Privacy Policy
Qita is an app for reading hadiths and Quran verses and for searching them by meaning. This policy explains what data the app and the qitaapp.com website handle, and why. We try to collect as little as possible.
In short
- No account, no ads, no tracking. We don’t sell data.
- Your search query is sent to our server only to run the search, and it is not stored.
- We count searches and which results are opened from search, as anonymous daily totals — without device identifiers, IP addresses or the text of searches.
- Favorites and settings stay on your device.
- If you turn on Daily Hadith notifications, our server stores a push token with your time zone and language — only to send them.
- Crash reports contain technical details about the error, not about who you are.
1. Who we are
Qita is developed and run by Arslan Kunanov, a private individual in the Republic of Kazakhstan (“we”). For any question about your data, write to support@qitaapp.com.
2. What we don’t collect
Qita has no registration and no account. We don’t ask for and don’t receive your name, email address, phone number, contacts, location, photos or advertising identifier — except the push token, if you turn on notifications (section 6). The app contains no advertising or tracking tools and no third-party analytics services; we keep only the anonymous statistics described in section 4. We don’t sell data and don’t share it with advertisers.
3. Search queries
When you search, the text you type is sent to our server over an encrypted connection (HTTPS) to find matching hadiths and verses. The search model runs on our own server: your query is not sent to any external AI service.
The query is not saved. Neither its text nor its hash is written to logs. To answer a repeated identical search faster, the server keeps the search results in memory for up to 5 minutes, under a hash of the query, without any link to you or your IP address.
For each search, the server notes its outcome without the text of the query: the language, how many hadiths and verses were found (or that nothing was found), how close the best match was, and how long the search took. These notes are part of the anonymous statistics described in section 4.
4. Technical data of requests
Like any internet service, our server sees the IP address of each request and what was requested (for example, which hadith or Quran passage was opened).
- The IP address is kept only in memory, for up to one minute, to protect the server from overload. It is not written to logs.
- The server log records the request path, the response status, how long the response took, the platform (iOS or Android) and the time, without the IP address or push token. The log is limited in size (about 30 MB per service), and old entries are overwritten automatically.
- The database is backed up daily, and the copies are kept for 7 days. They contain the app’s content (hadiths, translations, search index), the anonymous counters described below and, for devices with Daily Hadith notifications on, push tokens with time zone and language (section 6).
Anonymous usage statistics
To understand whether search helps people find answers, we keep anonymous statistics: how many searches there were, how many found nothing, and which results people open from search.
- When you open a card from the search results, the app sends a short note to our server: whether it is a hadith or a Quran passage, its number, its place in the list, whether it is the first card you opened from these results, the language and the platform (iOS or Android). The note contains no device or advertising identifier, no account and not the text of your search. Opening texts from favorites, the library, the daily hadith or a notification is not counted.
- The server writes this note and the outcome of each search (section 3) to its log as a single line, without your IP address. Our software regularly turns these lines into counters: per day by language and platform, and per day by collection and book (for the Quran, by surah) — the number of an individual hadith or verse is not kept in the counters; technical counters (number of requests and searches, response time) are kept per 5-minute and per hour interval. The log lines themselves are overwritten as described above.
- The counters do not relate to any particular person or device, and we don’t link them to other data. Daily counters are kept without a time limit, counters by collection and book for up to 13 months, and technical counters for up to 30 days (5-minute) and 13 months (hourly).
5. Favorites and settings
Your favorites and settings (language, collections, text size, whether notifications are on) are stored only on your device and are not sent to us. On iPhone, they may be included in your device backup (iCloud or computer), depending on your iOS settings. Deleting the app deletes them. The notifications themselves are described in section 6.
6. Daily Hadith notifications
If you turn on Daily Hadith notifications, the app gets a push token from iOS — a random string that Apple Push Notification service (APNs) uses to deliver Qita’s notifications to your device — and sends it to our server together with your device’s time zone (for example, Asia/Almaty) and the app language. We need the time zone to send the notification at 12:00 your local time, and the language to send it in. With the token we also keep a few technical fields: the build type (sandbox for test builds, production for the App Store), when the app last confirmed the token, the date of the last delivered notification and, after a temporary delivery error, when to try again. Nothing else is stored with it — no name, account, IP address, device model or advertising identifier — and we use it only to send these notifications.
Each day at noon our server sends Apple the text of the day’s hadith for your device, and Apple delivers it. The token is deleted from our server when you turn the notifications off in Qita, when Apple reports that the token is no longer valid (for example, after the app is deleted), or about 180 days after you last opened the app (the app confirms the token at most once a week, so in practice this happens after 173–180 days). If you turn notifications off in iOS settings, the app deletes the token the next time you open it. Deleted tokens remain in our server backups for up to 7 days.
7. Crash reports
If the app crashes, it sends a report to Sentry, a crash reporting service, so that we can find and fix the error. Reports are stored in Sentry’s EU data region (Germany) for up to 30 days.
A report contains: the error and the place in the code where it happened; the device model and the versions of iOS and the app; the technical state of the app at that moment (for example, memory and the screens that were open); session data (start, duration, whether it ended in a crash) used to measure stability; and a random installation ID. The app generates this ID itself; it changes when you reinstall the app and is not a device or advertising identifier.
A report does not contain your name, email address, IP address (Sentry receives it with the connection but is set not to store it), the text of your searches, or screenshots. We use crash reports only to fix errors, never to identify you.
If our server fails while handling a request, it also sends an error report to Sentry: the technical details of the error, the request path, and the request language and User-Agent (app and system version). It does not contain your IP address, the request body or the search text.
8. Who processes data for us
- Hetzner (Germany) hosts our server.
- Sentry stores crash and error reports in its EU data region.
- Apple (Apple Push Notification service) delivers notifications to your device; it receives the push token and the notification text from our server.
- Cloudflare provides DNS for our domain and forwards emails sent to support@qitaapp.com to our mailbox. App traffic does not pass through Cloudflare.
- Google (Gmail) hosts the mailbox where support emails arrive.
Apple distributes the app through the App Store; Apple’s privacy policy applies to your Apple account and downloads. If you have allowed iOS to share analytics with app developers, Apple may provide us with crash reports and general statistics that do not identify you.
We don’t share data with anyone else.
9. Where data is processed
Our server and the crash reports are located in Germany (EU). If you use Qita outside the EU, including in Kazakhstan, your search query and the technical data of your requests are transferred to Germany and processed there at the moment of the request. The anonymous statistics and, if Daily Hadith notifications are on, the push token with your time zone and language are stored on the same server in Germany. We don’t keep a database of users’ personal data. Emails to support pass through Cloudflare and are stored by Google, whose servers may be located in other countries.
10. Legal basis
We process data in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” and, since our server is in the EU, the EU General Data Protection Regulation (GDPR).
- Search queries and request data: to run the search and show the texts you ask for (GDPR Art. 6(1)(b)), and to keep the server reliable and secure (Art. 6(1)(f)).
- Crash and error reports: our legitimate interest in a stable app (Art. 6(1)(f)).
- Anonymous usage statistics: our legitimate interest in knowing whether search helps and in improving it (Art. 6(1)(f)).
- Daily Hadith notifications: to send the notifications you turned on (GDPR Art. 6(1)(b)).
- Emails to support: to answer you.
We make no automated decisions about you and build no profiles. Under the law of Kazakhstan, this processing does not create a personal data database.
11. Security
All connections between the app and our server are encrypted (HTTPS). Access to the server is restricted and protected by keys. The best protection is not to keep data, so we keep as little as possible.
12. Your rights
Under the law of Kazakhstan and the GDPR, you have the right to know whether we process your data and to access it, to have it corrected or deleted, to object to its processing, and to complain to a data protection authority (in Kazakhstan, the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, Information Security Committee; in the EU, the supervisory authority of your country).
In practice, we keep no data linked to you, except the push token if notifications are on; turning them off in Qita deletes it. Search queries are not saved, usage statistics are anonymous counters, and crash reports are not tied to your identity, so we cannot find “your” records among them. Everything stored on your device is deleted together with the app. If you have written to us, we will delete our correspondence at your request. Write to support@qitaapp.com; we will reply within one month, or within the time set by the law of Kazakhstan where it is shorter.
13. Children
Qita does not ask anyone, including children, for personal data, so no parental consent is needed. If you believe a child has sent us personal data (for example, by email), contact us and we will delete it.
14. Changes to this policy
If the way Qita handles data changes (for example, if we add sign-in or a subscription), we will update this policy before the change takes effect and change the date at the top. The current version is always at qitaapp.com/privacy.
15. This website
qitaapp.com uses no cookies, scripts or analytics and keeps no log of visits.