Privacy Policy

Who runs it

derhatır is run by Kadir Esen. There is no separate company name; the same person is responsible.

• Operator: Kadir Esen
• Privacy and data requests: [email protected]
• Site: https://derhatir.com
• iOS and Android bundle ID: com.derhatir.app

What we do not collect

We do not ask for the following, we do not take them through device permissions, and we do not give them to ad networks or data brokers.

• Account, membership, username or password
• Payment, card, billing address
• Location (approximate or precise)
• Contacts, address book, calendar
• Camera, microphone, photo library
• Advertising ID, ad profile, or cross-app tracking
• Your memorization map, ayah text and backup file; those never go to a server

What stays on your device

The actual product data lives in the browser's or the app's own storage. It is not uploaded, not backed up on our side, and not tied to an account. From Settings you can download a single-file backup, restore one, or delete everything.

• Memorization map, page and ayah revision history (derhatir:v1)
• Theme (light or dark)
• Mushaf font and text size
• Last open page in talim

To erase it, use Reset in Settings or clear this site's data in your browser. Uninstalling the iOS or Android app also deletes this local record.

Contact form

This exists only if you submit the form on the marketing site. No account is created. If you never use the form, this category stays empty.

• Collected: name, email, message text
• Purpose: to reply to you
• Transfer: email via Shipmail to [email protected]
• Basis: you send the form
• Retention: for as long as the correspondence needs; write if you want it deleted

Usage analytics

PostHog is used so we can see which screens break. This is not advertising measurement. It is not tied to a name.

• Collected: page path; completed steps (setup, reading, practice, hatim page, read together, backup) and their counts (duration, number of questions, number of ayahs unveiled); language; platform (iOS, Android or web); browser or WebView info; approximate location derived from the IP address (country, city); PostHog's anonymous distinct ID
• Not collected: memorization record, ayah text, backup file, contact-form content
• Purpose: see errors and usage, repair the product
• Processor: PostHog (posthog.com)
• To clear it: deleting site data in the browser clears the ID; uninstalling the native app does the same

Bot protection and infrastructure

The site is served through Cloudflare. The contact form also uses Cloudflare Turnstile to stop automated submissions.

• Cloudflare (CDN): typically IP address, user-agent, time on each request. Your memorization content is not processed here as product data.
• Turnstile: a short bot check when you submit the form. The check goes to Cloudflare; your memorization data does not.
• Server access logs: kept for the short time needed to run the service and stop abuse (IP, path, time).

Listening together

When you share a room code, reader and listener mark the same page. This is not an account and not a stored chat.

• Transferred: room code, page number, tapped ayah marks
• Storage: the room lives in memory only; no permanent database
• Duration: when the room goes idle or the session ends, nothing is kept
• No account; anyone with the code can join

iOS and Android

The store apps open derhatir.com in a WebView on your device. There is no separate native account, no separate memorization server, and no ad SDK.

• The same policy covers the site and the app
• Bundle ID: com.derhatir.app
• Status bar, keyboard and splash screen are display only; they do not collect data
• Camera, microphone, location, contacts and photos are not requested
• Uninstalling the app also deletes the local memorization record

Cookies and local storage

There are no advertising cookies. Storage we use:

• NEXT_LOCALE cookie: the interface language you chose (tr, en, ar). Remembered across visits, not sold.
• localStorage: your memorization and display preferences, only on your device
• PostHog's own storage: anonymous analytics ID

Processors

No sale of data, no ad network. These processors run the service. Each one sees only what its line says.

• PostHog: usage analytics. Page path, interface event, anonymous ID, browser info.
• Cloudflare: delivery, DDoS and Turnstile. IP, user-agent, bot check.
• Shipmail: contact email. Name, email, message.
• Hosting server: page responses and short access logs. No memorization database.

Sharing and sale

We do not sell, rent, or share personal data with an ad network. We do not give it to anyone beyond the processors above unless the law requires it (for example a court order). There is no cross-app advertising tracking.

How long we keep it

The memorization record on your device stays until you delete it, uninstall the app, or clear browser data. Contact messages stay in the mailbox for as long as the correspondence needs; write to [email protected] to have one removed. A listening room drops from memory when the session ends. The analytics ID drops when site or app data is cleared. Server access logs are short-lived.

Security

The site is served over HTTPS. Because the memorization record does not sit on our server, it cannot leak from there; who can open your device storage or backup file is up to you. Contact email travels through Shipmail and the mailbox. We do not promise perfect security; we take reasonable technical measures.

What you can do

Depending on where you are, you may have rights to access, correct, delete, port, or object. In this product that means:

• On-device data: export or reset from Settings
• Contact-form record: write to [email protected] and ask for deletion
• Analytics ID: clear site data or uninstall the app
• Reply: data requests are answered from the same email

Children

derhatır is not directed at children, and we do not knowingly collect personal data from anyone under 13. If we learn we received data from someone under 13, we delete it. If a parent uses the contact form on a child's behalf, that message is still processed only to reply.

Changes

If this text changes, the date at the top is updated. A material change (a new processor, a new data type, a sale, or advertising) will be visible on this page. Store apps use the same URL.