Privacy at Al Sirat

You can read, listen, and explore without registering with Al Sirat. Apple manages App Store purchases. No Al Sirat account or cross-device profile sync is required in this release. This page describes the account-free release. If you used an earlier version with an account or cloud sync, this update does not itself delete previously stored information. Contact us about that data.

Preferences, bookmarks, reading progress, saved conversations, downloads, and reminders are stored for the features you use. Your device’s backup settings may include local app data. We do not promise that deleting the app also deletes operating-system backups. Optional local diagnostics keep broad feature counters on the device. Optional suggestions use only read, listen, Ask, and learn counters in broad time-of-day groups. These preferences gradually fade and do not store questions, verses, locations, or worship-completion records. Both options are off by default and have their own controls; they do not enable sharing.

When sharing is available and you separately choose to enable it in Settings → Privacy, the app sends occasional batches of broad feature-opening and purchase-flow counts. Sharing is off by default. Previous local counts are not uploaded. The payload contains only fixed event names and counts. It excludes question or answer text, passages, prayer or worship details, location, account/device/session identifiers, receipts, and event timestamps. The receiver combines accepted batches into daily event totals, retained for up to 30 days. It does not create an individual usage profile. These best-effort totals are not a count of unique people. Hosting and network providers still receive connection information, including an IP address, when a request is made. An identifier-free payload does not mean that the whole network connection is anonymous. Turn sharing off to stop future uploads and clear unsent counts. Clearing counters also cancels pending uploads. A request already received cannot be recalled, and counts already combined with other people’s totals cannot be separated for individual deletion. Local diagnostics, local suggestions, and sharing are separate choices.

When you use an available Ask service, your question, recent conversation, relevant library excerpts and answer instructions are processed online by the configured model service, Google Gemini. Questions may contain personal or sensitive information you choose to enter. This processing is part of answering, not optional usage analytics. The gateway uses Apple App Attest installation proofs to protect the same five-request daily allowance for everyone. These operational records are pseudonymous, not anonymous. Its application code keeps verification keys/counters for up to 90 days after activity, short-lived challenges, and daily quota counters for up to two days. It does not save question bodies or answer bodies in that ledger. Previous monthly quota records, if any, expire under their original retention of month-end plus one day; the shared policy creates no new monthly quotas. Support payments do not affect Ask access and the active Ask gateway does not request Apple purchase verification. Older clients may still attach a signed transaction; that field is ignored for access and is not stored in the ledger or sent to Google. Provider and hosting processing is separate from the application ledger. Apple handles optional support billing and payment details. The app uses StoreKit purchase information to show and restore subscription status; Al Sirat does not receive your payment-card number.

Participation in invitations and referral rewards is optional. If you choose to participate, the app sends an Apple-signed app-acquisition record and device-verification proof to our server to check eligibility, prevent abuse and restore rewards for the same App Store acquisition. We do not request or upload your contacts or address book. After verification, the ledger stores a pseudonymous identifier made by hashing the Apple app-acquisition identifier with a server-held key, plus invitation codes, verified referral counts, reward expiry, and claim and milestone records. The claimed code links the activation to its inviter and prevents repeated credits. These records are pseudonymous, not anonymous. The application ledger does not retain the raw Apple-signed record. Vercel hosts the service and Upstash Redis stores the ledger; provider connection processing is described below. Referral records currently have no automatic expiry. They are retained for fraud prevention and reward restoration, including after a reward expires or the app is deleted. After you participate, the app may refresh your reward status online. Stopping new invitations does not automatically erase previous claims. Contact us through the contact form about access, correction, deletion or other privacy requests. These records are separate from optional aggregate feature totals.

Location is requested when needed for features such as nearby mosques, prayer calculations, maps, or Qibla. Local prayer calculation does not require sending coordinates to the analytics receiver. Online map or search providers may process the search area or place you request. Notifications require iOS permission and the relevant reminder settings. They are not enabled by analytics or learned suggestions. If you choose voice input, microphone and speech-recognition permissions are requested. Apple’s speech-recognition service may process speech online; the app does not guarantee on-device recognition. Audio, downloadable content, mosque timetables, and other online features contact their respective providers. Those providers can see requested resources and ordinary connection metadata. Opening an external link is governed by the destination’s policy.

The website and first-party endpoints use Vercel. The aggregate receiver uses a dedicated key namespace in Upstash Redis, separate from Ask and waitlist records. Ask uses its own operational storage and Google Gemini; Apple handles App Attest, speech recognition, and App Store services. Audio and content can come from providers including Tarteel/QUL, EveryAyah, and Google Cloud Storage. The app uses HTTPS for these online services. We do not claim certificate pinning, a special encrypted local database, automatic key rotation, or a universal log-retention period. Hosting, security logs, backups, and model-provider processing have their own settings and policies and may involve processing outside your country. Contact us for information about the configuration applicable to your version. We do not sell personal information.

Website measurement is separate from the app’s optional feature totals. This site includes Vercel Web Analytics and Speed Insights, which can measure page visits and performance along with browser/device information and approximate region. Their provider documentation is linked below. Your language choice is saved in browser local storage. Regional pricing uses an approximate country/continent supplied by hosting and a first-party cookie lasting up to 30 days. API requests bypass that pricing cookie. The optional combined Android launch and news signup is sent through Formspree to Al Sirat Support. We receive your email, language, chosen purposes, explicit consent text and submission time. One optional, unchecked consent covers both occasional app news and the Android launch announcement. Contact forms send the name, email and message you provide. These submissions are separate from anonymous app totals and are stored by Formspree and received by the developer for the purpose you chose. Our website code does not log form content. Formspree and network providers process connection information under their own policies. Ask to remove your signup or contact information through our contact form; we retain it for its stated purpose until removal is requested, subject to applicable legal obligations.

Use Settings → Privacy to control local diagnostics, optional sharing, and pending counts. Use Settings → Preferences → Suggestions for you to disable or reset learned preferences. Saved chats have their own clear control; subscriptions are managed through Apple. iOS Settings controls location, microphone, speech, and notification permissions. For privacy questions or requests about information we hold, contact Straight Path Solutions through our contact form. We will consider applicable access, correction, deletion, and other privacy requests. We cannot identify an individual contribution inside combined aggregate totals. We will update this page when processing changes. A new optional sharing purpose requires a new choice; simply continuing to use the app is not treated as consent to optional analytics.