Duha Legal

Privacy Policy

Last updated: October 6, 2026

1. Introduction

This Privacy Policy explains how Duha ("Duha", "we", "us", or "our") collects, uses, processes, and protects information when you use the Duha mobile applications for iOS and Android. Duha is developed and published by SubSet App. Duha is designed as a calm, privacy-respecting Islamic lifestyle and worship companion providing prayer times, Athan reminders, Quran reading, tafsir, Qibla direction, dhikr counters, Qada tracking, and Islamic calendar tools.

We believe in data minimization. We do not sell your personal information, nor do we track your activity across unrelated third-party apps or websites.

2. Account and Registration

Duha does not require or offer account creation or sign-in in the current version. You can use prayer times, Qibla, Quran reading, dhikr, local reminders, and premium subscriptions without providing your name, email, or telephone number.

Community contributions require Firebase Authentication under the current implementation. Because this version has no sign-in flow, users without an existing authenticated session cannot create posts or participate. Previously submitted community content and account records may remain in Firebase until a deletion request is processed.

3. Information We Process

A. Worship Progress and Local Storage

Duha is built with a local-first architecture. The following data is stored locally on your device. Community contributions made in earlier versions may be stored in Firebase Firestore:

• Quran reading progress, last-read ayah, and personal bookmarks.
• Dhikr counter tallies, custom tasbih lists, and worship streaks.
• Qada tracker balances (missed and completed prayers).
• Prayer checklist completion statuses and daily habit logs.
• Saved mosque notes, favorite mosque selections, and Friday prayer timings.
• App settings, such as selected calculation method, Asr juristic method, reminder lead times, and sound preferences.

On Android, this information is stored locally using Room Database and Jetpack DataStore. On iOS, it is stored in device storage using standard UserDefaults and shared App Group storage (to display prayer countdowns on Home Screen widgets and Lock Screen Live Activities).

Your device's optional operating-system backup or device-transfer service may include this local app data. These backups are controlled by your device settings and the system provider. Duha does not operate a cloud synchronization service for worship progress.

B. Location Data and Permissions

Duha offers accurate prayer calculations and Qibla direction:

• Prayer Times and Qibla: Location permission is optional. On iOS, prayer times and Qibla bearings are calculated on your device. On Android, the selected city and country are sent to Aladhan to fetch prayer times; GPS-based requests may send latitude and longitude to Aladhan when coordinate lookup is needed. Qibla bearings are calculated locally on both platforms. Coordinates are not added to our diagnostic custom fields or used for advertising.
• Manual City Fallback: Location permission is entirely optional. If you deny or revoke location access, you can select your city manually without granting location access. Remote prayer-time and Quran content requests need an internet connection when the requested data is not already cached.
• Nearby Mosques Directory: If you use the interactive Mosque feature, your current coordinate is sent to the public, open-source OpenStreetMap / Overpass API to query nearby mosque locations. Your coordinate is used transiently solely to fetch map search results; it is not saved to any profile.

C. Notifications and Exact Alarms

To deliver timely prayer alerts, Athan audio, and daily spiritual reminders, Duha requests notification permissions:

• Local Scheduled Notifications: Prayer times and daily reminders are scheduled locally on your device via system notification managers.
• Exact Alarms and Media Services (Android): On Android, exact alarm permissions (SCHEDULE_EXACT_ALARM) and foreground media playback services (FOREGROUND_SERVICE_MEDIA_PLAYBACK) are used so Athan recitations can play reliably at prayer times even when your screen is locked.
• Push Notifications (FCM): On Android, Google Firebase Cloud Messaging (FCM) is integrated to deliver occasional general announcements or seasonal reminders (such as Ramadan notifications). FCM uses an anonymous device push token.

4. In-App Purchases, Subscriptions, and RevenueCat

Access to Duha requires an active auto-renewable subscription (Weekly and Yearly subscriptions):

• Payment Processing: All financial transactions and payment processing are handled exclusively by Apple (via the App Store) for iOS users and Google (via Google Play) for Android users. Duha never collects, processes, or stores your credit card numbers, bank account numbers, or billing details.
• RevenueCat Subscription Infrastructure: We use RevenueCat to validate in-app purchases, verify store receipts, and unlock premium entitlements across app sessions. RevenueCat operates using an anonymous App User ID and receives store purchase tokens, transaction timestamps, and product identifiers from Apple or Google. RevenueCat does not receive your real name or personal financial payment credentials.

5. Analytics and Diagnostics

To ensure app reliability, monitor performance, and diagnose technical problems, we utilize limited third-party developer tools:

• Firebase Analytics (Android & iOS): Collects pseudonymous app interaction events (such as screens viewed, button clicks, and onboarding completion) and technical device metadata (device model, operating system version, app version) to help us understand feature adoption and improve user experience.
• Firebase Crashlytics (Android only): On Android devices, Crashlytics collects crash stack traces, device state, and diagnostic logs when an unexpected error occurs so that we can identify and fix bugs. Firebase Crashlytics is not enabled in the iOS release.
• No Ad Tracking: We do not use third-party advertising SDKs, nor do we access the Apple IDFA (Identifier for Advertisers) or Google Advertising ID for cross-app tracking.

6. Third-Party Service Providers

We work with trusted service providers who process information solely to facilitate app functionality:

• Apple Inc.: App Store distribution, in-app purchases, and StoreKit entitlement validation.
• Aladhan: Receives city/country and, when coordinate-based prayer lookup is used on Android, latitude/longitude to provide prayer times.
• Google LLC: Google Play distribution, Cloud Firestore for existing community content, Cloud Messaging, Crashlytics, and Analytics. Firebase Authentication may retain accounts created in earlier versions; this version offers no account sign-in.
• RevenueCat, Inc.: In-app purchase verification, subscription status, and entitlement management.
• OpenStreetMap / Overpass API: Public geospatial directory used on demand to return nearby mosque points of interest.
• Vercel Inc.: Hosting provider for Duha's official legal and support documentation.

7. Data Retention

Data stored locally on your device remains there until you clear it or uninstall the application. Community posts, feedback, and account records created in earlier versions may remain in Firebase Firestore or Firebase Authentication. Removing the app or using the current Settings screen does not automatically delete that cloud data. Contact us to request deletion of data associated with an earlier account or contribution.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your information, including encrypted HTTPS communication for all network queries, secure Firestore security rules, and local device sandboxing. However, no electronic transmission or storage method is 100% secure, and we cannot guarantee absolute security.

9. User Rights and Choices

You have full control over your data within Duha:

• Location Access: You can grant, deny, or revoke location permissions at any time in your device settings. You can switch to manual city selection without any loss of core prayer functionality.
• Notifications: You can customize or disable prayer notifications, Athan sounds, and daily reminders directly from within the app settings or via system settings.
• Subscription Management: You can manage, cancel, or modify your auto-renewable subscriptions at any time through your Apple App Store or Google Play account settings.
• Legacy Account and Community Data: The current version has no account deletion screen. To request removal of an account, community contribution, or feedback submitted in an earlier version, email subsetapp@gmail.com with enough information to identify the data. We will review and process the request; community content is not automatically removed when the app is uninstalled.

10. Children's Privacy

Duha is intended for a general audience and is designed to provide worship utility. We do not knowingly solicit or collect personal information from children under the age of 13 (or under the applicable age of consent in your country). If you believe a child has provided personal information to us, please contact us immediately so we can promptly delete it.

11. International Processing

Duha is available globally. Information processed by our service providers (such as Google and RevenueCat) may be transferred to, stored, and processed in data centers located in the United States and other jurisdictions around the world. By using Duha, you acknowledge this processing in accordance with this policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect enhancements to Duha, regulatory requirements, or changes in our operational practices. When updates are published, the "Last updated" date at the top of this page will be revised. We encourage you to review this page periodically.

13. Contact Information

If you have any questions, feedback, or requests regarding this Privacy Policy or our data practices, please contact us:

• Developer / Publisher: SubSet App
• Contact Email: subsetapp@gmail.com
• Official Website: https://mydeen-legal.vercel.app