Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Muaaz BdearMax-von-Laue-Straße 528359 BremenGermanyE-mail: bdear@salaty.info

If you have any questions about data protection or wish to exercise your rights, you can contact the controller at any time, preferably by e-mail. See also the legal notice.

2. The Salaty app

The app is designed to avoid processing personal data wherever possible. It requires no user account, contains no advertising and uses no analytics, tracking or crash-reporting services. The iOS app includes no third-party software libraries; it uses only system features of iOS. Apart from the system features of Android, the Android app includes only open-source libraries (such as Android Jetpack) that work on the device and do not transmit any data. The developer does not operate any servers for the app, and the app does not send any personal data to the developer.

2.1 Location

If you allow it (on iOS “While Using the App”, on Android only while using the app or only this time), the app accesses your device’s location. The location is needed to calculate prayer times and the Qibla direction, and to reference the Qibla compass to true north. City-level accuracy is sufficient. On iOS you can therefore turn off “Precise Location” for Salaty; if it is on, the app receives, stores and uses your precise position. On Android the app requests only approximate location; only on Android 11 and earlier, where the system does not offer approximate location, does it also request precise location.

• All calculations take place on your device only. The coordinates are stored locally together with the selected place and are not transmitted to the developer. To look up the place name, they are sent to Apple on iOS (see 2.2) and to your device’s geocoding service on Android (see 2.3).
• If you use “Current Location”, the app checks your location when you open it (at most every 30 minutes). If you have moved more than about 5 km, it switches to the new position, so the times stay correct while you travel. On iOS the app also uses location updates while the Qibla screen is open, to reference the compass to true north; on Android it uses the saved place for this.
• Depending on your device settings, the operating system may use its own services to determine your location (for example Apple’s Location Services or Google Location Accuracy); the respective provider is responsible for these.
• You can revoke location access at any time in the iOS or Android settings, or search for a city manually instead.

Legal basis: your consent, given through the iOS or Android permission prompt (Art. 6(1)(a) GDPR; Section 25(1) of the German TDDDG). You can withdraw it at any time with effect for the future.

2.2 Apple Maps (MapKit, iOS)

The iOS app uses Apple’s MapKit service for the following features:

• looking up the place name, country and time zone for a location,
• searching for cities using the search field,
• showing the map with the route to the Kaaba on the Qibla screen.

For these features, the app sends the data required directly from your device to Apple: the coordinates of a location, the text you type into the search field (sent while you type, to show suggestions), the map area shown, your device language and, for technical reasons, your IP address. Place names are also looked up automatically: if you use “Current Location”, the app checks your position when you open it (at most every 30 minutes). If you have moved more than about 5 km, it sends the new coordinates to Apple to determine the place name and time zone. The developer does not receive this data.

For users in the EEA, the UK and Switzerland, the recipient is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. It processes the data under its own responsibility in accordance with the Apple Privacy Policy. Data may be transferred to Apple Inc. in the USA; according to Apple, such transfers are governed by EU Standard Contractual Clauses. Without an internet connection these features are unavailable; prayer times are still calculated.

Legal basis: Art. 6(1)(b) GDPR (providing the app features you use).

2.3 Place names and city search on Android

To look up the place name and country for a location and to search for cities, the Android app uses the geocoding interface of the operating system. The operating system forwards the request to your device’s geocoding service; on devices with Google Play services, this is Google. The request contains the coordinates of a location or the text you type into the search field, the language and, for technical reasons, your IP address. If you use “Current Location”, this also happens automatically when you open the app after you have moved more than about 5 km. The developer does not receive this data. The app determines the time zone on the device without transmitting any data. If no geocoding service is available or you are offline, the app searches a built-in list of larger cities and, where needed, reads the country for the automatic choice of calculation method from your device’s mobile network or SIM card; no data is transmitted in this case.

For users in the EEA and Switzerland, the recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It processes the data under its own responsibility in accordance with the Google Privacy Policy. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). On devices without Google Play services, the privacy policy of the provider of the geocoding service in use applies.

Legal basis: Art. 6(1)(b) GDPR (providing the app features you use).

2.4 Notifications and background refresh

If you allow notifications, the app schedules prayer time alerts and reminders, such as the daily Quran reading reminder, locally on your device using the iOS or Android notification system. No push service is used: content such as the prayer name, time and place name is created on the device and is not sent to the developer or any third party. To keep scheduled alerts and widgets up to date, iOS may occasionally launch the app in the background; on Android the app uses the system’s exact alarms and reschedules the alerts after the device restarts. This, too, happens only on your device. You can change the permission for notifications (on Android also for alarms and reminders) and background refresh at any time in the iOS or Android settings.

Legal basis: Section 25(2) no. 2 TDDDG and, where personal data is concerned, Art. 6(1)(b) GDPR. You grant the permission through the iOS or Android prompt and can revoke it at any time.

2.5 Your own adhan (microphone and audio files)

You can record your own adhan or import an audio file. The app uses the microphone only after you have granted the permission and started the recording, and only while the recording is running; nothing is recorded in the background. When you import a file, the app receives only the file you select in the system’s file picker. Recordings and imported files are stored only in the app’s storage area on your device, prepared for playback as a notification sound, and not transmitted to the developer or any third party. On iOS the original files may be included in backups of your device (for example iCloud Backup); on Android they are excluded from backups. You can delete recordings in the app at any time; deleting the app removes them.

Legal basis: Section 25(2) no. 2 TDDDG and, where personal data is concerned, Art. 6(1)(b) GDPR. You grant the microphone permission through the iOS or Android prompt and can revoke it at any time in the settings.

2.6 Quran

The texts for the Quran section are included in the app; no data is downloaded or transmitted when you read or search. The app stores bookmarks, your reading position, the progress and goals of a khatm (a complete reading of the Quran) and your reading settings only locally on your device (see 2.7). If you turn on the daily reading reminder, it is scheduled as a local notification on your device (see 2.4).

2.7 Local storage on your device

The app stores the following data locally on your device only:

• your settings, such as the calculation method, adjustments, notification, sound and display options, including the app language,
• the selected place and up to 12 recently used places (name, country, country code, coordinates and time zone),
• bookmarks, reading position, progress and goals of a khatm, and your Quran reading settings,
• your own adhan recordings and imported audio files (see 2.5),
• technical status values, such as whether setup is complete, whether you chose the calculation settings yourself and when your location was last updated.

On iOS, the data the widgets need is kept in a protected shared storage area (App Group) that only the app and its widgets on the same device can access; the remaining values are kept in the app’s own storage area. On Android, all data is kept in the app’s private storage area. The data is not transmitted to the developer. You can remove recently used places in the app; deleting the app removes all data it has stored from your device.

If you back up your device, this data may be included in the backup: on iOS, for example, via iCloud or a computer; on Android, your settings, saved places and Quran data (bookmarks, progress, reading settings) may be included in Android backup to your Google Account or in a transfer to a new device. The notification schedule, device-specific status values and your own adhan recordings are excluded from this on Android. Your settings and the privacy terms of Apple or Google apply to backups.

You can export the monthly calendar as a PDF or as text. An exported PDF is created in the app’s temporary folder on your device; the export is shared only with the recipients or apps you choose yourself in the iOS or Android share sheet.

Legal basis: Section 25(2) no. 2 TDDDG (storage strictly necessary for the features you request) and, where personal data is concerned, Art. 6(1)(b) GDPR.

2.8 Links from the app to this website

If you open a link to this website from the app, for example to the privacy policy, the legal notice or support, the page is loaded in your browser; section 4 applies.

3. App Store, Google Play, testing and diagnostic data

3.1 App Store and TestFlight (iOS)

The iOS app is distributed through Apple’s App Store and is tested in advance via TestFlight. For downloading, installing and updating the app, and for taking part in the beta test, Apple processes data under its own responsibility, such as your Apple Account data. The Apple Privacy Policy applies. In this context, Apple may provide the developer with the following information:

• TestFlight: If you take part in the beta test, the developer receives through Apple the information required for the test, such as your name and e-mail address (if you were invited by e-mail), device model and iOS version, installation and usage statistics of the beta version, crash reports, and any feedback and screenshots you choose to send.
• Diagnostic data: If you have turned on sharing with app developers in iOS under Settings → Privacy & Security → Analytics & Improvements, Apple may provide the developer with crash reports and aggregated usage statistics. This data is collected by Apple, not by the app itself. You can turn this option off at any time.

3.2 Google Play (Android)

The Android app is distributed through Google Play and is tested in advance using Google Play’s testing features. For downloading, installing and updating the app, and for taking part in tests, Google (for users in the EEA and Switzerland, Google Ireland Limited) processes data under its own responsibility, such as your Google Account data; the Google Privacy Policy applies. In this context, Google may provide the developer with the following information:

• Testing via Google Play: If you are invited as a tester, the developer manages your e-mail address (that of your Google Account) in the Google Play Console and receives any feedback you choose to send via Google Play.
• Android Vitals: If you have turned on sharing of usage and diagnostics data in Android, Google may provide the developer with crash and error reports (for example device model, Android and app version, technical error report) and aggregated statistics. This data is collected by Google, not by the app itself. You can turn this option off in the Android settings.

3.3 Use and retention

The developer uses this information solely to run tests, fix bugs and improve the app. Information from TestFlight, App Store Connect and the Google Play Console remains there for as long as Apple or Google provides it. The developer does not export or store it elsewhere, except for individual crash reports needed to fix a specific bug, which are deleted once the bug is fixed. Tester invitations and e-mail addresses are deleted as soon as they are no longer needed for testing.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in running tests and providing a stable, error-free app.

4. This website and the demo

4.1 Hosting and domain

This website is available at https://www.salaty.info. The domain salaty.info and its DNS records are managed by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. If you open salaty.info without “www”, an IONOS server answers the request and redirects you to https://www.salaty.info. For technical reasons, IONOS processes your IP address, the address requested, the date and time and your browser’s user agent on behalf of the controller, based on a data processing agreement (Art. 28 GDPR), in data centres in the EU. The controller does not analyse this data.

The website itself is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA (“Railway”), on servers in the region EU West (Amsterdam, Netherlands). Railway processes the data generated when the website is accessed solely on behalf of the controller, based on a data processing agreement (Art. 28 GDPR). As a US company, Railway may access this data from the USA. Railway is certified under the EU-U.S. Data Privacy Framework, so such transfers are based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Railway’s Data Processing Addendum includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For more information, see Railway’s privacy policy. The connection to the website is encrypted via HTTPS.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in providing the website securely and under both spellings of the domain.

4.2 Server log files

When you visit the website, technical information transmitted by your browser is processed automatically:

• IP address,
• date and time of access,
• requested URL,
• HTTP status code and response time,
• user agent (browser type and version, operating system).

This also applies to the files the demo loads (such as scripts, language files or the city list); these requests contain neither your location nor anything you enter. The data is processed to deliver the website, to ensure its stable operation and to detect and prevent misuse and attacks. It is not combined with other data sources or analysed for marketing purposes. Railway stores these log entries for no longer than 30 days; they are then deleted automatically. The web server of this website itself writes no access logs.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in delivering the website securely and without errors.

4.3 No cookies, no tracking, no external content

The website sets no cookies and uses no analytics or tracking tools. It uses the fonts installed on your device and loads everything else — stylesheets, scripts, images, data and its own font files — exclusively from its own server; no third-party content such as Google Fonts or content delivery networks is embedded. Links to other websites (for example to Apple, Google Play, tanzil.net or geonames.org) are only opened when you click them; the privacy policy of the respective provider then applies.

4.4 Storing your language choice

The website selects its language based on your browser’s language setting; this happens entirely within your browser. If you open a link containing ?lang=de, ?lang=en or ?lang=ar (for example from the app), the website shows that language and remembers it for further pages in the same tab in your browser’s session storage (sessionStorage, key “salaty.lang”); this entry is deleted when you close the tab. Only when you choose a language yourself — in the website’s language menu or in the demo’s settings — is this choice saved in your browser’s local storage (localStorage, key “salaty.lang”), so that the website can use it on your next visit. To reach a language permanently without anything being stored, use the addresses /de/, /en/ and /ar/. The entries contain only the language code (de, en or ar), are not transmitted to the server and can be deleted at any time in your browser settings.

Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR (legitimate interest in a user-friendly, multilingual website).

4.5 Interactive demo

The live demo on the home page and at /demo calculates prayer times, the Qibla direction and the calendar entirely within your browser. Your location, your search input and your settings are not transmitted to the server of this website or to any third party. Your browser loads the demo’s files (scripts, language files, city and time zone data) from this website’s own server (see 4.2). On your first visit, the demo picks an example city based on your browser’s time zone; this, too, happens only within your browser.

• Location (optional): Only if you tap “Use Current Location” in the demo’s settings and confirm the notice with “Continue” does the website ask your browser for your location. If you allow access, the demo immediately rounds the coordinates to two decimal places (about 1 km) and uses them only within your browser to calculate prayer times and the Qibla direction and to find the nearest city in the city list supplied with the demo. The coordinates are not transmitted to the server or to any third party; the unrounded coordinates are not stored, and the rounded ones only as described under “Demo settings”. Your browser or operating system may use its own services to determine your location (for example Wi-Fi-based positioning by Apple, Google or Microsoft); the respective provider is responsible for these. You can revoke the permission at any time in your browser settings.
• City search: The city list is loaded from this website’s server. What you type into the search field is evaluated only within your browser and is not transmitted.
• Compass (optional): Only if you tap “Enable compass” on the demo’s Qibla screen does the website read your device’s heading from its motion and orientation sensors (on iOS only after you allow it in the browser). The readings are used only in your browser’s memory while the Qibla screen is visible, and are neither stored nor transmitted. Access ends when you tap “Stop compass” or leave the screen.
• Demo settings: As soon as you select or change something in the demo (for example the place, calculation method, Asr calculation, time format, calendar view or the open tab), the website saves this state in your browser’s local storage (localStorage, key “salaty.demo.v1”), so that the demo shows it again on your next visit. The entry contains only these settings and the selected place (the city name in up to three languages, country code, time zone and the city’s coordinates, or the rounded coordinates if you used your location) and no identifier. It is not transmitted to the server and remains stored until you delete it: in the demo with “Reset demo” or in your browser settings.

Legal basis: for access to your location, your consent, which you give by tapping “Use Current Location” and “Continue” and allowing access in your browser (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future in your browser. For access to the sensors and for storing the demo settings, Section 25(2) no. 2 TDDDG (strictly necessary for the feature you explicitly request) and, where personal data is concerned, Art. 6(1)(f) GDPR (legitimate interest in a working demo).

5. Contact by e-mail

If you contact the developer by e-mail — for example via the support link in the app or on this website — your e-mail address, your name (if provided) and the content of your message, including any attachments, are processed to handle your request. When you use the support link in the app, the app’s version and build number are already filled in in the subject line.

E-mails are received and stored by the controller’s e-mail provider, IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which processes them on the controller’s behalf (Art. 28 GDPR) in data centres in the EU. Correspondence is deleted no later than 12 months after your request has been fully dealt with, unless statutory retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR where your request concerns the use of the app; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

6. Data security

The website delivers its content only over encrypted connections (HTTPS/TLS), and browsers are instructed to access it only in encrypted form (HSTS). It loads no third-party content, and a Content Security Policy prevents third-party scripts from running. Only the website itself may request location and motion sensors; camera and microphone are blocked entirely. Only the controller has access to the accounts with Railway, IONOS, Apple and Google. Data that the app stores only on your device is protected by the security mechanisms of iOS or Android, in particular the separation of app data from other apps and device encryption, provided you have set a device passcode.

7. Children

The developer does not receive any personal data through the app or the demo — including from children. Children under the age of 16 should only contact the developer by e-mail with the consent of their parents or guardians. If you become aware that a child has provided personal data without such consent, please contact the e-mail address above and the data will be deleted.

8. Your rights

Under the GDPR, you have the following rights:

• access to the personal data processed about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure of your data (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply send an e-mail to bdear@salaty.info. As neither the app nor the demo sends any data to the developer, such requests will usually concern only e-mail correspondence, server log data of this website or information provided by Apple or Google. The developer can neither see nor delete data stored only on your device or in your browser; you can change or remove it yourself at any time, for example by deleting the app, with “Reset demo” or in your browser settings.

You are neither legally nor contractually obliged to provide personal data. Without location access you can search for a city instead; without notification permission you will not receive alerts; without microphone permission you cannot record your own adhan, but you can import an audio file. There is no automated decision-making, including profiling (Art. 22 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for the controller is: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen, Georgstraße 122–124, 27570 Bremerhaven, www.datenschutz.bremen.de.

9. Changes to this privacy policy

This privacy policy will be updated when the features of the app or the website, or the legal requirements, change. The version published on this page applies.

Last updated: 16 September 2026