Privacy Policy

for the Vakat iPhone app · Last updated: 29 October 2026

1. Data controller

Please send questions about privacy and requests about your rights to this address. More details are in the legal notice (Impressum, in German).

2. What stays on your phone

Vakat stores the following only on your device. It is not sent to us, and we have no access to it:

• your prayer log: logged prayers, pauses and your streak
• the days you fasted in Ramadan
• “Learn to pray”: your progress and the school of thought (madhhab) you chose
• saved verses
• your name (optional), your goal, your city, the calculation method, reminders, alarms and other settings

Prayers, pauses (for example during your period, illness or travel), fasting and your school of thought can reveal something about your religion and your health. The GDPR counts such information among the special categories of personal data (Art. 9 GDPR). That is why it does not leave your device. The only exception is your light in the Circle, if you use it (section 4).

In “Me” → “Delete all prayer data” you remove all logged prayers, pauses and your streak. When you delete Vakat, iOS deletes the app’s data on your device. Only the Circle’s anonymous ID stays in the keychain, if you used the Circle (section 4.5).

If you use iCloud Backup or back up your iPhone to a computer, iOS includes this data in the backup, as it does for every app. We have no access to it.

3. Location and Apple Maps

Vakat calculates prayer times on your device from the city you choose. City, coordinates and time zone stay on your device.

• Use my location: iOS asks for your permission first, only for while you are using Vakat. Vakat determines your location once and asks Apple Maps which place it is; for this, the position is sent to Apple. Otherwise Vakat does not request your location, not in the background either; the only exception is the Qibla compass (below). Vakat only asks for your approximate location; prayer times and the compass need no more.
• City search: What you type into the search is sent to Apple so that suggestions appear. During setup, Vakat also searches Apple Maps for the city of your time zone (for “Europe/Paris”, Paris) to suggest it to you.
• Mosques nearby: Vakat sends the area around your city (about 20 kilometres) and the word “mosque” to Apple Maps.
• Qibla compass: Vakat calculates the direction from your city and turns it with your device’s compass. If you allowed location access, the compass uses your approximate location while it is open, to find true north. Nothing is sent or stored.

Apple processes these requests under its own privacy policy. We receive nothing from it. The legal basis is the feature you use (Art. 6(1)(b) GDPR).

4. The Circle

4.1 Optional, and only with your consent

In the Circle, you see whose light is lit for Fajr today. The Circle is optional. Before anything is shared, Vakat asks for your explicit consent, because a prayer circle reveals something about your faith (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Until then, Vakat does not connect to the server; Firebase is not even started before that. Vakat stores when you consented only on your device. Without the Circle, everything else in Vakat works just the same.

4.2 What is stored

About you:

• your name in the Circle: your choice, up to 20 characters, a nickname is enough
• your light: if you logged the Circle’s prayer, Vakat stores until when your light is lit, namely until the next Fajr, rounded down to the full hour (field litUntil). Otherwise the field is empty. Whether you prayed on time or made it up later is not stored there.
• the code you joined with, and when you joined
• an anonymous ID (Firebase user ID), without a name, email address or phone number

About the Circle: its name (“Fajr Circle”), the Circle’s prayer, a challenge if one was chosen (30 or 40 days and the start day), the invitation code, when it was started, who started it and who belongs to it, each as an anonymous ID.

Nudges (“… is thinking of you at Fajr”): from whom, to whom, on which day and when.

Never shared: your prayer log, other prayers, pauses, missed prayers, fasting, your city and your location. “Not logged”, “no” and “Paused” look the same in the Circle: the light is off.

4.3 Who sees it, and why

This information is used only to make the Circle work. Only the members of your Circle can see it (up to 8 people). Nudges are seen only by the sender and the recipient. Whoever started the Circle can remove people and disband the Circle.

4.4 Provider and storage location

The Circle runs on Firebase by Google. Google processes the data on our behalf as a processor; the Firebase Data Processing and Security Terms apply.

• The Circle data is stored in Cloud Firestore in Frankfurt am Main, Germany (region europe-west3). Vakat talks to Firestore directly over its encrypted interface (HTTPS).
• For the anonymous sign-in, Vakat uses Firebase Authentication. This service runs only in data centres in the US. In the process, Google also processes your IP address and device information (user agent) to prevent abuse, and keeps IP addresses for a few weeks. The transfer to the US is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which Google is certified.
• Vakat does not use Firebase Analytics, Crashlytics or Cloud Messaging. Firebase’s automatic data collection is turned off.

More from Google: Privacy and security in Firebase.

4.5 Leaving and deleting

You find everything in the Circle under “More”:

• Leave Circle deletes your entry in the Circle (name, light, code and when you joined) and your nudges. If you are the last person to leave, the Circle is disbanded. If you started the Circle and leave, the member who has been in it the longest takes over.
• Disband Circle (only whoever started it) deletes the Circle for everyone, with all names, lights and the code.
• Remove from Circle (under “Members”, only whoever started it) deletes that person’s entry.
• Withdraw consent: you leave the Circle, Vakat deletes your anonymous ID at Firebase and forgets your consent. After that, nothing more is sent to the server.
• Nudges are deleted by Vakat as soon as you dismiss them, otherwise after one to two days, when either of you opens the Circle again.

Firebase keeps your anonymous ID until you withdraw your consent. If you delete Vakat without leaving the Circle, your name stays in the Circle; your light goes out by itself. Your name stays until the Circle is disbanded or the person who started it removes you. The ID stays in your device’s keychain: if you reinstall Vakat and consent again, you find your Circle again and can leave it. Or write to us and we will delete your entry. To do so, tell us your name in the Circle and the code.

4.6 Hiding and reporting

Long-press a name in the Circle: Hide name no longer shows that name and its nudges on your device; which names you hide is stored only on your device. Report opens an e-mail to us with that name and the Circle code; you decide whether to send it. We use it only to look into the report and to reply to you (Art. 6(1)(f) GDPR), and delete it once the matter is settled.

5. App Lock (Screen Time)

App Lock uses Apple’s Screen Time, for yourself. You choose which apps are locked in a window provided by Apple. Vakat only receives placeholders (tokens) for this and does not learn which apps or websites you choose or how long you use them.

So that the lock knows when to let you back in, Vakat keeps the following in a shared storage area on your device (App Group): your lock settings, which prayers of the days around today are logged, whether you have just postponed the lock, and whether a pause is on. Only Vakat and its extensions read this storage. Your prayer log is not in it, and none of it leaves your device.

6. Widgets, Live Activity, Siri and Control Center

Widgets, the Live Activity, Siri and Shortcuts, and the button in Control Center run on your device. From the shared storage they read only what they need to display: city, calculation method, your time adjustments, the language and whether the current prayer is already logged or a pause is on. If you log a prayer there, it is noted in the shared storage, and Vakat adds it to your prayer log the next time you open the app. Vakat updates the Live Activity only on the device, without a push server. If you use Siri, Apple processes your voice requests under its own terms.

7. Notifications, alarms, photos and sharing

• Reminders and the Fajr alarm are local iOS notifications and alarms. They are scheduled on your device, without a server. This also applies to the reminder before your free trial ends.
• Photos: Vakat only asks for permission to add photos, so that you can save cards and verses as images or videos to your Photos. Vakat cannot see your photos.
• Sharing: Vakat only passes on a weekly card, a verse or an invitation to the Circle when you tap “Share” yourself. You choose what is on it and who gets it. The app you share with processes it under its own rules.

8. Purchases and subscriptions

You buy Vakat Plus in the App Store. Apple handles the payment; Vakat never sees your payment details. Through StoreKit, Vakat learns on your device whether and which subscription is active, whether the free trial is running and when it renews. This decides whether Vakat Plus is open. The legal basis is the subscription contract (Art. 6(1)(b) GDPR); for purchase and payment, Apple’s privacy policy applies.

Subscription statistics with RevenueCat: So that we can see how many subscriptions and trials there are, Vakat uses the service RevenueCat (RevenueCat, Inc., USA). For this, your device gets a random ID without a name or email address. RevenueCat receives:

• your App Store purchases and subscriptions: product, price and currency, dates, trial, renewal, cancellation and refund
• the country of your App Store, device model, iOS and app version, and your IP address

Apple also reports renewals, cancellations and refunds to RevenueCat directly (App Store Server Notifications), including for subscriptions that started before RevenueCat was added. RevenueCat never receives your prayers, pauses, your location, the Circle or the advertising ID; Vakat sets no further attributes in RevenueCat. RevenueCat processes the data on our behalf in the USA; the transfer is safeguarded by standard contractual clauses. We keep purchase data as long as needed for the statistics and for tax obligations. The legal basis is our legitimate interest in evaluating our subscriptions (Art. 6(1)(f) GDPR). You can object at any time by email (section 11). RevenueCat’s privacy policy also applies.

9. What Apple shares with us

In App Store Connect, Apple shows us aggregated figures, for example on downloads and purchases, without names or contact details. We only receive crash reports and usage statistics if you turned on “Share With App Developers” in the iOS settings. These do not tell us who you are either. We use them only to find and fix bugs (Art. 6(1)(f) GDPR).

10. This website

This page is hosted on GitHub Pages (GitHub, Inc., USA). When you open it, GitHub stores your IP address for security reasons. The legal basis is our legitimate interest in providing the page securely (Art. 6(1)(f) GDPR). GitHub is certified under the EU-US Data Privacy Framework; more in GitHub’s privacy statement. The page sets no cookies, loads no fonts or scripts from other servers and does not count visits.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw your consent at any time with effect for the future; for the Circle, directly in the app with “Withdraw consent”. Most data is only on your device, where you can view and delete it yourself. For anything else, write to david.zwirtmayr@dopaminedept.org.

You can lodge a complaint with a data protection supervisory authority, for example in the country where you live. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

You do not have to give Vakat any personal data; without the Circle, the app works fully. There is no automated decision-making and no profiling.

12. Changes

If Vakat changes in a way that processes different data, we will update this policy. The current version is always here. Should the Circle ever share more than it does today, Vakat will ask for your consent again first.

This is a translation. If the two versions differ, the German version applies.