Privacy Policy and Privacy Notice

1. Data controller

The data controller (in GDPR terms, the controller) is Oğuz Mete YELTEN. Halal Phone is developed and offered not by a company but by an individual living in Türkiye. “We” in this text means that person.

• Name: Oğuz Mete YELTEN
• Address: Büyükçekmece, İstanbul
• Email: support@halalphone.app
• Representative: none. No data controller’s representative has been appointed in Türkiye. We also have no representative established in the European Union or the United Kingdom; if one is appointed, their name and contact details will be published in this section. Until then you can reach us directly, from any country, at the addresses above.
• Data Controllers’ Registry (VERBİS): under the Personal Data Protection Board’s registration exemption decisions, we are not required to register with the Registry. The exemption does not lift the KVKK’s other duties (informing you, security, answering requests).

2. Data that stays on your phone

All the data the app needs to work is kept on your phone, in the app’s own storage. We have no server; we cannot see this data and the app does not send it to us or to any other server. So we do not process this data; the app processes it for you, on your phone. We still list it here so you know what there is.

• Location and prayer times. To calculate prayer times. On Android you choose one of two ways: get your location once with permission, or type latitude and longitude yourself. The iPhone version also lets you pick a city from a list. The location is stored rounded to about 1 km; times are calculated on the phone. No address or city name is derived from the location (that would require sending it to a server). The app does not ask for background location. On Android only approximate location permission is requested. On iPhone, if “device location” is selected, the app refreshes the location each time it opens, at most once every 6 hours.
• Reading. The verse where you left off, reading time, number of verses read, the days you read (streak), the “I gave up” count, and the time you unlocked by reading.
• Prayer marks. The prayers you marked “Prayed” or for which you chose “Lift the lock for this prayer”, and the week board.
• Detailed statistics archive. A short summary for each day (verses, gave-ups, unlocked time, marked prayers). It is kept on the phone whether or not you buy Premium; Premium only lets you see it. It is not deleted when a subscription ends.
• Lock settings. The apps you lock, never-locked apps, the lock state, the usage time you earned. On Android the package names of the apps you choose (e.g. com.instagram.android) are stored on the phone. On iPhone, Apple does not even show the app the names of the apps you choose; the choice is kept as Apple’s encrypted, device-specific tokens.
• Settings. Preferences such as theme, text size, Arabic font and prayer-time calculation method.
• Premium status. The last verified purchase status, so Premium stays on without internet.
• Diagnostics log. A technical log showing when and why the lock engaged (at most 128 KB; older entries are deleted as it fills). Details in section 8.

How long

• Daily counts and prayer marks on the Today screen: up to 60 days (on iPhone, reading details 30 days).
• Detailed statistics archive: about 3 years.
• The list of days you read (for the streak): until you delete it.
• Past entries in the lock state: 2 days.
• Everything else: until you change it or delete the app.

To delete all of it, just delete the app: when the app is deleted, this data on your phone is deleted too. For the copy in your phone’s backup, see below.

Your phone’s backups

Android: if backup is on in your phone’s settings, Android includes your reading history and where you left off, marked prayers, statistics and display settings in the backup in your Google account and in phone-to-phone transfer, so they come back when you reinstall the app or change phones. Never included: the lock state (the apps you chose, location and calculation method, time earned by reading, emergency exit, waiting periods), the diagnostics log and the purchase cache. The Android operating system makes this backup to your Google account; we cannot access it. According to Google, on Android 9 and later, on phones with a screen lock, this backup is encrypted with your screen lock. You can turn backup off in your phone’s settings and delete it from your Google account.

iPhone: if iCloud Backup or backup to a computer is on, iOS includes this app’s data in your phone’s backup, as it does for other apps. The backup is in your Apple account or on your computer; we cannot see it.

3. Permissions and the accessibility service

Android: accessibility service

On Android, the accessibility service is the reliable way to open the lock screen over another app. Halal Phone uses this service only for the lock. The service is not declared as an assistive tool for users with disabilities.

• What it sees: only the package name of the app that comes on screen. The service asks Android only for the “foreground window changed” event.
• What it does not see: the content of your screen (window content access is off in the service settings), what you type, your passwords, messages or notifications. It does not capture touches or keys and does not perform gestures for you.
• What it does: when a locked app opens, it opens the lock screen on top of it. If the locked app gets in front of the lock screen, it takes you to the home screen and opens the lock screen again. It measures the time spent in locked apps, on the phone.
• Where it goes: nowhere. The decision is made on the phone. App names may be written to the diagnostics log on the phone; when the log is shared they are turned into a short code.
• Your choice: before you turn the service on, the app explains what it sees and does not see and asks for your agreement. You can turn it off at any time in Settings › Accessibility; the lock stops when you do.

Android: other permissions

• Approximate location: for prayer times, only while the app is open and only once. Precise location is not requested.
• Notifications: to tell you if the lock stops (e.g. the service was turned off). Notifications are created on the phone.
• Start at boot: to set up lock monitoring again when the phone restarts.
• Internet and Google Play billing: only for Premium purchases.
• App list: apps on the phone are listed on the phone so you can choose which to lock and so that apps like phone, messages and maps are never locked. This list is not sent anywhere.

Not used: the advertising ID (the permission was removed from the app), usage-stats access, drawing over other apps, precise location, background location.

iPhone: Screen Time permission

The app asks for Apple’s Screen Time (Family Controls) permission only on this phone, for your own use. Apple turns the apps you choose into encrypted tokens; Halal Phone cannot see by name which apps you chose. iOS measures the time spent in locked apps; the app only receives a “time is up” signal. You can remove the permission at any time in Settings › Screen Time.

iPhone: other permissions

• Location (only while using the app): for prayer times. If you do not allow it, you can pick a city or type the location yourself.
• Notifications: for reminders such as the switch to reading and refreshing prayer times. Notifications are scheduled on the phone; none are sent from a server.

4. Data about religious belief

Your prayer marks and Qur’an reading records can say something about your religious belief. The KVKK (Art. 6) and the GDPR (Art. 9) treat such data as a special category and protect it further.

That is why we do not collect this data at all. It stays on your phone; it is not sent to us, to RevenueCat or to any other service (if Android backup is on, it goes only into the backup in your own Google account; section 2).

Three things you should know:

• Being on the waitlist may indicate an interest in religious matters. So we add you only with your explicit consent, and we treat that consent as also covering special-category data (KVKK Art. 6(3)(a); GDPR Art. 9(2)(a)). The consent text says so plainly.
• Your Premium purchase record belongs to Halal Phone, which may also indirectly indicate an interest in religion. The record contains no name, email or information about your belief; only a random ID and purchase details (section 5). We use it only to verify the purchase; we do not use it to draw conclusions about your belief, to build a profile or for advertising. Apple and Google also know that you downloaded the app.
• If you share the diagnostics log yourself, it contains prayer-lock events (e.g. that a prayer was closed with “Prayed” or “Lift for this prayer”); the report also states the app version, Android version and phone model. The log leaves the phone only if you send it; if you send it to us, we use it only to fix the problem.

5. Premium purchases

This is the only time the app goes online. Google (Google Play), or Apple (App Store) on iPhone, takes the payment. Your card and payment details never reach us or RevenueCat. Google and Apple process that data under their own privacy policies, as their own responsibility.

To verify purchases we use a subscription service called RevenueCat, Inc. (US). RevenueCat processes this data on our behalf, as a data processor.

Sent to RevenueCat on Android

• A randomly generated, anonymous user ID.
• Your Google Play purchases in this app: product, purchase token, date, renewals, refunds.
• Android version, device model and brand, preferred languages, app version and package name, Google Play country and currency.
• Your IP address during the connection.
• The advertising ID is not collected.
• If you bought Premium, the RevenueCat software also writes the anonymous ID to Block Store in your Google account (end-to-end encrypted), so a new phone can find your purchase. We cannot see or delete this copy.

Sent to RevenueCat on iPhone (once released)

• A randomly generated, anonymous user ID.
• Your App Store purchases in this app: which plan, when, renewals, transaction IDs.
• App and iOS version, device model, preferred languages, App Store country and currency.
• The identifier for vendor (IDFV) that Apple gives this app on your device. This is not the advertising identifier (IDFA).
• Your IP address during the connection.

Not sent

Your location, reading, prayer marks, statistics and app choices are not sent to RevenueCat or anywhere else. No name, email or account is asked for.

Why, and on what legal basis

To verify the purchase, turn Premium on, see changes such as renewals, refunds and family approval, and restore the purchase on a new phone. Legal basis: entering into and performing the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)). RevenueCat also shows us sales summaries that are not linked to a person (e.g. how many subscriptions there are); we use these to run the business (legitimate interest, KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). We do not use them for advertising or tracking.

If you have never opened the Premium screen, never tapped “Restore purchases” and have no purchase, the app never connects to RevenueCat. Once you have, it connects when the app opens, to see renewals and refunds.

Sales reports we receive from Google

Google Play gives us sales and payout reports: order number, product, date, price, tax and, to the extent Google shows it in the report, the buyer’s country and region or postal code. These reports do not contain your name or email. We keep them for our tax and accounting obligations (legal obligation, KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).

6. The waitlist

• What is collected: your email address, the language of the page where you filled in the form (Turkish, English, Arabic, German, French or Indonesian), the moment you ticked the consent box, and the version of the consent text in force at that moment. Your IP address and browser details are not stored in this list. The form has an empty field people do not see, to filter out bots.
• What for: only to send you one email announcing the launch when Halal Phone is released. That email is a promotional message (a commercial electronic message in the terms of Türkiye’s Law No. 6563). We do not use your address for any other purpose, sell it, or share it with anyone for advertising.
• Legal basis: your explicit consent (KVKK Art. 5(1); because being on the list may indicate an interest in religion, also KVKK Art. 6(3)(a) and GDPR Art. 6(1)(a) with Art. 9(2)(a)) and your consent to commercial electronic messages (Law No. 6563, Art. 6). The consent box is not pre-ticked; the form is not sent unless you tick it.
• Who can join: only people over 18.
• Withdrawing consent: at any time, without giving a reason: write to support@halalphone.app or use the link in the announcement email. We remove your address from the list within three business days at the latest. Withdrawing consent does not affect the lawfulness of processing before it.
• Where: Supabase (Supabase, Inc., a US company), in the European Union: Germany, Frankfurt region. The server function that receives the sign-up runs in the same region. Supabase stores the address on our behalf, as a data processor.
• How long: 12 months after the app’s first release (the first public version on Google Play), we delete the whole list. If you ask, or withdraw your consent, we delete your address straight away.
• How it is collected: through the form on this site, electronically.

Against abuse

So that too many sign-ups cannot come from the same place in a short time, we do not keep your IP address itself but a one-way hash of it, hashed once more with a random key that changes every day. We keep this hash for at most one hour and then delete it; the key is deleted the next day. We use the hash for nothing but this count and never link it to your email address. Legal basis: legitimate interest in the security of the form and the list (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Supabase’s own logs and backups

To operate the service and keep it secure, Supabase keeps technical details of requests (IP address, browser details, time) in its own system logs. According to the periods Supabase publishes, these logs are kept for 1 day (free plan), 7 days (Pro) or 28 days (Team), depending on the plan we use. Our function does not write email addresses or IP addresses to these logs. On the free plan no database backups are taken; if we move to a paid plan, daily backups are kept for 7 or 14 days and a deleted address disappears from the backups when that period ends.

Waitlist consent text

By ticking the box on the waitlist form, you accept the following text:

I am over 18. I give my explicit consent to Oğuz Mete YELTEN keeping my email address in order to send me a single announcement email when Halal Phone launches, and I agree to receive this commercial email. I understand that being on this list may indicate an interest in religion. I can withdraw my consent at any time by writing to support@halalphone.app or using the link in the email.

7. This site

This site uses no cookies; there is no analytics, tracking or third-party script. Fonts are loaded from the site itself. The waitlist form sends no request anywhere until you submit it.

The site is hosted on the infrastructure of Cloudflare, Inc. (US); the domain is also registered with Cloudflare. When you open a page, your browser connects to Cloudflare’s servers; Cloudflare processes your IP address, browser details, the requested address and the time in order to serve the page, block attacks and run its network. Cloudflare processes this data on our behalf. Cloudflare does not publish a specific retention period for these logs; under its own privacy policy it keeps them for a period “consistent with the business purposes” and legal requirements (cloudflare.com/privacypolicy). We do not receive or keep visitor logs from Cloudflare.

Legal basis: legitimate interest in serving the site and keeping it secure (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). How it is collected: automatically and electronically, when you open the site.

8. If you write to us, and the diagnostics log

Emails you send to support@halalphone.app and destek@halalphone.app are forwarded by Cloudflare’s email forwarding service (Cloudflare Email Routing) to the data controller’s personal mailbox. Cloudflare says it does not store the content of emails in this service; your email is stored with the email provider that hosts that mailbox (this provider may be abroad; section 10).

We use your email address and what you write only to answer you and carry out your request. Legal basis: legitimate interest in solving problems and giving support (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); for requests under the KVKK or GDPR, legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)). Retention: 2 years from the last message; then we delete it.

The diagnostics log stays on the phone and is not sent automatically. To help us solve a problem you can share it from Settings; it then goes wherever you choose in the share sheet (e.g. email). It contains: date and time, which part of the app ran, lock decisions, prayer-lock events (e.g. “prayed”, “lifted”), app version, Android version, phone model. Before sharing, location coordinates are removed and app names are removed or turned into a short code. A log you send us is kept for the same period as the correspondence.

9. Who we transfer data to, and why

• RevenueCat, Inc. (US): verifying purchases; on our behalf, as a data processor.
• Supabase, Inc. (US company; data in Germany): storing the waitlist; on our behalf, as a data processor.
• Cloudflare, Inc. (US): hosting and serving the site, forwarding support emails; on our behalf, as a data processor.
• Our email provider: the mailbox where support emails are stored; on our behalf.
• Google and Apple: distribute the app, take the payment and keep their own purchase records; as their own responsibility, as independent controllers. We do not send this data to Google or Apple; you give it to them when you use their store.
• Competent public authorities and courts: only if a law or a decision of a competent authority requires it (KVKK Art. 8(2)(a) and Art. 5(2)(ç)).

We do not sell personal data, and we do not share it with anyone for advertising or behavioural advertising.

10. Transfers abroad

Some of the services above are outside Türkiye. Under Article 9 of the KVKK, as long as the Personal Data Protection Board has not issued an adequacy decision for these countries, data may be transferred abroad only with one of the appropriate safeguards listed in the Law. The safeguard we rely on is the standard contract announced by the Board (KVKK Art. 9(4)(c)): it is signed with each recipient without changes to the Board’s text and notified to the Board within five business days of signature. Status:

• RevenueCat, Inc. (US), purchase record: the standard contract has not been signed yet; until it is signed and notified to the Board, this transfer does not rest on the safeguard required by Article 9 of the KVKK.
• Supabase, Inc. (data in Germany, company in the US), waitlist: the standard contract has not been signed yet; until it is signed and notified to the Board, this transfer does not rest on the safeguard required by Article 9 of the KVKK.
• Cloudflare, Inc. (US and servers worldwide), site and email forwarding: the standard contract has not been signed yet; until it is signed and notified to the Board, this transfer does not rest on the safeguard required by Article 9 of the KVKK.

We do not send data to Google or Apple; you give it to them directly when you use their stores. So that flow is not a transfer made by us.

For users in the European Union and the United Kingdom (GDPR and UK GDPR): the data processing agreements of RevenueCat, Supabase and Cloudflare, which form part of their terms of service, include the European Commission’s standard contractual clauses (2021/914) with the UK addendum. At Supabase the data stays in Frankfurt; access from outside the EU by Supabase, Inc. for support and maintenance is subject to the same clauses.

If you ask, we will give you a copy of these contracts, with trade secrets removed.

11. Summary: purpose, legal basis, collection method, retention

• Verifying Premium purchases: entering into and performing the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)). Automatically, through the RevenueCat software in the app. For as long as the subscription lasts; for a lifetime purchase, for as long as the app is offered on Google Play; straight away if you ask us to delete it (if you restore later, a new record is created). When the service ends, the RevenueCat record is deleted; it disappears from RevenueCat’s backups within RevenueCat’s own period.
• Sales summaries not linked to a person: legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Google Play sales reports: legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)). For the period set by tax law (Tax Procedure Law Art. 253: 5 years starting from the year after the year concerned).
• Waitlist and launch announcement: explicit consent (KVKK Art. 5(1) and 6(3)(a); GDPR Art. 6(1)(a) and 9(2)(a)) and consent to commercial electronic messages (Law No. 6563, Art. 6). Through the form on the site. Deleted 12 months after the first release, or straight away on request.
• Security of the form (IP hash): legitimate interest. At most one hour.
• Serving and securing the site: legitimate interest. The period in Cloudflare’s own policy.
• Support correspondence: legitimate interest; legal obligation for KVKK and GDPR requests. By email. 2 years from the last message.

Data that stays on your phone is not transferred to us; we have no access to it.

We do not make automated decisions or build profiles.

You are not obliged to give us any data: you can use the whole free part of the app without buying Premium and without joining the waitlist. Premium needs the purchase record; without it the purchase cannot be verified.

12. Your rights and how to apply

Data that stays on your phone is already in your hands: you can see and change it in the app and delete it completely by deleting the app. The rights below apply to the data we and the services working for us hold (purchase record, waitlist, correspondence).

Türkiye (KVKK Art. 11)

To learn whether your data is processed and, if so, to request information about it; to learn the purpose and whether it is used for that purpose; to know the persons it is transferred to in Türkiye or abroad; to ask for it to be corrected if incomplete or wrong, and to be deleted or destroyed if the reasons for processing no longer exist; to ask for these actions to be notified to the persons it was transferred to; to object to a result against you that arises solely from analysis by automated systems; and to claim compensation if you suffer damage because of unlawful processing.

European Union and United Kingdom (GDPR, UK GDPR)

Access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent. Withdrawing consent does not affect the lawfulness of earlier processing.

United States

The California Consumer Privacy Act (CCPA/CPRA) and similar state laws do not apply to us because we are below their size thresholds. Even so, wherever you live, we answer requests to know, correct and delete the data we hold about you as described in this section. We do not sell your data or share it for behavioural advertising.

How to apply

• In writing: to Oğuz Mete YELTEN, Büyükçekmece, İstanbul; or with an application signed with a secure electronic signature or mobile signature, to destek@halalphone.app (KVKK Art. 13; Communiqué on the Procedures and Principles of Application to the Data Controller, Art. 5).
• By email: support@halalphone.app. We accept applications sent this way from the address on the waitlist or the address you wrote to us from before; we do not reject email applications from other addresses either, but we may ask for more information to confirm the data is yours.
• In your application, give your name and surname, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and passport or ID number), your postal address or email, and what you are asking for.
• For your purchase record, give the order number from your Google Play (or Apple) receipt. Because we keep no accounts, we may not be able to find your record any other way.
• We conclude your application free of charge within 30 days at the latest (KVKK Art. 13(2)). For applications under the GDPR, the period is also one month. If the action involves a separate cost, we will not ask for more than the tariff set by the Board.
• For your data at Google and Apple you need to apply to them directly.

Complaints

If your application is rejected, you find our answer insufficient or we do not answer within 30 days, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application (KVKK Art. 14; kvkk.gov.tr). If you live in the EU you can complain to the data protection authority in your country; in the United Kingdom, to the Information Commissioner’s Office (ICO).

13. Children

The app is for ages 13 and up; it is not directed at children under 13. There is no account and no age question; whoever uses it, data on the phone stays on the phone.

The only flow that leaves the phone is purchases. Google (family approval) and Apple (Ask to Buy) let parents approve purchases by under-18s. We do not knowingly collect personal data from children under 13; if you tell us about such data (e.g. with an order number), we delete it.

The waitlist is only for people over 18. If we learn that someone under 18 has joined, we delete their address.

14. Security and data breaches

Data on the phone is protected by your phone’s own protection (screen lock and device encryption); the app does not encrypt it separately. Keeping your phone locked protects this data.

Purchase, waitlist and site connections are encrypted (HTTPS). Only our own server function can add to the waitlist; no one can read, change or delete the list from outside. If we export the waitlist for the launch announcement, we delete the file as soon as the announcement has been sent.

No method is perfect. If your data is obtained by unauthorised persons, we will notify the Personal Data Protection Board and the people affected as soon as possible (KVKK Art. 12(5); the Board expects notification to it within 72 hours). For people covered by the GDPR we will also act under GDPR Articles 33 and 34.

15. Changes

If the app starts processing new data or a data flow changes, this text is updated first. We announce important changes in the app or on the site. If a new purpose arises for the waitlist, we will ask for your explicit consent again; unless you agree, we will not use your address for the new purpose. The dates are at the top of the page.

16. Contact

Oğuz Mete YELTEN, Büyükçekmece, İstanbul, support@halalphone.app.