Mümin 360 — Privacy Policy

Last updated: October 23, 2026 · Effective: October 23, 2026

1. In short

Mümin 360 has no accounts. We do not ask for your name, email or phone number. Your worship records, Heart Journal entries, intentions, missed-prayer and zakat records stay only on your phone; we cannot see them.

Some requests go to the internet so the app can work: prayer times, Quran text and audio, gold prices, subscription checks, ads in the free version, and at most once a day an anonymous usage count. Below we list exactly what is sent in each case.

We do not sell your data.
We do not track you: we do not ask for Apple’s tracking permission (ATT), and the advertising identifier (IDFA) is not used.
Ads are always requested as non-personalized; with Premium the ad software does not run at all.
You can turn off the usage count in Settings.
Settings > Privacy & data > Delete All Data erases everything on your phone.

2. Who is responsible, what this covers

Data controller: Burak Arslan (Türk Otağ)
Email: contact@turkotag.com
Web: turkotag.com

This policy covers the Mümin 360 iOS app on the App Store, its home screen widgets and its lock screen Live Activity. External sites you open from the app (such as the Diyanet tafsir page, Tanzil or the gold price source) have their own privacy rules.

It was written with Türkiye’s Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR) and Apple’s App Store privacy rules in mind. It also contains the information notice required by Article 10 of the KVKK. All requests, including KVKK applications, are made to the email address above.

3. What stays only on your phone

The following is kept on your phone, in the app’s own storage. It is not sent to our server and we cannot access it.

Your settings: language, your name if you entered one, notification and sound preferences, calculation method and school of law, appearance choices
Your chosen location: country, city and district names and codes; coordinates if found by location
Worship tracking (if you turned it on): prayer, fasting and excuse days, Self-review and Intentions
Dhikr counts, your custom dhikr, salawat and tasbihat records
Heart Journal: your mood, gratitude notes and the lines you write
Khatm plans, reading position, bookmarks and favorites
Missed-prayer book, zakat calculation, vow and charity records
Surah audio you downloaded and cached prayer time and translation data
A summary prepared for widgets and the lock screen: district and city name, prayer schedule, Hijri date and verse of the day. It is written only to the area the app shares with its widgets on the phone (App Group, group.com.turkotag.mumin360) and shown in home screen widgets and, if you turn it on, in the Live Activity on the lock screen. The Live Activity is off by default and can be turned on in Settings. This data does not leave your device and no server updates (push) are used. Others who look at your phone can see what is shown on the lock screen.

Notifications are scheduled on your phone. No remote (push) notifications are used and no push token is obtained. Error logs are written only to the device console in development builds; no error reports are sent to us.

Information about religion and belief is a special category of personal data under the KVKK and the GDPR. That is why no worship-related record leaves your phone.

The app does not add its own encryption to this data; it is protected by iOS app sandboxing and file protection. If iCloud or computer backup is on, this data may be included in that backup, which is handled between you and Apple.

Sharing: When you share a card, a verse or a Self-review summary, the iOS share sheet opens and you choose what to send and to whom. If you save a share card to Photos, only add-only access is requested; your library is not read.

4. What leaves your phone

Every internet request lets the receiving server see your IP address and basic connection details such as device type and iOS version. Their logs are governed by their own policies. Apart from the following, no data leaves your phone.

Prayer times (Diyanet data): The code of your chosen district goes to ezanvakti.emushaf.net. This is an independent service that passes on the times published by Türkiye’s Presidency of Religious Affairs (Diyanet) unchanged; it is not Diyanet’s own server. Your location or coordinates are not sent. In Türkiye, finding your district from your location is done with a table on the phone, without the internet.
Prayer times (other countries and fallback): If Diyanet data cannot be loaded or your place is not on Diyanet’s list, coordinates rounded to two decimals (about 1 km), the calculation method, school of law, high-latitude rule and month go to api.aladhan.com. Without internet, times are calculated on the phone.
Address lookup (Apple): When finding your city from your location outside Türkiye, your coordinates go to Apple through the iOS address service; when locating a district you picked from the list, only the district, city and country names go. Apple’s privacy policy applies.
Quran text, translation and recitation: The surah and verse number, your chosen translation and reciter go to api.alquran.cloud; audio files come from cdn.islamic.network. If this service cannot be reached, text and translation are loaded from an open Quran data repository on jsDelivr (cdn.jsdelivr.net, fastly.jsdelivr.net).
Gold and silver prices: When you ask for rates on the Zakat screen, the daily price list is requested from finans.truncgil.com. Nothing about you is sent.
Anonymous usage count (Türk Otağ): If on in Settings, at most once a day only the date, app version and language are sent to turkotag.com (Cloudflare infrastructure). The server reads only the country code from the connection and adds one to the totals per day, version, language and country. No IP address, device identifier or location is stored; individual users cannot be told apart. To turn it off: Settings > Privacy & data > Anonymous usage count.
App updates (Expo): When the app opens or comes to the foreground (at most every 6 hours), it asks Expo’s update server (u.expo.dev) whether a fix is available. The request contains the app version, platform and a random identifier created by the update service at installation; it is not linked to you or to any account.
Connectivity check: To show the offline notice correctly, an empty request is sent to captive.apple.com or www.gstatic.com; it carries no data.
Subscription (RevenueCat) and advertising (Google AdMob): see the next two sections.

5. Location

Location permission is requested only “While Using the App”; background location is never requested. If you do not allow it, you pick your city from the list and the rest of the app works the same.

Location is used to:

Find your district or city (in Türkiye with the table on the phone, offline)
Calculate prayer times when Diyanet data is not available (with rounded coordinates, as described above)
Calculate the qibla direction: the calculation is done on the phone. Motion and heading sensors are used for the compass only on the Qibla screen.

If automatic location is on, the app checks whether your district has changed when it comes to the foreground; it does not ask if permission is missing. Your coordinates and district are stored on your phone and not sent to our server. You can turn the permission off at any time in iOS Settings > Mümin 360 > Location.

In the free version, Google AdMob ads appear only at the bottom of list and tool screens and when leaving some tool screens. There are no ads in surah reading, the dhikr counter, Qibla, the Heart Journal, Settings or the Premium screen.

Ads are always requested as non-personalized. Google chooses the ad not by your interests but by context, such as the type of app and the approximate location (country or city) derived from the IP address.
We do not ask for Apple’s tracking permission (ATT). So the advertising identifier (IDFA) is not given to Google and no cross-app tracking takes place.
With an ad request Google receives technical information such as IP address, device model, iOS version, language, app information and ad interactions (views, taps). Google uses it to show and measure ads and to prevent fraud and abuse. Google’s privacy policy applies: policies.google.com/privacy
Apple’s SKAdNetwork is used to measure ad results; this measurement does not identify you.
In the European Economic Area, the United Kingdom and Switzerland, Google’s consent screen is shown before ads. Your choice is stored on your phone; you can change or withdraw it under Settings > Privacy & data > Ad consent preferences. If you do not consent, Google shows limited ads that do not store information on your device. If the consent flow cannot complete, no ad requests are made at all. This screen does not appear in other regions, including Türkiye, or with Premium.
The ad content limit is set to “general audiences”. If you still see an inappropriate ad, write to us from the “Did you see an inappropriate ad?” row on the Support screen.
With Premium, the ad framework (Google’s ad software) and the consent screen are never started; no ad-related request goes to Google. If Premium ends, the ad framework starts at that moment.

7. Premium and purchases

Buying and renewing Premium is handled entirely by Apple. Your card details never reach us or RevenueCat.

RevenueCat (RevenueCat, Inc., USA) is used to verify your subscription. RevenueCat’s software creates a random, anonymous user ID on your phone. With this ID, App Store transaction details (product, purchase and expiry dates, storefront country and currency), the app version and basic device information go to RevenueCat. Your name, email or Apple Account are not given to RevenueCat, and we do not match this anonymous ID with any other account. RevenueCat’s privacy policy: revenuecat.com/privacy

Purchase records remain with RevenueCat and Apple; Delete All Data does not erase them. Restore Purchases brings Premium back.

8. Purposes and legal bases

Prayer time, Quran, address lookup and gold price requests: to provide the feature you asked for. KVKK Art. 5/2-c (formation and performance of a contract), GDPR Art. 6(1)(b).
Subscription verification (Apple, RevenueCat): to provide the service you bought. KVKK Art. 5/2-c, GDPR Art. 6(1)(b).
Anonymous usage count: to see in aggregate how many people use the app and improve it. Legitimate interest; KVKK Art. 5/2-f, GDPR Art. 6(1)(f). The count does not identify anyone and can be turned off in Settings.
Ads (free version only): to keep the free version running. Legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)); in the EEA, the UK and Switzerland, the consent you give on Google’s consent screen for storing and reading information on your device (GDPR Art. 6(1)(a) and electronic communications rules).
Updates and connectivity check: for the app to work safely and correctly. Legitimate interest; KVKK Art. 5/2-f, GDPR Art. 6(1)(f).
Emails you send us: to solve your issue and reply. KVKK Art. 5/2-c and f, GDPR Art. 6(1)(b) and (f).
Location: with the permission you give on the iOS permission screen, only for the purposes above.

We do not use your data for profiling, automated decisions or marketing, and we do not sell it.

9. How long data is kept

Data on your phone: until you delete it (Delete All Data or removing the app). Removing the app also deletes the summary in the area shared with widgets.
Caches (prayer times, translations, surahs): refreshed automatically; deleted immediately with Delete All Data.
Usage count: the server keeps only totals. Since they cannot be linked to a person, they may be kept without a time limit. Your phone stores only the day of the last count.
Emails you send us: deleted within 12 months after the matter is closed, unless the law requires us to keep them.
RevenueCat, Google, Apple, Expo, Cloudflare and other services: according to their own policies.

10. International transfers

We have no server that holds user data. However, most services the app connects to are outside Türkiye (USA, European Union and other countries): Google, RevenueCat, Expo, Cloudflare, Apple, AlQuran.cloud, Aladhan and jsDelivr. When a request is sent to them, your IP address and the content of the request reach servers in those countries.

These transfers are necessary for the feature you asked for to work. Data going to Google, RevenueCat, Expo and Cloudflare is subject to those companies’ own data processing terms (including safeguards such as the EU Standard Contractual Clauses).

11. Security

All network requests of the app are encrypted with HTTPS (TLS).
Our usage count server accepts only the date, version and language fields, with a size limit, and does not store IP addresses.
Since there are no accounts, we have no user database that could leak.
The security of the data on your phone depends on the security of your phone. We recommend using a screen lock and keeping iOS up to date.

If a security incident affects us, we will make the notifications required by law (under the KVKK, to the Personal Data Protection Board within 72 hours).

12. Children

Mümin 360 is for Muslims of all ages, but it is not an app designed specifically for children. Because we ask no one for a name, email or age, we do not knowingly collect personal data from children. Ads are requested with a “general audiences” content limit.

Parents can control purchases with Screen Time and Family Sharing’s “Ask to Buy” in iOS. If you believe we have received personal data of a child, write to us and we will delete it.

13. Your rights

Under Article 11 of the KVKK and the GDPR you have the right to: learn whether your data is processed, request information, learn the purpose of processing and to whom it is transferred, have it corrected, deleted or destroyed, restrict processing, object, data portability, withdraw consent, object to an adverse result based solely on automated processing, and claim compensation for damage.

In the app you can do most of this yourself:

Access and correction: your data is on the app’s screens and you can change it as you like.
Erasure: Settings > Privacy & data > Delete All Data, or remove the app.
Portability: share the last 30 days’ summary as text from the Self-review screen.
Objection and withdrawing consent: turn off the usage count in Settings, change your ad consent in Ad consent preferences, turn off location in iOS Settings.

Since we hold no data tied to your name, we usually cannot match a request to you; we still answer every question. If you want your anonymous subscription record at RevenueCat deleted, write to us and we will work out together what is needed to find it.

Send requests to contact@turkotag.com; we reply free of charge within 30 days at the latest. If you are not satisfied with our answer, you can apply to the Personal Data Protection Authority in Türkiye (kvkk.gov.tr) or to the data protection authority of the country where you live in Europe.

If you live in California: we do not sell your personal information or share it for targeted advertising.

14. Changes

If a new data flow is added to the app, this policy is updated in the same release. The last updated date is shown at the top. We also mention important changes in the App Store release notes.

Last updated and effective: October 23, 2026

15. Contact

For any privacy question or request:

Burak Arslan (Türk Otağ)
Email: contact@turkotag.com
Web: turkotag.com

Writing “Privacy” or “KVKK” in the subject line helps us sort it faster.