🌙 Noor — Privacy Policy

• Prayer times and Qibla are computed entirely on your device, and your precise location is never sent to Noor's servers. Two features do send location onward, and only while you use them: Nearby Mosques sends a deliberately coarsened version of your position — rounded to about 1 km — to public OpenStreetMap (Overpass) endpoints to fetch mosques around you, and the city name shown in the app comes from your operating system's own geocoder. Nothing about your location is stored on our servers, and results are cached only on your device.
• Your prayer tracking, bookmarks, favourites, reading progress, scan history, and settings are stored locally on your device. Scan history never leaves your device at all. The rest leaves it only if you sign in: when you have an account, Noor automatically backs your prayer log (and favourites, bookmarks, and settings) up to that account so they survive a reinstall or a new phone — see Accounts & backup below. As a guest with no account, none of it ever leaves your device.
• Noor works fully in guest mode with no account. In guest mode we collect no names, emails, or contacts. Guest mode still shows ads in the free tier — see Advertising for exactly what the ad network receives.

This list matches Noor's App Store privacy label:

• Name and email address — only if you create an account (Sign in with Apple can hide your email behind Apple's private relay).
• User ID — the account identifier, and an app-generated random identifier used to rate-limit the free AI features.
• Worship content and other user content — prayer log, favourites, bookmarks, settings; backed up to your account automatically once you sign in, and never for a guest with no account. Because prayer logs reflect religious practice, we treat them as sensitive data (see Accounts & backup).
• AI questions and scan photos — the question you type into Ask Noor, and the ingredient-label photo you take in the halal scanner, are sent to be answered (see AI features).
• Purchases and product interaction — whether you own Noor Plus or the ad-free purchase, and basic in-app interaction needed to run those features. Product interaction also covers the anonymous daily counts of how often each screen and feature is opened, described under Anti-abuse & aggregate counts; those counts are not linked to you and are never used for tracking.
• Device identifier, coarse location, and advertising data — handled by the ad network in the free tier only (see Advertising). The coarse location there is derived by Google from your IP address; precise location is never collected by Noor's servers.
• Crash and performance diagnostics — see Diagnostics.

Having an account is optional — Noor works fully in guest mode with nothing leaving your device. An account exists so your data survives changing or reinstalling your phone:

• Guest, no account: everything — including your prayer log — stays 100% on your device. It is never uploaded, and it is lost if you delete the app, because there is no account to hold a backup.
• Signed in (with Apple, or an email + password): Noor automatically backs up your prayer log, favourites, bookmarks, and settings to your account and keeps them in step across your devices. There is no separate switch to turn on — signing in is what turns backup on, so you don't silently lose a year of prayers when you move phones. We tell you this in a clear one-time notice when you first sign in.

On a new or reinstalled device, signing in restores your backed-up data automatically, and it merges — anything you have already recorded on the new device is kept, never overwritten.

What we collect for an account: a user id; your email address if you sign up with email (Sign in with Apple lets you hide it behind Apple's private relay); and the backed-up data listed above. We do not collect or upload your location, and your account data is never linked to advertising or used to target ads. We use no third-party analytics or attribution SDKs — no analytics company receives anything from Noor. To know which parts of the app are worth improving, Noor counts in aggregate how many times each screen and each feature is opened: a plain daily number, with no user id, no account link and no device id, exactly like the scan counter described below. It does not record what you read, what you pray, or what you tap — no surah, no dhikr, no station, no note, and nothing that could be traced back to you. See Anti-abuse & aggregate counts below, and Diagnostics for crash reporting. The free tier does show ads, which are described in full under Advertising.

How it's protected: account data is stored with our database provider (Supabase), isolated per account by row-level security so only you can read it, and encrypted in transit and at rest.

Your control & retention: signing out stops this device from backing up any further; your existing backup stays until you remove it. You can permanently delete your account and all its server data from inside the app (Account → Delete account & data). We keep backed-up data only until you delete it.

Prayer logs reflect religious practice; we treat them as sensitive data. For a signed-in account we back them up automatically, solely to provide backup and restore, on the basis of the consent you give by signing in after the notice described above. Delete your account at any time to erase them from our servers.

The free tier of Noor is funded by ads, served by Google AdMob. They appear as a banner on some screens, and as an optional rewarded video you may choose to watch to unlock extra halal scans — a rewarded ad is never shown unless you tap to watch one.

• Non-personalized by default. Every ad request Noor makes is marked non-personalized unless you have explicitly allowed tracking. Non-personalized ads are chosen from general context, not from a profile of you.
• Personalized ads only with your consent. On iOS you will see Apple's App Tracking Transparency prompt, and, where required by law, Google's consent (UMP) form. Only if you grant permission do ads become personalized and use your device's advertising identifier (IDFA). Declining changes nothing else in the app, and you can change your mind at any time in iOS Settings → Privacy & Security → Tracking.
• What the ad network receives: your device's advertising identifier (only with your consent), your IP address — from which Google derives an approximate, coarse location — and ad interaction data such as ad impressions, taps, and rewarded-video completions. Noor passes no location coordinates and no keywords drawn from your worship data into an ad request.
• Your worship data is never used for ad targeting. Your prayer log, bookmarks, Quran reading, AI questions, and scan history are never shared with an ad network and never used to select an ad. Ads are limited to general-audience content (Google's "G" rating), and Noor is not directed to children.
• We do not sell your personal data and we operate no ad exchange, data broker relationship, or cross-app profile of our own.
• You can remove ads. Noor Plus, or the one-time ad-free purchase, removes the banner ads — when you own either, the banner is not even requested, so nothing is sent to the ad network for it.

Google's own handling of ad data is governed by its policies — see Google Privacy & Terms and How Google uses information from apps that use its services.

Subscriptions and the one-time ad-free purchase are processed by Apple through the App Store, and our subscription state is managed with RevenueCat. We never see or store your card details, and we are told only whether an entitlement (Noor Plus / ad-free) is active. Purchases are attached to an anonymous purchase id, not to your worship data.

If you use the Photo mode of the halal scanner, the photo you take of an ingredient label is sent to our server and then to our AI provider (OpenRouter, which routes to Google Gemini) to read the ingredients and return a screening result. The image is processed to generate the result and is not stored by us; the resulting product verdict may be cached against the product's barcode so the next person does not need to scan it again. Do not photograph anything private.

If you use Ask Noor (the AI question feature), the question you type is sent to our server together with the source passages Noor retrieved on your device, and on to the same AI provider so the answer can be written and checked against those sources. We send an app-generated random identifier with the request to enforce the free monthly limit. Your question text and the answer are not written to our logs — we keep only counters (how many requests, tokens, and refusals) with no user content and no identifier attached.

The Barcode and Text modes of the scanner do not send your photos to us.

To keep the free halal scanner and Ask Noor running for everyone, our server keeps a few minimal, non-identifying records — none of which is analytics, advertising, or profiling:

• Aggregate scan count. We increment a single daily number of how many halal scans happen in total (for example, "scans today"). It is a plain counter with no user id, no account link, no device id, and no record of what you scanned — just a number.
• Aggregate screen and feature counts. So we know which parts of Noor are used and which are dead weight, the app keeps a small tally on your device — "the Quran hub was opened 3 times, the radio was played once" — and sends the totals to our own server about once a day. What is stored is literally a table of (name, date, number). The names come from a fixed list built into the app and re-checked on the server, so they can only ever be a screen or a feature: never a surah, an āyah, a dhikr, a radio station, a product, a question, or anything you typed. There is no user id, no account link, no device id, no session, and no time of day — only the date — and we do not keep the IP address of the request. Because there is no identifier of any kind, these numbers cannot be traced back to you, joined to your account, or used to build a profile, and they are never used for advertising. They stay on our own infrastructure; no analytics company receives them.
• Free-tier limits on the AI features. Ask Noor and the AI scan have a free monthly allowance. To count it we use the app-generated random identifier described above, which is tied to your app install — not to your name, account, or device hardware.
• Guest rate limit. If you use these features without signing in, we apply a per-day limit per network address to stop automated abuse of the free AI service. This uses a short-lived daily counter keyed to your IP address, used only to enforce that limit — not to identify you, track you across apps, or build a profile. Signed-in users are identified by their account token instead, and this IP counter does not apply to them.

So that crashes can be fixed, Noor can report crash and performance diagnostics to Sentry. These reports contain the technical details of the failure — the error, a stack trace, the app version, and the device model and OS version. They are configured to carry no personally identifying request data, no screenshots, and no view hierarchy, and they never contain your Quran reading, prayer log, questions, or scans.

Separately from the AdMob ads described above, Noor may occasionally show a promotional card inside the app (for example, highlighting a Noor feature or a seasonal reminder). These cards are authored by Noor's owner and delivered from our own server. They involve no ad network, no auction, no tracking, and no profiling. Showing a card requires no personal data from you and does not report back who saw it.

Noor streams and fetches Islamic content directly from third-party providers, so your device's IP address is visible to them when you use those features:

• Quran translations & tafsir — the Quran API (jsDelivr), Quran.com; recitation audio — everyayah.com. The Arabic Quran text itself is bundled inside the app and read offline (no network request).
• Reciters & radio — mp3quran.net, archive.org, Radio Browser, and the broadcasters' streams
• Hadith — the fawazahmed0 Hadith API (jsDelivr)
• Nearby mosques — OpenStreetMap / Overpass (public mirrors). This is the one feature that sends your position off the device, and it is rounded to roughly 1 km first: it is used only to run the "mosques around this point" query, and carries no account or device identifier.
• Barcode lookups — Open Food Facts
• Ads in the free tier — Google AdMob (see Advertising)

We do not control these providers' own data practices.

Data controller: Noor is operated by the Noor team. For any privacy request or question, contact noorislamicapplication@gmail.com.

Legal bases we rely on: your consent for the optional account and for backing your data up to it — consent you give by signing in after the clear one-time notice that signing in backs up your prayer log, and which you can withdraw by signing out or deleting your account; our legitimate interest in preventing abuse of the free AI services (the guest rate limit and aggregate count above) and in reporting crashes so the app can be fixed; performing the service you request when you run a photo scan or ask a question; and, for advertising, your consent for personalized ads and any tracking identifier (granted or refused through the App Tracking Transparency and Google consent prompts, and withdrawable at any time in iOS Settings), with non-personalized ads shown on the basis of our legitimate interest in funding the free tier. You can also remove ads entirely with Noor Plus or the ad-free purchase.

Sensitive data: your prayer logs reflect religious practice. We treat them as sensitive and process them only for a signed-in account, solely to back up and restore them, on the basis of the consent you give by signing in after a clear one-time notice that this backup happens. As a guest they never leave your device. You can withdraw at any time by signing out (which stops further backup) or deleting your account (which erases the backup from our servers).

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for users in the EU/EEA and UK, the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data (e.g. your display name or email);
• Delete your account and all its server data — available directly in the app (Account → Delete account & data), or by emailing us;
• Portability / export — request a copy of your synced data in a portable format;
• Withdraw consent at any time — sign out to stop further backup on a device, or delete your account to erase the backup from our servers;
• Object or restrict certain processing, and lodge a complaint with your data-protection authority (in the UAE, the UAE Data Office).

To exercise any of these rights, email noorislamicapplication@gmail.com. Because guest use involves no account, most rights apply only once you have signed in and there is data linked to you.