Privacy Policy

1. Who we are

This Privacy Policy explains how CNT İnteraktif Bilgi Teknolojileri Yazılım Sanayi ve Ticaret A.Ş. (a Turkish joint-stock company) ("we", "us") handles personal data in Qibla Finder.

We are the data controller for the personal data described in this policy.

Registered address: Mansuroğlu Mah., Bayraklı, İzmir, Türkiye Mersis no: 0211 0664 8190 0019 Contact: gdpr@appassistant.net

Privacy enquiries for our applications are handled by a shared team using a single contact address. This does not change which company is responsible for your data: the controller for Qibla Finder is CNT İnteraktif Bilgi Teknolojileri Yazılım Sanayi ve Ticaret A.Ş., as stated above.

2. What this policy covers

This policy applies to Qibla Finder only — the iOS application (com.hundred.qibla.finder.ios), its Apple Watch companion, and the Android application (com.hundred.qibla.finder). Qibla Finder is published as a single listing on the App Store and a single listing on Google Play.

It describes version 3.9.0 and later. Versions published before 3.9.0 requested a different set of device permissions, and this policy does not describe them.

Our other applications each have their own privacy policy describing what that application collects. This policy does not describe them, and their policies do not describe Qibla Finder.

3. How we handle your data

We ask for the minimum access a feature requires, at the moment the feature needs it, and we explain why at the point we ask.

We do not sell personal data.

We do not use personal data to train AI models, and we do not share it with advertising providers for that purpose.

Data is transmitted over encrypted connections.

Qibla Finder has no account system. There is no registration, no sign-in, no social login, and no field in which you enter your name, e-mail address or any other personal detail.

4. What we collect

Precise location — coordinates to four decimal places. Used to calculate the direction of the Kaaba, to draw the map and the AR compass, to find mosques near you, and to target and measure the advertising shown in the app. Obtained from your device after you grant location permission.

Advertising identifier — IDFA on iOS, Google Advertising ID on Android. Used for advertising and marketing measurement. Obtained from the operating system; on iOS, only where you have allowed tracking.

Vendor identifier (IDFV) — iOS only. Used to identify the installation to our own mosque-search service, and to TikTok, Adapty, AppsFlyer and Firebase. Obtained from the operating system in every case, independently of your tracking choice.

Build.ID — Android only. Sent to our own mosque-search service. This value identifies the operating system build, not your individual device.

Firebase installation identifier and push token. Used to identify the installation to Firebase and to deliver push notifications. Generated on first launch.

Permission status, app version, platform and timestamp. Sent with each nearby-mosque request to our own service.

App usage events — screens opened, features used, and live stream events such as starting a stream and how long it was watched. Collected automatically.

Install and attribution events, including SKAdNetwork conversion values. Used to measure which marketing brought you to the app.

Subscription and purchase records. Used to provide and restore your subscription. Received from Apple, Google and our subscription provider.

IP address. Held in your subscription profile by Adapty; also received by advertising mediation partners, and by YouTube when you play the live stream.

Crash reports, performance and diagnostic data. Used to find and fix faults.

Advertising interaction data. Used to serve, cap and measure advertising.

5. Permissions, and what each one is for

iOS

Location — While Using the App. Used on the Map, Compass and AR screens to calculate the direction of the Kaaba and to find mosques near you. Where you have granted it, your location is also used to target and measure advertising — see section 10.

Camera. Used on the AR tab to draw the Qibla direction over the live camera view.

Tracking (App Tracking Transparency). Used to personalise and measure advertising. Declining does not switch off any feature of the app.

Apple Watch

The Watch app reads location on the Watch itself, to calculate the direction of the Kaaba. Its permission prompt reads: "Used to calculate the direction of the Kaaba from your location." Mosque search and the map are not available on the Watch. The Watch app makes no network requests of its own — what it measures reaches only your paired iPhone.

Android

Some of the permissions in the Android release are declared by us; the rest are added by the libraries the app includes.

Declared by Qibla Finder:

• ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION — Qibla direction, map, nearby mosques, and advertising targeting and measurement (section 10)
• CAMERA — the AR view. Declared as not required: the app installs and runs on a device without a camera, and the AR view is then unavailable
• INTERNET, ACCESS_NETWORK_STATE — making network requests, and checking whether the device is online
• POST_NOTIFICATIONS — showing push notifications (section 7)
• com.android.vending.BILLING — purchasing and restoring subscriptions through Google Play
• com.google.android.gms.permission.AD_ID — reading the Google Advertising ID for advertising and attribution
• VIBRATE — haptic feedback. This permission allows the device to vibrate and gives access to no data

Added by libraries we include:

• ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION — Firebase Analytics
• ACCESS_ADSERVICES_CUSTOM_AUDIENCE — Meta SDK
• ACCESS_ADSERVICES_TOPICS — Google AdMob
• com.google.android.c2dm.permission.RECEIVE — Firebase Cloud Messaging
• com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE — Google Play install referrer, used by Firebase
• FOREGROUND_SERVICE — AndroidX WorkManager
• WAKE_LOCK — Firebase Analytics
• androidx.core.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION — AndroidX Core

6. The camera, the compass, and the live stream

The camera. In the AR view, the camera feed is used on your device to draw the Qibla direction over what the camera sees. The image is not recorded, not stored, and is not sent to us or to anyone else.

The compass. Readings from the device's compass and magnetometer are used on your device to point towards the Kaaba. They do not leave your device.

The live Kaaba stream. The stream is an embedded YouTube player running in YouTube's privacy-enhanced mode, on youtube-nocookie.com. When you play the stream, a playback request and your IP address reach Google and YouTube. No separate permission is requested for this. The app also makes one request, carrying no parameters, to a Google Cloud Function hosted in the europe-west1 region, to determine which stream source to use.

When you watch the stream, events recording that you started a stream and how long you watched are sent to Firebase Analytics.

7. Notifications

Qibla Finder sends push notifications through Firebase Cloud Messaging. To do this, a push token is generated on your device and held by Firebase.

The notifications Qibla Finder currently sends are reminders and announcements about the app. You can turn notifications off at any time in your device settings.

8. What your use of the app indicates

Qibla Finder is an application for Islamic religious practice. Installing it, and using it, therefore indicates an interest in that practice. We are stating this plainly rather than leaving it to be inferred.

The app does not ask you to declare a religion, and it has no field in which you could. It does not collect your denomination, your prayer habits, or any other statement of belief.

What it does collect is described in section 4: app usage events, including which screens you open and when you watch the live Kaaba stream, are sent to Firebase Analytics; and the identifiers described in section 11 are sent to the advertising and marketing measurement providers listed in section 12. These providers receive that data in the context of an application whose subject is religious practice.

9. Children

Qibla Finder is intended for a general, adult audience. It is declared as 18+ on Google Play and is not directed at children.

The app has no account system and no profile fields, so no name, date of birth, or any other information about a child can be entered into it. We do not knowingly direct the app at children, and we do not collect information identifying anyone as a child.

The data described in this policy — location, device and advertising identifiers, and app usage — is collected from the device the app runs on. If a child uses a device on which Qibla Finder is installed, that data is collected in the same way, because the app has no means of knowing who is holding the device. If you believe a child has used the app and you want the associated data removed, write to gdpr@appassistant.net.

10. Advertising and measurement

Qibla Finder is free to use and shows advertising. Advertising is served by Google AdMob.

Your location is used for advertising. AdMob's automatic location collection is switched on in Qibla Finder. Where you have granted location permission, your location is used not only to calculate the Qibla direction and to find mosques near you, but also to target and measure the advertising you are shown.

Mediation partners. AdMob fills some advertising slots through mediation partners. When it does, that partner's creative receives your IP address, your user-agent string, your device model and operating system, and impression beacons confirming that the advertisement was shown. The partners recorded in Qibla Finder are Liftoff, Smadex, Yango Ads, Kayzen, Adjust and Luna Labs. Which of these serves a particular advertisement varies, and the set of partners may change as we add or remove mediation adapters.

Consent. Where consent to personalised advertising is required, it is collected through Google's UMP consent form. On iOS, App Tracking Transparency also applies — see section 11.

Marketing measurement. Install and event data is sent to AppsFlyer, Meta, TikTok, Apple Search Ads and Google's on-device measurement, so that we can tell which marketing brought people to the app.

11. Tracking identifiers

This section differs by platform. Please read the part that applies to your device.

On iOS

When you are asked. The App Tracking Transparency prompt is shown once, on the first launch after you install the app. If it cannot be shown on that launch, the app does not ask again. You can change your choice at any time in Settings → Privacy & Security → Tracking.

If you allow tracking. Your advertising identifier (IDFA) is sent to AdMob, AppsFlyer, Meta, TikTok, Firebase Analytics and Adapty.

If you decline, or are never asked. No provider receives your real advertising identifier. We verified this on three clean installs of version 3.9.0.

What continues regardless of your choice. Your vendor identifier (IDFV) is sent to TikTok, Adapty, AppsFlyer, Firebase and our own mosque-search service in every case, including when you have declined tracking. IDFV is not covered by App Tracking Transparency, but it is a device identifier, and we state it here rather than leave it to be discovered. Declining tracking stops the advertising identifier; it does not stop the vendor identifier.

Analytics is not exempt. Firebase Analytics is also governed by your tracking choice — when you allow tracking, it receives your real advertising identifier.

What we cannot tell you. Google's on-device measurement uses hashed values, and Apple Search Ads uses a signed token. Neither can be reversed, so we cannot state what, if anything, they contain beyond what those providers publish.

On Android

Android has no App Tracking Transparency. The Google Advertising ID is a device-level setting controlled by Android, not by this app, and it is sent to AdMob, AppsFlyer, Meta and TikTok. Consent to personalised advertising, where it is required, is collected through Google's UMP consent form. The measurement described above for iOS was carried out on iOS only and does not describe Android behaviour.

12. Service providers

Our own mosque-search service (location.muslimassistant.com) — finds mosques near you. Receives your coordinates, a device identifier (the vendor identifier on iOS, Build.ID on Android), permission status, app version and timestamp.

Google AdMob, with the UMP consent SDK — serves, targets and measures advertising. Receives device and app information, advertising interactions, your precise location, and your advertising identifier; on iOS, only where you have allowed tracking.

AdMob mediation partners — Liftoff, Smadex, Yango Ads, Kayzen, Adjust, Luna Labs. Serve advertising and measure it on behalf of advertisers. Receive your IP address, user-agent, device model and operating system, and impression beacons.

AppsFlyer — install attribution and marketing measurement. Receives your vendor identifier in every case, install and app events, SKAdNetwork conversion values, and, where you have allowed tracking on iOS, your advertising identifier.

Meta — marketing measurement. Receives app events and, where you have allowed tracking on iOS, your advertising identifier.

TikTok — marketing measurement. Receives your vendor identifier in every case, including when you have declined tracking, and, where you have allowed tracking on iOS, your advertising identifier.

Apple Search Ads — attributes App Store installs. Receives a signed attribution token.

Google on-device measurement — measures advertising on the device. Receives hashed advertising measurement data.

Firebase Analytics — helps us understand how the app is used. Receives the app instance identifier, usage events, your vendor identifier, and, where you have allowed tracking on iOS, your advertising identifier.

Firebase Cloud Messaging and Firebase Installations — push notifications and installation identity. Receive the installation identifier and push token.

Firebase Crashlytics — crash reporting. Receives crash reports.

Firebase Performance and Sessions — diagnosing performance problems. Receive performance measurements.

Firebase App Check — confirms that requests come from a genuine copy of the app. Receives an attestation token valid for at most seven days, which is not stored.

Firebase Remote Config and Firestore — deliver configuration to the app. Receive the installation identifier, app version, language and country.

Adapty — manages subscriptions. Receives subscription status, your IP address, your vendor identifier in every case, and, where you have allowed tracking on iOS, your advertising identifier.

ipify — determines the IP address recorded in your subscription profile. Receives your IP address.

Apple (StoreKit) and Google Play Billing — take payment and restore purchases. Receive purchase and subscription records.

YouTube / Google — the live Kaaba stream, in privacy-enhanced mode. Receives the playback request and your IP address.

Google Cloud Functions (europe-west1) — determines the live stream source. Receives a request carrying no parameters.

Apple Maps (iOS) and Google Maps (Android) — show the map, search, and reverse geocoding. Receive map and search requests.

Google Location Services (Android) — determines the device's position. Receives location requests.

Where a provider operates outside Türkiye and the EEA, section 17 explains the basis on which data reaches them.

13. What Qibla Finder does not do

Each of the following has been verified against the application's source, its dependency manifest, its release manifest, a recording of its network traffic, or written confirmation from the owner of the system concerned.

• There is no account. No registration, no sign-in, no social login, no e-mail address and no password. The app contains no authentication library of any kind.
• Your coordinates are not stored as a record of you. When the app looks for mosques near you, your coordinates are used to match against a list of mosque locations held on our server, and are not written to the database as a record. The device identifier sent with the request is not stored. Nothing on that server is associated with you or with your device.
• Your location is not sent to Google. The mosque locations our service matches against are obtained from Google in bulk and stored on our own server. The matching is done on our server. Your coordinates are not passed on to Google as part of it.
• The camera image never leaves your device. The AR view neither records nor uploads what the camera sees.
• Compass and magnetometer readings never leave your device.
• The app does not access your photo library.
• The app does not use the microphone. The audio recording permission has been removed from the Android release.
• Declining App Tracking Transparency does not disable any feature. Every part of the app works the same either way.
• When you decline tracking on iOS, no provider receives your real advertising identifier. Your vendor identifier does continue to be sent — this is described in section 11 and is not covered by this statement.
• Your data is not used to train AI models. Qibla Finder contains no AI or model-calling component of any kind, and nothing you do in the app is sent to one.
• The Apple Watch app makes no network requests. What it measures reaches only your paired iPhone.

14. Legal bases for processing

Where the GDPR or equivalent law applies, we rely on the following legal bases:

• Performance of a contract — to provide the features you ask for, and to manage subscriptions you purchase.
• Consent — where we ask for it, such as access to device features, personalised advertising, or optional communications. You can withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.
• Legitimate interests — to keep the application secure and working correctly, to diagnose faults, and to understand how features are used in aggregate. We balance these interests against your rights, and you may object as described in section 16.
• Legal obligation — where we must retain records, such as purchase records for accounting purposes.

15. How long data is kept, and how to have it removed

We keep personal data only as long as it is needed for the purpose it was collected for.

On your device. Your settings, and the camera and compass readings described in section 6, stay on your device and are removed when you uninstall the app.

Our mosque-search service. Each time the app looks for mosques near you, it sends your coordinates, a device identifier, your permission status, the app version and a timestamp to our own service. What that service keeps is a list of mosque locations and mosque names. It does not keep a record of your request, your coordinates or your device, so there is no personal data held there to retain or to delete.

Adapty. Your subscription profile holds a single IP address — the one most recently seen. No history of your IP addresses is kept: when a new address is seen, the stored one is replaced. The address is refreshed when your profile is updated, and is re-checked at most once every seven days. It is held for as long as the subscription profile exists.

Firebase. Analytics events, crash reports and performance data are held by Google on our behalf and are kept for the retention period configured in our Firebase project. If you would like to know the current setting, write to gdpr@appassistant.net.

Other providers. The advertising, attribution and payment providers listed in section 12 retain data according to their own published policies.

Deletion. Because Qibla Finder has no account, there is nothing to delete inside the app. To ask us to remove data associated with your device, write to gdpr@appassistant.net. Where we hold data on our own systems, it is deleted within 30 days of a valid request, except records we are required to keep by law — such as purchase and accounting records.

16. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we process it
• receive your data in a portable format
• withdraw consent you have given
• lodge a complaint with a supervisory authority

To exercise any of these rights, write to gdpr@appassistant.net. We respond within the period required by applicable law.

If you are in Türkiye. Under Law No. 6698 on the Protection of Personal Data (KVKK), you hold the rights set out in Article 11. Applications must be made in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, and may be submitted to our registered electronic mail address: cntinteraktif@hs09.kep.tr

You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK).

17. International transfers

Some of the service providers listed in section 12 operate outside Türkiye and outside the European Economic Area.

Where personal data is transferred abroad, we rely on the transfer mechanisms permitted under Article 9 of Law No. 6698, and, where the GDPR applies, on the safeguards it requires. We require these providers to apply protections appropriate to the data they receive.

18. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls on our systems, and regular review of the services we integrate.

No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority where the law requires it.

19. Reporting a security or privacy issue

If you believe you have found a security or privacy issue in one of our applications, we want to hear about it.

Write to gdpr@appassistant.net. We will acknowledge your report and keep you informed while we investigate. We ask that you give us a reasonable period to address the issue before disclosing it publicly.

20. Changes to this policy

We update this policy when the application changes what it collects or who it shares data with.

When we make a significant change, we update the date at the top of this page and, where the change is material, we tell you in the application.