Learn Islam.
Free & Fun.

Last updated: August 16, 2026 · Version: 1.0

This Privacy Policy explains how personal data is handled when you use the Diraya mobile application (the "App"). Please read it before using the App.

1. Who we are

Diraya is developed and provided by Layla Alsalih, an individual developer. There is no company behind the App.

Contact: team@diraya-app.com

Layla Alsalih is the "data controller" for the personal data described in this policy.

2. What data we collect

Data you give us directly

• Account details, if you create an account: email address, age and display name
• Whether you identify as Muslim, if you choose to tell us. This is information about religious belief and is treated as a special category of personal data under Article 9 GDPR. Answering is optional, it is processed only with your explicit consent, and the App can be used without answering.
• Messages you send for support

Data collected automatically

• Device and technical data: device model, operating system version, app version, language, time zone offset and IP address
• Technical identifiers created by the App and its infrastructure: a Firebase installation identifier, a push notification token, and a crash reporting identifier. These identify your installation of the App, not you personally, but we treat them as personal data.
• Crash reports and error logs
• Usage data: which lessons, quizzes and knowledge bites you open, complete or leave; which screens you view and for how long; which answers you select in quizzes; which notifications you open; when you open and close the App
• Session recordings: a reconstruction of how you moved through the App — the screens you visited, and where and when you tapped, scrolled and typed

About session recordings

Session recordings help us find parts of the App that are confusing or broken. They are not video of you, they do not use your camera or microphone, and they do not record anything outside the App.

Sensitive parts of the screen are hidden before a recording is created. Specifically:

• Everything you type is masked, including your email address and password
• The question about religious belief, and your answer to it, is masked in full and never appears in a recording

You can switch session recordings off at any time at Settings → Privacy → Usage analytics. This also switches off usage analytics. See section 3 for how to object.

Data that is not collected

• We do not collect precise location, contacts, photos, health data, voice recordings or camera images.
• We do not sell your personal data.
• We do not use your data for advertising, and we do not work with advertising networks. If this ever changes, we will update this policy and tell you before it takes effect.
• We do not track you across other apps or websites.

Before you create an account, the App also counts how many people reach each onboarding screen. These counts contain no identifiers of any kind, cannot be linked to you, and are not personal data.

3. Why your data is used, and the legal basis

• Providing the App and its core features: Performance of a contract (Art. 6(1)(b))
• Creating and managing your account: Performance of a contract
• Saving your progress, bookmarks, streak and quiz results: Performance of a contract
• Checking that you meet the minimum age for an account: Legal obligation (Art. 6(1)(c)) and legitimate interests — protecting minors
• Fixing crashes and technical problems: Legitimate interests (Art. 6(1)(f)) — keeping the App working
• Understanding how lessons and quizzes are used, so that content can be improved: Legitimate interests — improving the App
• Recording sessions to find parts of the App that are confusing or broken: Legitimate interests — improving the App
• Understanding, in aggregate, how the App is used by learners who identify as Muslim and those who do not: Explicit consent (Art. 9(2)(a)), together with consent under Art. 6(1)(a)
• Sending push notifications: Consent (Art. 6(1)(a))
• Responding to your messages: Legitimate interests
• Keeping a record that a deletion request was carried out: Legitimate interests — demonstrating compliance
• Meeting legal obligations: Legal obligation (Art. 6(1)(c))

Information about religious belief

This is the only special category of personal data processed by the App. It is processed only with your explicit consent. It is stored only in your account record, is never sent to any analytics service, is masked out of session recordings, is not used for advertising, and is not shared with anyone.

At present it is used only to understand, in aggregate, how different groups of learners use the App. It is not currently used to change or personalise the lessons you see. If we ever want to use it that way, we will update this policy and ask for your consent again before doing so.

Withdrawing consent

Where the App relies on consent — for push notifications and for the question about religious belief — you can withdraw it at any time in Settings. Withdrawing consent does not affect processing that already took place.

Objecting to usage analytics and session recordings

Usage analytics and session recordings are collected on the basis of legitimate interests, not consent. You can object at any time by switching off Settings → Privacy → Usage analytics. When you do, the App stops sending usage data and stops creating session recordings immediately. Everything else in the App continues to work normally.

4. Third-party services

The following companies process data on our behalf. They act as data processors, handle data only on our instructions, and are bound by data processing agreements.

Google (Firebase) — the platform the App is built on:

• Firebase Authentication — account creation and login
• Cloud Firestore — storing account data and app content
• Firebase Crashlytics — crash and error reporting
• Firebase Cloud Messaging — push notifications

PostHog — usage analytics and session recordings, using the EU-hosted version of the service.

Apple — on iPhones and iPads, push notifications are delivered through the Apple Push Notification service. Apple receives the notification token and the message in order to deliver it.

Further information is available in Google's privacy policy (policies.google.com/privacy), Firebase's privacy documentation (firebase.google.com/support/privacy), PostHog's privacy documentation (posthog.com/privacy) and Apple's privacy policy (apple.com/legal/privacy).

No other companies receive your personal data. We do not share it with advertising networks or data brokers, and we do not disclose it to anyone else except where required by law.

5. Where your data is stored

The storage location depends on the service:

• Account data and app content in Cloud Firestore are stored in the eur3 multi-region, meaning servers in Belgium and the Netherlands, with a replica in Finland.
• Usage analytics and session recordings are stored by PostHog on servers in Frankfurt, Germany. This data does not leave the EU.
• Firebase Authentication is operated only from data centres in the United States, so login data — email address, encrypted password and user ID — is processed there.
• Crash reports and push notification data may be processed on Google or Apple servers in the United States or in other countries where they operate facilities.

For the transfers to the United States described above, we rely on Google LLC's and Apple Inc.'s certifications under the EU–US Data Privacy Framework and on the Standard Contractual Clauses contained in their respective data processing terms.

6. How long your data is kept

• Account data: when you request deletion in the App, a background process automatically erases your user record — including progress, quiz attempts, streak and bookmark data — deletes your Firebase Authentication account, and deletes your usage analytics and session recordings from PostHog. This normally completes within 48 hours.
• Deletion records: a record of your deletion request, including an account identifier, the reason given and basic platform information, is kept separately for 12 months as evidence that the request was carried out.
• Usage analytics: 14 months.
• Session recordings: 30 days.
• Crash reports: 90 days.
• Support emails: 2 years.

Crash data held by Google is deleted automatically at the end of the period above and is not affected by deleting your account.

7. Your rights

If you are in the EU/EEA or UK, you have the right to:

• access the personal data we hold about you
• correct data that is wrong or incomplete
• have your data deleted
• restrict how your data is used
• object to processing based on legitimate interests, including usage analytics and session recordings
• receive a copy of your data in a portable format
• withdraw consent at any time, where consent is the basis
• lodge a complaint with a data protection authority

To exercise any of these, email us at team@diraya-app.com. We will respond within one month. We may need to ask you to confirm the email address linked to your account before we act on a request, so that we do not disclose your data to someone else.

Deleting your account: you can delete your account and associated data directly in the App at Settings → Delete account.

Objecting to analytics and recordings: you can do this yourself at any time at Settings → Privacy → Usage analytics. No email is needed.

If you are in Austria, the supervisory authority is the Österreichische Datenschutzbehörde (dsb.gv.at). If you are elsewhere in the EU, you can complain to your own national authority.

If you are outside the EU/EEA and UK: the App is built for users in Europe, but we apply the same standard of protection to everyone. You can use the same contact address and the same in-App controls, and we will handle your request the same way. You may also have additional rights under your own national law.

8. Minimum age and younger users

You must be at least 14 years old to create a Diraya account. We ask for your age when you sign up and do not create accounts for anyone below this age.

If you are under 16, the App does not ask you for consent to anything. This means the question about religious belief is not shown to you, and push notifications are not offered. Everything else in the App works exactly the same.

We do not knowingly collect personal data from anyone under 14. If you believe someone under 14 has created an account, contact us at team@diraya-app.com and we will delete it.

If you are a parent or guardian and you have questions about your child's use of the App, or you want their data deleted, contact us at the same address.

9. Automated decisions and profiling

We do not make any decisions about you by automated means that produce legal effects or similarly significantly affect you. The App does not build a profile of you to predict your behaviour, and it does not currently change the lessons you are shown based on your answer to the question about religious belief.

10. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), encryption of stored passwords, and restricted access to stored data. No system is completely secure, so we cannot guarantee absolute security. If a data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

11. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you in the App or by email before they take effect. The date and version at the top show when it was last revised.

12. Contact

Questions about this policy or your data:

team@diraya-app.com