Privacy Notice on the Protection of Personal Data
Informational translation. The Turkish text is legally authoritative: muminapp.com/aydinlatma.
This notice is given under Art. 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It describes the data processed by the Mumin App mobile application and this server (muminapp.com and api.muminapp.com).
1Data controller
DODO İLERİ TEKNOLOJİ VE TİCARET ANONİM ŞİRKETİ (kısa: DODO İLERİ TEKNOLOJİ VE TİCARET A.Ş.), ÇİTLİBAĞ MAH. ÇİTLİBAĞ KÜME EVLERİ NO: 3JA KIZILTEPE / MARDİN, Mersis No: 0302144561100001, Vergi No: 3021445611 (Kızıltepe Vergi Dairesi), Tel: +90 850 303 36 72, E-posta: [email protected]
Contact: [email protected]
2In short: what does Mumin App know, and what does it not?
- Mumin App has no account, membership, login, phone number or email.
- Prayer times are calculated on your device in the app. Your GPS location never leaves your phone and is not sent to the server. Only the country and city name that you choose are sent.
- Anonymous usage statistics are collected: which screens are used, app version, phone type and brand, display/theme/font size preferences, the selected country/city and calculation method, and error logs. These are not linked to your identity; they are kept under a random installation number generated on the device and can be switched off in the app settings.
- Your data is never sold and is not shared with advertising companies. There are no ads.
- Optional Qibla map: only if you open it and give consent, map tiles are downloaded from the third-party provider OpenFreeMap. The provider can see the approximate location of the area you view and your IP address; your GPS coordinates are not sent. While the map is off, no map request is made.
- Optional nearby mosques: only if you open it and give consent, your approximate location (rounded to about 1 km) and your IP address are sent to OpenStreetMap Overpass servers (overpass-api.de and its backups); your exact GPS coordinates, account or identifier are not sent. Results are kept on your device for 24 hours. Can be switched off under Settings > Privacy > “Nearby mosques”; no request is made while it is off or never confirmed.
- The title, purpose, commemoration name and participant nicknames of khatm circles are end-to-end encrypted; the server cannot read them.
- Your IP address is not recorded. It is visible at the network level while your request is being answered, but it is not written to any log, database or persistent storage.
- Circle data is automatically deleted 90 days after the last activity, and usage statistics 400 days after collection.
- Information about religion and belief is special-category personal data under Art. 6 of the KVKK. Mumin App keeps worship records such as the days you perform prayers, your qada count and your dhikr count only on your device and does not send them to the server. Only setting information such as your chosen calculation method and Asr calculation preference enters the statistics; these are not linked to your identity.
3Data processed, purposes and legal bases
| Data | Purpose of processing | Legal basis | Note |
|---|---|---|---|
| Room ID (random, 128-bit) | To identify the circle | KVKK Art. 5/2-c (provision of the service) | Cannot be linked to a person. |
| Juz' statuses (empty / taken / read) and last date | To avoid giving the same juz' to two people and to show progress | Art. 5/2-c | The name of who took which juz' does not exist on the server. |
| Encrypted content (title, purpose, commemoration name) and encrypted nicknames | To deliver the circle's information to participants | Art. 5/2-c. For content that may be of a religious nature, Art. 6/2 (explicit consent): you open the content yourself by sharing the invitation link. | The key exists only in the #k=… part of the invitation link; the browser does not send this part to the server. The server cannot decrypt the content and therefore cannot process it. |
| SHA-256 digest of the participant token | So that only the person who took a juz' can mark it "read" or "release" it | Art. 5/2-c, Art. 5/2-f (data security) | The token is generated randomly on your device; it has nothing to do with your identity. |
| Digest of the write key | So that only the organiser can update and close the circle | Art. 5/2-c, Art. 5/2-f | The key itself is not kept on the server. |
| Circle reports: reason, optional short description (up to 300 characters), date, digest of the reporter's token | Notice-and-takedown process against unlawful or harmful content | Art. 5/2-ç (legal obligation under Law No. 5651), Art. 5/2-f | No IP address or identity is kept in a report. Please do not write personal data in the description field. |
| Salted digest for rate limiting | Protection against abuse, service security | Art. 5/2-f (legitimate interest) | Only in server memory, for about one minute; not written to disk. The IP address is not recorded. |
| Aggregate counts (active/completed circles, number of juz' read) | General statistics | Not personal data | Türkiye-wide totals only; there is no province/district breakdown. |
| Anonymous usage statistics: random installation number; app version, build number, platform (iOS/Android), major OS version, language; phone brand (e.g. Samsung; not the model or device ID), screen size class, theme and font size preference; selected country and city name; calculation method, Asr calculation, Easy Mode setting; screens opened, session length range and features used (daily counters); whether notification, location, exact alarm and battery permissions have been granted, adhan schedule health and whether a widget has been added; onboarding steps; app error logs (error message, location of the error, first lines of the stack trace) | To improve the service, understand which features are used, and find and fix errors | KVKK Art. 5/2-f (legitimate interest) | The installation number is not related to any identifier of your phone and cannot be linked to your name or account; it is renewed when the app is deleted and reinstalled. No GPS location is sent. Can be switched off in settings. Deleted after 400 days. |
| Optional Qibla map: map tile requests (tile coordinates of the viewed area, around your chosen city) and the IP address visible at the network level during the request | To show the Qibla line on a map | KVKK Art. 5/1 (explicit consent; the map is enabled after a notice and your consent the first time you open it) | Recipient: the third-party map tile provider OpenFreeMap (tiles.openfreemap.org). Not retained by us and not sent to the Mumin App server. No GPS coordinates, account or identifier is sent; the map component collects no analytics. Can be switched off under Settings > Privacy > “Qibla map”; no request is made while it is off or never opened. Retention at the provider is subject to its own policy. |
| Optional nearby mosques: approximate location (coordinates rounded to about 1 km) and the IP address visible at network level during the request | Listing nearby mosques and prayer rooms | KVKK Art. 5/1 (explicit consent; enabled after a notice and your consent the first time you use the list) | Recipient: OpenStreetMap Overpass API servers (overpass-api.de; backups: overpass.openstreetmap.fr, overpass.private.coffee, overpass.kumi.systems). Not retained by us and not sent to the Mumin App server. No exact GPS coordinates, account or identifier is sent. Can be switched off under Settings > Privacy > “Nearby mosques”; no request is made while it is off or never confirmed. Retention at those servers is subject to their own policies. |
| Daily totals for the website (number of page views, domain of the referring site, browser type class, country code) | To monitor the operation of the site and the server | Art. 5/2-f | These are daily totals only; they cannot be linked to a person or device. No IP address, cookie or raw browser information is stored. Deleted after 400 days. |
| GPS location, adhan and notification preferences, prayer/qada records, dhikr counts, other personal preferences related to religion and belief (special category, KVKK Art. 6) | To calculate the times and play the adhan | Not processed, as it does not reach the data controller | Stays only on your device. Deleting the app deletes this data. |
The server does not collect your first name, surname, phone, email, GPS location, or the device's hardware or advertising ID. In this version the server does not keep a push notification token either. Usage statistics consist only of the fields listed above. Data processed by the stores from which you download the app (Apple App Store, Google Play) is outside this notice; they are subject to their own policies.
4Information of a religious nature
Information such as a khatm commemoration name may relate to religious belief and may therefore be considered special-category data under Art. 6 of the KVKK. This information reaches the server only in encrypted form and the server cannot decrypt it; therefore there is no possibility of processing this content on the server side. The parties who decrypt it are the devices of the participants who receive the invitation link. People with whom you share the link can see the circle's content; share the link only with people you trust.
5Retention periods
- Circle (including juz' statuses, encrypted content and reports): automatically and permanently deleted 90 days after the last activity. Closed circles are also deleted within the same period.
- Rate-limiting digest: about one minute, in memory only.
- Anonymous usage statistics and error logs: automatically and permanently deleted after 400 days. You can switch off sending statistics in the app settings; after you do, no new data is sent.
- On the web participation page, a random participant token and the nickname you typed are stored in your browser's local storage (localStorage). No tracking cookie is used. You can remove these by clearing your browser data.
- Data on your device is under your control; simply delete the app.
6Transfers
Your data is not sold; it is not shared with any third party for advertising, analytics or marketing purposes. No third-party analytics or advertising service is used; usage statistics are kept on our own servers and are seen only by the data controller. In the event of a legal request, the data held on the server is limited to what is listed above. If a transfer abroad becomes necessary, Arts. The exceptions are the optional Qibla map and the optional nearby-mosques list. Qibla map: if you open it and consent, map tiles are downloaded from the third-party map provider OpenFreeMap, which can see the approximate area and your IP address; this serves neither analytics nor advertising, and your GPS coordinates are not sent. Likewise, if you open the optional nearby-mosques list and consent, your approximate location (rounded to about 1 km) and your IP address are sent to OpenStreetMap Overpass servers (overpass-api.de and its backups); your exact GPS coordinates, account or identifier are not sent, the request does not touch the Mumin App server, and none is made while the list is off. 8 and 9 of the KVKK will be complied with.
7Your rights (KVKK Art. 11)
Under Art. 11 of the KVKK, you may apply to the data controller to request the following:
- To learn whether your personal data is processed and, if so, to request information about it,
- To learn the purpose of the processing and whether the data is used in accordance with that purpose,
- To know the third parties to whom the data is transferred, in Türkiye or abroad,
- If the data is incomplete or inaccurately processed, to request its correction, and, within the framework of Art. 7 of the KVKK, to request its deletion or destruction, and to request that these actions be notified to the third parties to whom the data has been transferred,
- To object to a result against you arising from the analysis of the processed data exclusively by automated systems,
- To request compensation for damage if you suffer harm due to unlawful processing.
8How to apply
Because no identity data that could be linked to you is kept on the server, we may need you to tell us the relevant room ID (the 26 characters after /h/ in the link) in order to respond to a request. Because usage statistics are kept under a random installation number that cannot be linked to you, we cannot single them out for you; you can switch off sending statistics in the app settings. You can submit your application in the following ways:
- Email: [email protected]
- In writing: to the data controller's address above, with a wet-signed petition stating your identity.
Applications are concluded, depending on the nature of the request, within 30 days at the latest and in principle free of charge; if the process requires an additional cost, a fee under the tariff set by the Board may be charged. If you are not satisfied with the response, you retain the right to lodge a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and, in any case, within 60 days from the date of your application.
9Complaints and content reports
You can use the "Report this circle" link on the circle page or write to [email protected]. For details, see the Support page.
This notice may be updated; the current version is published at this address.