Privacy Policy

1. Overview and Architecture

QuranAI ("we", "our", or "the App") is an iOS application developed by Shamil Rakhimov (Bundle Identifier: dev.rakhimov.QuranAI). The App provides Quranic reading, localized translations, full-text search, and an AI-powered conversational assistant to help answer questions grounded in authentic Islamic sources.

We adhere to a strict privacy by design philosophy. The core reading and search functionality functions 100% offline. Remote data processing occurs solely when you interact with the AI Chat or manage your subscription.

2. What We Do NOT Collect

QuranAI is built to protect your anonymity. We do not collect or access:

• Personal Identity & Registration: We have no sign-up or login. We never ask for and never collect your real name, email address, phone number, postal address, contacts, or photos.
• Geolocation: We do not request, track, or access your device's physical or GPS location.
• Device Hardware Access: We do not access your camera, microphone, photo library, or local file system outside the application sandbox.
• Advertising Identifiers & Cross-App Tracking: We do not use the Identifier for Advertisers (IDFA), advertising frameworks, or cross-app tracking mechanisms (NSPrivacyTracking = false).
• Sale of Personal Data: We never sell, rent, lease, or monetize your personal information to third parties.

3. Local On-Device Data Storage

The following data remains strictly on your local device within the secure iOS application sandbox:

• Quran Text and Translations: The complete Arabic Quran text and translation editions are bundled within an offline SQLite database (quran.sqlite). Reading and full-text search execute locally without network requests.
• Reading Settings: Selected translation language, chosen translator edition, font sizes, and visibility toggles are stored locally in UserDefaults (under Apple's Required Reason API reason CA92.1).
• Bookmarks and Local Cache: Ayah bookmarks and cached conversation history are saved locally on your device using Apple SwiftData.

4. AI Chat Processing and Storage

When you send a message in the AI Chat tab, the following processing occurs:

• Transmission to Backend: Your question and recent conversation context are transmitted over an encrypted HTTPS connection to our secure serverless backend hosted on Google Cloud Functions (region europe-west1).
• Third-Party AI Generation (OpenAI): The backend builds a structured prompt containing your question and context, and forwards it to OpenAI via secure API calls. OpenAI processes the text solely to generate the theological response and identify Quranic surah and ayah citations.
• Conversation History Storage: To allow you to view your chat history across app sessions, the question, AI response, citation metadata, and token counts are stored in Cloud Firestore under /users/{uid}/conversations/{id}/messages, associated with your anonymous user ID.
• Rate Limiting & Quotas: To prevent abuse and ensure service availability, requests are rate-limited (a 30-second cooldown between requests and a daily cap of 60 requests).

5. Device Identifier and Apple App Attest

To verify that requests originate from a genuine, uncompromised copy of QuranAI and to enforce the free question allowance (10 questions in the first 30 days, then 3 every 30 days) without requiring personal accounts:

• The app uses Apple's App Attest service (part of the DeviceCheck framework) to confirm that the request comes from a genuine copy of QuranAI. It is not used to identify your device.
• The app generates a random installation identifier the first time it runs and keeps it in the device Keychain, without iCloud synchronisation. Our backend derives an irreversible, one-way SHA-256 hash of it and stores only that hash in Firestore under /devices/{deviceHash}, along with the count of free queries used and timestamps. The identifier itself is never stored or logged.
• This device hash is used exclusively for quota enforcement and abuse prevention. It is never used for advertising, tracking, or user profiling.

6. Anonymous Authentication

To authorize requests to the backend without requiring personal credentials, QuranAI uses Firebase Authentication's anonymous sign-in (signInAnonymously).

This generates a random pseudonymous identifier (UID). It is not linked to your Apple ID, name, email address, phone number, or social media accounts.

7. In-App Purchases and Subscriptions (StoreKit 2)

QuranAI offers optional auto-renewable subscriptions under the QuranAI Premium tier (Monthly: dev.rakhimov.QuranAI.sub.monthly, Yearly: dev.rakhimov.QuranAI.sub.yearly).

• Payment Processing: All purchases and subscriptions are handled directly and exclusively by Apple via StoreKit 2. We never receive, process, or store your credit card details, bank information, or billing address.
• Server Synchronization: Our backend receives cryptographically signed App Store transaction identifiers (originalTransactionId) and entitlement expiration dates in Firestore under /subscriptions to restore and validate your premium status across app reinstalls and device migrations.

8. Product Telemetry and Analytics

QuranAI uses Firebase Analytics (Google) and AppMetrica (Yandex) to collect aggregate telemetry and diagnostic metrics to improve app stability and user experience. Both receive the same events:

• What is tracked: Aggregated event counts such as app launches, screen views, search execution counts, paywall views, and purchase completion events.
• Strict Privacy Invariant: The text of your questions, the AI's generated answers, and your search keywords are never transmitted to analytics. This restriction is enforced directly in the application code through strongly-typed event definitions (AnalyticsEvent).
• No Tracking: Analytics data is not linked to your personal identity and is not shared with third-party data brokers or advertising networks. The advertising identifier (IDFA) is not requested and no cross-app tracking permission is asked for.

9. Data Retention and Deletion ("Delete Account and Data")

You have full control over your data. In the app, navigating to Settings → Delete Account and Data allows you to permanently and irreversibly erase your information from our servers:

• What is deleted: Your anonymous user profile (/users/{uid}), all conversation history and messages, your bookmarks, and the subscription link associated with your current anonymous UID are immediately deleted from Firestore, and the anonymous authentication account is removed.
• What survives: The device free-question counter (/devices/{deviceHash}) is retained because it is tied to the hardware attestation hash, not your account. This prevents bypassing the free-question limit through repeated account deletion. It contains no personal content or messages — only numerical counters and timestamps.
• Active Subscriptions: Deleting your account data does not automatically cancel a paid Apple subscription. Subscriptions must be managed and canceled directly in your Apple ID Account Settings. If you reinstall the app or restore purchases, your premium entitlement can be re-linked.

10. Third-Party Service Providers

We work with trusted third-party providers to provide essential application features:

11. Children's Privacy

QuranAI is not directed to children under 13 years of age (or under 16 in the European Economic Area). Because the application features an AI-driven conversational chat with free-form text input, we do not knowingly collect, solicit, or store personal information from children. If we discover that personal data from a child has been collected, we will promptly delete it.

12. Your Rights and Data Choices

Under applicable data protection laws (including the GDPR and CCPA/CPRA), you have the right to access, export, or delete your data:

• Erasure: You can permanently erase all stored cloud messages and account records at any time via Settings → Delete Account and Data.
• Inquiries: For any questions or data requests, you can reach out directly via email at rakhimov.dev@gmail.com.

13. Changes to this Policy

If we make material changes to this Privacy Policy, we will update the "Effective date" at the top of this page and include a notice in the application's release notes.

14. Contact Us

If you have any questions or feedback regarding this Privacy Policy, please contact the developer: