Privacy Policy

This policy explains what Mataanaha does with your personal data. Mataanaha is a mobile app for Islamic ebooks and audiobooks, with a Qur’an section and a Community section.

Mataanaha is operated by Stichting KHAYR Foundation, a foundation registered in the Netherlands. The foundation is the controller of your personal data under the General Data Protection Regulation (GDPR).

• Registered address: Parallelweg 128, A3, 1948 NN Beverwijk, The Netherlands
• Dutch Chamber of Commerce (KvK) number: 95007938
• Telephone: +31 85 800 3005
• Organisation and legal correspondence: info@khayr.so
• Customer support: help@mataanaha.com

We have not appointed a data protection officer. Send privacy questions and requests about your data to help@mataanaha.com; formal legal correspondence can also be sent to info@khayr.so or to the registered address.

Account. When you create an account we store your first name, your email address and a password (stored only in protected, hashed form by our authentication provider). If you sign in with Apple or Google, we receive the identifier and the name or email those services share with you. We use this to run your account, keep your library on every phone you sign in to, and contact you about your account. Legal basis: performance of our contract with you.

Using Mataanaha without an account. You can browse the bookstore, read and listen to free samples, and use the Qur’an and Community sections without registering. In that case we do not keep an account for you; the data in the sections below that mentions "your account" does not apply.

Purchases. When purchases open, records of what you bought, when, the price and the payment channel (the App Store, Google Play or a card payment provider) are kept so we can give you access to what you paid for and meet accounting and tax obligations. We never see or store full card numbers; the payment provider handles payment details. Legal basis: contract; legal obligation (accounting).

Reading and listening progress. Where you are in a book or audiobook, your bookmarks and your saved books are stored on your phone and, when you are signed in, in your account so you can continue on another phone. Legal basis: contract.

Qur’an and prayer features. Your Qur’an bookmarks and last page are stored on your phone and, when signed in, in your account. Your prayer-time location is used only on your phone to calculate prayer times and the Qibla direction; it is saved on the phone and is not sent to our servers. Tasbih counts are stored only on your phone.

Reviews. If you rate or review a book, we store the stars, your text and the time, and show them to other readers with your first name only. Legal basis: contract (the review feature you choose to use).

Customer support. Messages you send through the in-app support chat or by email, and our replies, are stored so we can help you and keep a record of the conversation. Legal basis: contract; our legitimate interest in handling requests properly.

Event and giveaway registrations. When you register for an event or enter a giveaway through the app, we store the answers you give on that form (for example your name, email address, phone number, country and city, as requested by that form), the time, and your registration reference. We use them only to run that event or giveaway. Registering never adds you to any marketing list. Legal basis: contract (the registration you request); for giveaways, also compliance with the published giveaway rules.

Notifications. Prayer-time alerts are generated on your phone and need no data from us. Mataanaha does not yet send marketing push notifications or marketing emails. If we introduce them, they will require your separate, explicit opt-in, which you can withdraw at any time.

Technical data. Our servers keep standard access logs (for example IP address, request time and the type of request) for security and to keep the service running. We also log access to paid content to enforce limits that protect authors' work. Legal basis: our legitimate interest in security and preventing abuse.

Crash reports. When the app crashes or a serious error occurs, the app sends a crash report so we can find and fix the problem: what went wrong (the error and where in the app's code it happened), the app version, the type of phone and its operating system version, the screen you were on and the steps just before the error (which buttons were pressed, without their text). Crash reports never contain your name, email address, IP address, payment details, passwords, the text of books or of the Qur’an, or screenshots. They are not used for advertising or to build a profile of you. Legal basis: our legitimate interest in keeping the app working and secure. The app does not contain analytics or advertising software.

Our website (mataanaha.com). The website uses no cookies and no advertising or tracking software. To see which pages and buttons are useful, the website counts a few anonymous events: a page view, a click on a download or "notify me" button, the language chosen, the type of device (iPhone, Android or computer), and the campaign name in the link you followed (for example "utm_campaign=ramadan"). These counts contain no name, email address, IP address or device identifier, and are not linked to your app account. If your browser sends a "Global Privacy Control" or "Do Not Track" signal, nothing is counted. To prevent abuse, our database briefly uses a scrambled form of your IP address to limit how often one connection can send events or sign-ups; it is deleted within two days. Legal basis: our legitimate interest in running and improving the website.

Launch notification list. If you ask the website to tell you when Mataanaha launches, we store your email address, the language you chose, the time and the consent text you agreed to. We use it only to send you one launch announcement (and, where needed, one message to confirm your address). It is never used for other marketing unless you separately agree. Every email has an unsubscribe link, and you can ask us at help@mataanaha.com to remove your address at any time. Legal basis: your consent.

• Supabase (database, authentication, file storage, server functions), hosted in the European Union (Ireland).
• Vercel (hosting of our web pages and admin site), with the site served from the European Union (Dublin).
• Sentry (Functional Software, Inc.), crash reports, stored in Sentry's European Union data region (Frankfurt, Germany). [Confirm the organisation's data region and sign Sentry's data processing agreement before release.]
• Apple and Google (sign-in, app distribution, in-app purchases, push delivery), each under its own privacy terms.
• Payment providers, when payments open (for example Stripe for card payments where permitted). They receive the data needed to process a payment.
• Qur’an and prayer data sources: when you use the Qur’an section, your phone downloads Qur’an text, translations and recitation audio directly from the Quran Foundation (quran.foundation / quran.com) and AlQuran Cloud (alquran.cloud / islamic.network), and Hijri dates from AlAdhan (aladhan.com). Those services see the technical details of those requests (such as your IP address). We do not send them your account data.

We do not sell personal data, and we do not share it with advertisers.

Our main systems are hosted in the European Union. Apple, Google and some service providers may process data outside the EU; where they do, we rely on the European Commission's adequacy decisions or standard contractual clauses as provided by those services.

• Account data: for as long as your account exists. When you delete your account, your profile, library, progress, saved items, bookmarks, reviews and support conversations are deleted.
• Purchase records: kept for as long as Dutch accounting and tax law requires, without your account details once the account is deleted. [Retention period to be confirmed by legal review.]
• Event and giveaway registrations: kept until the event or giveaway and any legally required follow-up are complete. [Period to be confirmed.]
• Server access logs: a short period for security purposes. [Period to be confirmed.]
• Crash reports: 90 days, then deleted automatically. [Set the retention in Sentry to match.]
• Launch notification list: until the launch announcement has been sent and at most 12 months, or earlier if you unsubscribe or ask us to remove it.
• Anonymous website counts: 25 months. The scrambled IP addresses used against abuse: at most two days.

Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent.

• Delete your account yourself in the app: Profile → Delete Account.
• For any other request, email help@mataanaha.com from the address on your account (or write to info@khayr.so or the registered address). We answer within one month, as the GDPR requires.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Access to personal data is controlled per account on the server (row-level security); administrators are verified on the server; paid files are kept in private storage and served through short-lived links; passwords are never stored in readable form; offline book copies on your phone are encrypted and removed when you sign out. No system is perfectly secure; if a breach affects you, we will inform you and the authority as the law requires.

Mataanaha is not directed at children under 16. If you believe a child has created an account, contact us and we will delete it.

We will post changes here with a new version number and date. For important changes we will inform you in the app.