the payment on Stripe's own hosted page in your browser.
- We send Stripe no name, no email address, and no identifier linking the donation to your Hidaya account. On Stripe's side, the donation is not connected to your account with us.
- Your card details are entered on Stripe's page and never touch Hidaya or our servers.
- Stripe independently receives your payment details, your IP address, and browser information in order to process the payment and prevent fraud, acting as its own controller for that purpose. See Stripe's privacy policy at stripe.com/privacy.
8. Other connections the app makes
For completeness, these are the remaining occasions the app contacts a server. As with any internet connection, the service on the other end can see your IP address.
- Quran recitation audio. The verse-by-verse recitation is streamed from our own storage. The request reveals which verse and which reciter you are listening to, and it is not tied to your account, because the request carries no sign-in credentials.
- Additional hadith collections. If you open a collection that is not bundled with the app, it is downloaded from jsDelivr, a public open-source content delivery network. The request carries no account information.
- App updates. On launch, the app checks for an update through Expo Application Services. This check sends the app version and platform, and carries no account information.
- Opening a photograph's source page. The mosque photographs behind the prayer card are stored inside the app, so displaying one contacts nobody. If you tap “View photograph source” to see who took it, that opens Wikimedia Commons in your phone's browser. Wikimedia then sees the visit as it would any other, including your IP address, and on Android the browser may carry cookies you already had for that site. Nothing about your Hidaya account is sent, and nothing happens unless you tap the link.
9. What we do not collect
Stated plainly, because these are the things apps most often collect quietly. Hidaya contains no code that does any of the following:
- No advertising. No ad network, no advertising identifier, and no ads anywhere in the app.
- No analytics or usage tracking. There is no analytics SDK in the app at all.
- No crash reporting or diagnostics SDK.
- No device identifiers or fingerprinting.
- No push notification tokens. Reminders are scheduled locally by your phone.
- No access to your contacts, calendar, microphone, camera, call logs, or SMS.
- No reading of your photos. The app only writes a du'a image to your gallery when you ask it to.
- No precise coordinates stored on our servers, and no location history.
- No selling of personal data, and no sharing of it for advertising or marketing.
10. Who your data is shared with
We do not sell your personal data, and we do not give it to any company to use for its own purposes. The following companies process data on our behalf, or as part of completing something you asked for. Please also read the note below the table about how Google Play uses the word "shared", which is narrower than it sounds.
| Company | Role | What it receives |
|---|---|---|
| Supabase | Our database, authentication, and file storage provider (a processor acting on our instructions). | Everything described in sections 3 and 4. |
| Sign-in provider, app store, and the Android operating system. | Sign-in details when you authenticate. Purchase details when you buy. Coordinates when the operating system resolves your city name. | |
| Apple | Sign-in provider (Sign in with Apple), app store, and the iOS operating system, on iPhone. | Sign-in details when you authenticate with Apple, and the token exchange and revocation described in sections 3 and 13. Purchase details when you buy on iPhone. Coordinates when the operating system resolves your city name. |
| RevenueCat | Purchase and entitlement infrastructure. | Your Hidaya account identifier and your purchase or receipt information. No name or email from us. |
| Stripe | Payment processing for voluntary donations only. | The donation amount and currency from us. Your payment details directly from you on Stripe's page. |
| Open-Meteo | Weather data. | A rounded, approximate location point. Nothing identifying. |
| jsDelivr | Public content delivery network for optional hadith collections. | The request for a file. Nothing identifying. |
| Expo Application Services | App update delivery. | App version and platform. Nothing identifying. |
We may also disclose data if we are legally required to do so, for example in response to a valid legal order.
A note on the word "shared". Google Play's Data safety section uses "shared" in a specific technical sense: any transfer of data to a company that is not us. Under that definition, two things are classified as shared, and Hidaya's Data safety label on Google Play says so: your account identifier, because it is sent to RevenueCat to identify your purchase, and your purchase history, because RevenueCat and Google Play process it. Both are described in section 6.
We mention this so the label and this page do not appear to contradict each other. It remains true that we do not sell your data, do not share it for advertising or marketing, and do not give any company your personal data to use for its own purposes.
Where your data is stored
Our database and file storage are hosted by Supabase in the European Union (northern Europe), so the data described in section 4 stays within the EU. RevenueCat and Stripe may process data outside the EU. Where they do, those transfers rely on the safeguards those companies put in place, such as the European Commission's Standard Contractual Clauses.
11. How your data is protected
- All connections between the app and any server use HTTPS with modern encryption. Nothing is sent in the clear.
- Data stored in our database is encrypted at rest by our hosting provider.
- Access to your rows is enforced at the database level with row-level security, so one account cannot read another's data even if the app were modified.
- Your premium status can only be granted by our server after Google Play confirms a purchase. The app itself cannot grant it.
- The account deletion endpoint identifies you from your verified sign-in token, so a request can only ever delete the account that made it.
No system is perfectly secure, and we do not claim otherwise. If you believe your account has been compromised, contact us at the address in section 17.
12. How long we keep it
- Data on your device is kept until you delete it in the app, clear the app's storage, or uninstall the app.
- Data on our servers is kept for as long as your account exists. When you delete your account, it is deleted immediately and permanently, not archived. See section 13.
- Purchase records held by RevenueCat and by Google Play are kept after account deletion, because they are needed to validate an entitlement, to honour refunds, and to meet tax and accounting obligations.
- Donation records are kept by Stripe under Stripe's own retention policy, and by us as required for accounting and fraud prevention. We hold no card data.
13. Deleting your account and data
You can delete your account and its data from inside the app at any time:
Profile tab → Settings → Account and privacy → Delete account
This immediately and permanently deletes your sign-in record and, with it, your profile, your activity log, your saved items and settings, and your entitlement row. It is not recoverable. The app then clears your data from the device and signs you out.
If you signed in with Apple, deleting your account also revokes Hidaya's access to your Apple ID, so Hidaya disappears from the "Sign in with Apple" list in your Apple ID settings.
A record of any purchase remains with Google Play or the App Store and with RevenueCat, and any donation remains with Stripe, for the reasons given in section 12.
If you can no longer sign in, or you would rather ask us to do it, use the request page: Request account and data deletion.
14. Your rights
Under the GDPR, and under similar laws elsewhere, you have the right to access a copy of your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, and to receive your data in a portable format. You may exercise any of these by emailing hidayamobileapp@gmail.com. We will respond within one month.
We process your data on the following bases: to perform the agreement to provide you the app you asked for (your account, sync, and purchases); with your consent, which you give by choosing to grant location access or to log your worship activity, and which you may withdraw at any time by turning off the permission or by deleting your account; and to meet legal obligations such as tax record keeping.
If you believe we have handled your data improperly, you may complain to your local data protection authority. In Ireland this is the Data Protection Commission, dataprotection.ie.
15. Children
Hidaya is not directed at children. It is intended for adults aged 18 and over, its Google Play target age group is 18 and over, it is not listed in Google Play's Designed for Families programme, and it is not in the App Store's Kids category. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
16. Changes to this policy
If our data practices change, this page is updated and the "last updated" date at the top changes with it. For a change that materially affects you, we will also give notice inside the app before it takes effect. The current version is always available at this URL.
17. Contact
Zakaria Marsli
Ireland
hidayamobileapp@gmail.com