Privacy Policy

1. Introduction

This Privacy Policy describes how Ayaat (“Ayaat”, “we”, “us”, or “our”) collects, uses, and discloses personal data when you use our website at ayaatapp.com and our mobile applications for iOS and Android (collectively, the “Service”). Ayaat is the data controller responsible for the personal data described in this Privacy Policy. If you have questions, contact us at support@ayaatapp.com.

2. Information We Collect

Information You Provide to Us

• Account information. When you create an account, we collect your email address, username, display name, and password.
• Profile information. You may choose to provide a bio, profile photo, city, and country. Your profile information, username, and public recitations are visible to other users of the Service.
• User content. Audio recordings you upload or record within the Service, and the associated metadata you provide, such as surah, verse range, recording date, and reciter.
• Verification information. If you apply for reciter verification, we collect your full name, phone number, email address, postal address, city, country, identity or affiliation documents, a sample recitation, and any links or notes you submit. Verification information is accessible only to Ayaat administrators.
• Communications. When you submit a content report or contact us, we collect the contents of your message and your account details.

Information We Collect Automatically

• Usage information. We collect information about your activity on the Service, including the recitations you play and for how long, playback position, likes, follows, playlists, saved collections, searches, recitations you download for offline listening, daily listening minutes, listening streaks and goals, the platform you use (web, iOS, or Android), and your app language.
• Approximate location. When you play a recitation, we derive your country from your IP address. We store the country only and do not store your IP address.
• Device identifiers. Our mobile applications generate a random identifier when installed. This identifier is sent with playback events whether or not you are signed in.
• Push notification tokens. If you grant notification permission, we collect the push notification token issued to your device by Apple (iOS) or Google (Android).

Information from Third Parties

• Sign-in providers. If you sign in with Apple or Google, we receive your email address and, if you choose to share it, your name from that provider.
• YouTube. If you connect your YouTube channel as a reciter, we receive the information described in Section 10.

3. How We Use Your Information

We use the information we collect to:

• provide, maintain, and operate the Service, including playback, playlists, offline downloads, syncing your listening position across devices, and reciter dashboards;
• review and process reciter verification applications;
• send transactional communications, including account confirmations, password resets, verification decisions, invitations, and a welcome email;
• send verified reciters a monthly email summarising the performance of their recitations;
• send push notifications about new recitations from reciters you follow and updates to your verification application;
• provide reciters with aggregated statistics about their own recitations, such as plays, likes, listener counts, and listener countries. Reciters cannot identify individual listeners;
• measure the number of listeners and understand how the Service is used, in order to improve it;
• detect, prevent, and address abuse, security incidents, and violations of our Terms of Service;
• comply with legal obligations.

4. Legal Bases for Processing

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Performance of a contract, to provide the Service, process verification applications, and send transactional communications.
• Legitimate interests, to provide reciters with aggregated statistics and monthly summaries, to measure and improve the Service, and to keep the Service secure. You may object to processing based on legitimate interests as described in Section 8.
• Consent, to send push notifications and to access your YouTube account. You may withdraw consent at any time through your device settings or by disconnecting YouTube.
• Legal obligation, where processing is required to comply with applicable law.

5. How We Share Information

We do not sell your personal data, and we do not share it for targeted advertising. We may disclose personal data in the following circumstances:

• Service providers. We share personal data with vendors that perform services on our behalf, including database and authentication hosting, file and audio storage and delivery, web hosting, email delivery, and push notification delivery. These providers are permitted to process personal data only on our instructions and are contractually required to protect it.
• Sign-in providers. If you sign in with Apple or Google, that provider receives your sign-in request.
• Other users. Your profile information and public recitations are visible to other users. Reciters receive aggregated statistics as described in Section 3.
• Legal requirements. We may disclose personal data where required by law, regulation, legal process, or governmental request.

6. International Data Transfers

Our service providers may process personal data in the United States and other countries that may not provide the same level of data protection as your country of residence. Where required by applicable law, we rely on standard contractual clauses or other approved transfer mechanisms to protect such transfers.

7. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, your account, profile, verification information, user content, and connected YouTube data are deleted immediately. Playback events are dissociated from your account and retained only as anonymous aggregate data. We may retain personal data for longer where required by law or to resolve disputes.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• request correction of inaccurate personal data;
• request deletion of your personal data;
• object to or request restriction of processing based on legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with your local data protection authority.

You may delete your account at any time from Settings within the Service or at ayaatapp.com/delete-account. You may opt out of monthly reciter emails by contacting us. To exercise any other right, contact us at support@ayaatapp.com. We will not discriminate against you for exercising your rights.

9. Cookies and Similar Technologies

Our website uses cookies that are strictly necessary to authenticate you and keep you signed in, and uses browser local storage to remember your playback and interface preferences. We do not use advertising or third-party tracking cookies.

10. YouTube API Services

Ayaat uses YouTube API Services. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service. Google’s processing of your data is governed by the Google Privacy Policy.

We request the youtube.readonly scope only when you, as a reciter, choose to connect your channel. We use this access to read your channel ID, handle, title, and avatar in order to display and verify your channel, and to list your uploaded videos so that you can select videos to import.

We store your channel ID, handle, title, avatar URL, and an encrypted OAuth refresh token. For each video you select for import, we store its public title, duration, and thumbnail, and we download the audio of that publicly available video from YouTube to create a recitation on the Service. This download uses the public video URL and does not use your Google account credentials. We do not access analytics or viewer data, post or modify content on your channel, share your YouTube data with third parties, or use it for advertising purposes.

Ayaat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You may disconnect your YouTube account at any time from your Ayaat dashboard, which deletes the stored channel data and refresh token, or revoke Ayaat’s access through your Google Security Settings.

11. Children’s Privacy

Accounts on the Service may be created only by individuals aged 13 or older. We do not knowingly collect personal data from children under the age of 13. If you believe that a child under 13 has provided us with personal data, please contact us and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make changes, we will post the updated policy on this page and revise the effective date above.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at support@ayaatapp.com.