Privacy Policy

1. The short version

• We do not ask you to register or create a profile.
• Your notes, marks, Quran searches, in-app selections, and reading-plan progress are not sent to us or to a content provider. An ayah or resource number is sent only when you deliberately request its online audio, word timing, or tafsir.
• Core content services are contacted when you press play or open tafsir. They are named in section 4 with links to their own policies.
• This version shows no ads, contains no advertising or analytics SDK, does not use an advertising identifier (Apple's IDFA or the Android advertising ID), and does not ask for advertising consent, Apple's App Tracking Transparency permission, or Android ad personalisation permission.
• Deleting the app removes its local data and caches from that device. An existing device backup remains subject to your platform's own backup handling and retention — Apple's on iOS, or your device's backup provider (typically Google, if enabled) on Android.

2. Who is responsible

The Kevser app is published by MissingLayer B.V., Korte Lijnbaanssteeg 1, 4570, 1012 SL Amsterdam, Netherlands (“we”, “us”). For anything in this policy, write to admin@missinglayer.com.

Where data protection law applies, we are the controller for the choices Kevser makes about processing, including operation of our Quran Foundation proxy and this website. Cloudflare acts as our infrastructure provider for those services. Quran Foundation and QuranEnc separately determine how they process connection data received by their own services and are independent controllers for that processing. Their policies are linked below.

3. What stays on your device

Kevser keeps the following on the device itself. None of it is transmitted to us, and there is no service of ours that could receive it.

• Notes, highlights and bookmarks — saved in a file inside the app's own Application Support directory.
• Reading-plan progress — which ayahs you have read, the plan you chose, its start date, and how many times you have completed the Quran.
• Your settings — your reading and playback preferences, including the translation, the edition of the Arabic text, reading fonts and sizes, line and ayah spacing, display mode, day or night appearance, reciter, rotation lock, whether the audio buttons are hidden, whether playback continues across surahs and follows along as it reads, and which commentary source you last chose in each language.
• Your place in the text — the surah and ayah you last read, so the app can reopen there.
• Your reminder setting — whether a daily reminder is on, and the time you chose for it.
• Caches — recitation and spoken-translation audio files you have played, their word-timing files, and tafsir passages you have opened. These live in the system cache area so that supported content works offline. Each cached item expires by itself — within about a week for commentary, recitation and word timings, and within a month at most for spoken translations — and the operating system may clear them sooner when storage runs low, after which the app simply fetches them again next time.

This version of the app does not use iCloud or a Google account to sync data, so your notes and marks do not travel between your devices. On iOS, because app data (other than caches) sits in Application Support, it is included in an ordinary encrypted device backup made by Apple's own backup mechanisms, governed by Apple's privacy policy. On Android, the same app data is eligible for your device's own backup service (typically Google's Android backup, if you have it enabled), governed by Google's privacy policy; you can turn this off for the app in your device's system backup settings.

4. When the app uses the internet, and who it talks to

Reading, searching, navigating, annotating and reading-plan tracking are entirely offline: the Quran text and every bundled translation are inside the app. The app opens a network connection only for the content features described below. Each is a plain HTTPS request for one file, and Kevser attaches no account information, notes, or reading progress to it. Some of those requests pass through a service we host; the rest go straight to the provider. As with any internet request, each service that receives one can see the IP address it came from and ordinary details such as the time and the file requested. An IP address is personal data when it can be related to a person, and the requested path may show which Quran content was requested. We do not use that information to infer a religious belief, build a religious profile, or personalise the app.

Recitation audio and word timings — Quran Foundation Content API

WhenYou tap the Arabic play button and that ayah's recording is not already cached. The app looks up the recording for that verse and then downloads it from Quran Foundation.

What is sentThe selected reciter and surah-and-ayah number. The host serving the MP3 also receives an ordinary request for that audio file.

KeptThe word timings are cached for about a week, both by our hosting provider and on your device. The recording stays with Quran Foundation and is cached on your device for up to a week.

Their policyquran.com/privacy

Tafsir — Quran Foundation (Quran.com API) and QuranEnc.com

WhenYou tap Tafsir on a verse, or open the Daily Verse screen with its commentary card, and that passage is not already cached. Some languages have no online commentary source: most of those show the translator's own notes instead, which are bundled in the app and need no internet request, and the two with neither do not show the tafsir option at all.

What is sentA request for the commentary of one ayah from one named resource.

KeptCommentary is cached on your device for about a week. Quran Foundation passages may be cached by our hosting provider for the same period.

Their sitesquran.com/privacy · quranenc.com

Spoken translations — QuranEnc.com and our own storage

WhenYou tap the spoken-translation button for an edition that has spoken audio, and that ayah is not cached.

Where fromQuranEnc.com for the ten editions with a human narration: English, French, Portuguese, Dutch, Chinese, Vietnamese, Tagalog, Somali, Assamese and Persian. The Turkish edition is read by a synthesized voice, not a person; we generated that audio ourselves from the bundled Turkish text and serve it from our own storage at Cloudflare, so no separate content publisher receives that request. Cloudflare necessarily receives the connection as our hosting provider. The app labels it as a synthesized voice. Other translation editions do not show a spoken-translation control.

What is sentAn ordinary request for one audio file, identified by surah and ayah number. No account or app-specific device identifier is attached; the receiving server still necessarily sees the connection's IP address and time.

KeptCached on your device for up to a month.

Their sitequranenc.com

Quran Foundation integration

Kevser is an independent app and is not an official Quran Foundation, Quran.com, or QuranReflect product. It uses Quran Foundation's Content API to retrieve tafsir and per-ayah recitation metadata, including word timings and where each recording can be played from. Those requests are made on the app's behalf by a service we operate, so the app on your device holds no credential of its own. Kevser does not use Quran Foundation's user-account features and never asks you to sign in to one.

The app does not send Quran Foundation your notes, bookmarks, reading history, settings, or other on-device content. We do not sell or rent that on-device content, use notes or reflections to train an AI model, or send sensitive Quran activity to another service. Notes and reading activity can reveal religious beliefs and may be sensitive personal information, which is why Kevser keeps them on your device and does not collect or process them on our servers.

Cloudflare may hold a temporary copy of the commentary and recitation information Kevser requests, so that a passage many readers open is not fetched again for each one. What is cached is public Quran content, not anything about you. To deliver and protect that service, and to limit abusive request rates, Cloudflare processes ordinary connection information such as IP address, time, and the address requested, under its privacy policy. We add no request logs of our own, no record of which verses you opened, and no identifier for you or your device.

All of these requests use HTTPS, and everything cached on your device stays inside the app's own protected storage. If we become aware of a security incident affecting this connection, we will begin responding promptly and notify Quran Foundation within 24 hours as its developer terms require.

5. Why we process connection data

Where the GDPR applies, our lawful basis for the limited connection data processed through our proxy and website is our legitimate interest under Article 6(1)(f): delivering the content or page you requested, keeping the service secure and available, preventing abuse, and diagnosing failures. We balance that interest against your rights by collecting no account identifier, keeping user-created content on the device, adding no application request logs of our own, and limiting online requests to features you deliberately open or play. You can use the bundled Quran, translations, search, annotations, and reading plans without making those requests.

If you contact us, we use the information in your message to answer it and keep any necessary record of the request. The basis is taking steps at your request, our legitimate interest in providing support, or compliance with a legal obligation, depending on the message. We do not use consent as the basis for the processing described in this section and do not use online Quran requests to infer or record anyone's religious beliefs. There is no automated decision-making or profiling.

6. Providers, retention and international transfers

Cloudflare hosts the website, proxy and our Turkish spoken-translation files, delivers and protects those services, and applies rate limits. It processes connection data on our behalf under its data-protection terms, while also handling limited data for its own security and legal purposes as described in its privacy policy. We require processors acting on our behalf to protect personal data consistently with this policy and to provide the same or equivalent privacy protection. Quran Foundation and QuranEnc receive only the request information needed to return content and process it independently under their own policies; we do not give any provider notes, bookmarks, reading history, advertising identifiers, or an app account.

Our shared proxy cache contains public Quran content rather than a user record and expires in about one week. We create no application-level request log. Infrastructure and security logs maintained by Cloudflare, Quran Foundation, or QuranEnc are retained under the relevant provider's settings and policy for no longer than the provider considers necessary for delivery, security, abuse prevention, legal compliance, and dispute handling. Contact the relevant independent provider for a request concerning data it controls.

These providers operate internationally, so connection data may be processed outside your country and outside the EEA. For transfers made by us to a processor in a country without an EU adequacy decision, we rely on an approved transfer mechanism such as the European Commission's Standard Contractual Clauses and any supplementary safeguards required by law. Cloudflare's customer data-processing terms incorporate those clauses. Independent content providers are responsible for the transfers they make under their own policies and applicable law.

We use HTTPS/TLS for data in transit, platform encryption at rest where the hosting platform stores data, restricted production access, encrypted deployment secrets, and credential rotation. Our incident process and API controls are maintained to meet Quran Foundation's developer security requirements, including its Security Rule 6.9 reference.

7. Advertising and analytics

This version of Kevser does not display advertising and contains no advertising or analytics SDK. It does not make ad requests, create an advertising profile, access Apple's advertising identifier, or ask for Apple's App Tracking Transparency permission.

We may add advertising in a future version. Before any such version is released, we will update this policy and the App Store privacy disclosures to describe the exact provider and data practices, and we will add any consent and privacy controls required by law. Any banner will use its own dedicated row outside the Quran and translation presentation, never overlaying Quran text, translation text, selection controls, or playback controls. We will configure the ad service to block alcohol, gambling, nudity and sexual content, interest-based lending, hate, extremism, misinformation, and unlawful goods or services. Installing this version does not consent to advertising in a future version.

8. App Store and Google Play services

• The App Store or Google Play handles the download, any purchase, and updates. That relationship is between you and the store operator — Apple, under Apple's privacy policy, or Google, under Google's privacy policy.
• Aggregated crash and install reports. Apple's App Store Connect and Google's Play Console may each give us aggregated, non-identifying reports about installs, versions and crashes on their own platform. Whether your device contributes is your choice in system settings — on iOS, Settings → Privacy & Security → Analytics & Improvements; on Android, Settings → Google → Usage & diagnostics, or the equivalent for your device. We never receive anything that identifies you.
• The rating prompt. On iOS, Settings uses Apple's standard in-app rating mechanism; Apple shows it and we are not told what you do with it. On Android, the rating link currently opens the app's Google Play Store listing in Google Play, where you can choose to leave a rating; we are not told whether you do.
• Sharing a verse uses the operating system's own share sheet. You choose the destination; the app hands the text to the operating system and learns nothing about where it went.

9. Notifications

If you switch on the daily reading reminder, the app asks the operating system for permission and then schedules one repeating local notification at the time you picked, in the language you read in. It is created and delivered by your device. There is no push server, and we cannot send you anything. Turning the reminder off, or revoking permission in system Settings, stops it. If permission has been refused, the app tells you so instead of pretending the reminder is set.

10. Other privacy points

• No account, sign-in, email address or profile.
• The current app has no access to your location, contacts, photos, microphone or camera, and asks only for notification permission when you enable reminders.

11. This website

At present these pages are plain static files. They set no cookies, store nothing in your browser, and load their assets from the Kevser site itself. The only third-party addresses on the site are the ones you can see and choose to click. As with any website, Cloudflare hosts these files and processes standard connection metadata (such as IP address, page requested and time) for delivery, security, and operation.

12. Children

Kevser is a general-audience app and is not directed to children. It has no account, advertising SDK, or messaging feature, and notes and other user-created Quran content remain on the device.

13. Your rights

Depending on where you live and the circumstances, privacy law may give you rights to access, correct, erase, or receive a portable copy of personal data; restrict or object to processing; and withdraw consent where processing is based on consent. Exercising a right does not affect processing already lawfully completed. We do not discriminate against you for making a privacy request.

We create no account or user profile and do not receive your notes, marks, Quran searches, in-app selections, reading history, or settings. Cloudflare and the content providers process the limited connection metadata described in section 4 when you use a network feature. In practical terms:

• Access, correction or portability. User-created app content is on your device, in the app itself. We cannot retrieve or correct it remotely.
• Deletion. Deleting Kevser from the device removes your notes, marks, progress, settings and device-cached files from that device. Anything held in the shared cache is provider content, is not tied to you or your device, and expires by itself. Existing device backups are handled by Apple under its own privacy policy and retention settings.
• Restriction or objection. You may object to processing based on legitimate interests or ask that qualifying processing be restricted. You can also avoid new online content requests while continuing to use the app's offline features.
• Complaints. In the Netherlands, you may complain to the Autoriteit Persoonsgegevens. You may instead contact the supervisory authority where you live or work, or where you believe an infringement occurred.

If you believe we hold something about you, write to us. We normally answer within one month. We may ask only for the information reasonably needed to verify the request and may extend the period where the law permits for a complex or numerous request.

14. Changes to this policy

If the app's behaviour changes — a new content source, advertising, analytics, a sync feature, or anything else that moves data — this page will be updated before or alongside that release, and the date at the top will change. Material changes will also be described in the app's App Store or Google Play release notes.

15. Contact

We aim to answer privacy-related inquiries within 30 days.

admin@missinglayer.com
MissingLayer B.V.
Korte Lijnbaanssteeg 1
4570
1012 SL Amsterdam
Netherlands