Privacy Policy

The controller within the meaning of Art. 4(7) GDPR is the provider identified under “Controller” at the end of this policy (hereinafter “we”).

For all matters relating to data protection and the exercise of your rights, you can reach us by email at support@deenquest.de and in the app under Settings › Support.

We process personal data exclusively within the limits of the applicable statutory provisions. Depending on the processing operation, processing is based on the performance of the user agreement concluded with you (Art. 6(1)(b) GDPR), on your consent (Art. 6(1)(a) GDPR and, for special categories of personal data, Art. 9(2)(a) GDPR), on compliance with legal obligations (Art. 6(1)(c) GDPR) and on our legitimate interest in secure operation free from abuse (Art. 6(1)(f) GDPR).

The relevant legal basis is stated for each processing operation. You may withdraw any consent you have given at any time with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected.

DeenQuest is a service with an Islamic orientation. The mere use of the app, and in particular voluntary profile information such as religion, school of thought or “Islam means to me”, may allow conclusions to be drawn about your religious beliefs. Such data constitute special categories of personal data within the meaning of Art. 9(1) GDPR.

We process these data exclusively on the basis of your explicit consent, which you give when setting up your user account. The consent also extends to the automated photo review described in section 14, insofar as the image-related attributes determined in that process allow conclusions to be drawn about religious beliefs. As the app cannot be used without the processing of these data, a user account cannot be provided without such consent.

You may withdraw your consent at any time with effect for the future by removing the relevant information from your profile or by deleting your user account. Information on religion, school of thought, “Islam means to me”, relationship status, date of birth and place of residence is stored in a specially protected area and is visible to other users only in accordance with your privacy settings.

The legal basis is Art. 9(2)(a) GDPR and, for information which you have manifestly made public yourself, additionally Art. 9(2)(e) GDPR.

The home screen of the app may be used without a user account; this includes in particular prayer times, the calendar, the Qurʾān and places of prayer. No user account is created in this case. Only technical data and the requests to external services described in sections 9 and 10 are processed. Settings remain on your device. Social features and the AI assistant IVA require a user account.

The legal basis is Art. 6(1)(b) and (f) GDPR.

Registration is carried out via the sign-in services “Sign in with Apple” or “Sign in with Google”. In this context we process a unique user identifier, your email address, the sign-in method chosen and your display name. When signing in with Apple you may hide your email address; in that case we receive only a relay address provided by Apple. Authentication is technically handled by an external authentication service.

During setup you provide your name, language and gender. Stating your gender is mandatory, cannot be changed subsequently and is recognizable to other users, as several features of the app are based on it, in particular the form of address and the rules and filters for image content.

During setup you confirm that you have reached the age of 18, accept the Terms of Use and give the consent referred to in section 3. We store the time and version of these declarations for evidentiary purposes for as long as your user account exists.

Up to three user accounts may be stored and switched on one device. For this purpose a randomly generated switch key is stored on your device for each account, in the protected storage of the operating system where available; on our servers only a check value derived from it and a random device identifier are kept. When an account is signed out or deleted, the key ceases to be valid. We store the association of jointly used accounts with a device in order to prevent abuse, in particular the circumvention of bans.

The legal basis is Art. 6(1)(b) GDPR and, for evidentiary purposes and the prevention of abuse, Art. 6(1)(c) and (f) GDPR.

You may voluntarily add further information to your profile, in particular a biography, profile and cover photo, gallery, links, profession, languages, nationality, relationship status, date of birth, place of residence, religion, school of thought, “Islam means to me”, favorite surah, home mosque, and Show photo and Show text.

Your profile is intended for other signed-in users. Your name, photos, gender and all information whose visibility you have not restricted are visible to them. In the privacy settings you determine which information is visible to all users, to friends only or to no one, who may send you messages, who can find your profile and whether screenshots are permitted, to the extent this can be technically enforced. Messages from persons outside your friends list are disabled by default.

Your friends list is visible to other users only in accordance with your settings; the number of your friends is displayed on your profile. The list of users you have blocked is visible to you alone.

The app records whether you are online and when you were last online, and displays this information to other users in accordance with your settings.

When you change your profile, we store the respective previous value for a period of 14 days in order to be able to investigate abusive conduct, for example the alteration of a profile shortly after a report. The previous value is deleted thereafter.

Uploaded photos are held with an external storage service.

The legal basis is Art. 6(1)(b) GDPR, for voluntary information your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), and for the profile history Art. 6(1)(f) GDPR.

The app enables you to create posts, comments, likes, bookmarks, stories, highlights and events, to share content, to form friendships and to block other users. We store the content and the associated metadata, in particular author and time, in our database.

The viewing of a story is displayed to its author. This applies equally to views of your stories by other users.

If you activate the function “Show me in the Show”, your Show photo and Show text are displayed to other users in the Discover area. The order of display is determined by the degree to which profile information corresponds. In the Discover area users can also be found by community, profession and proximity; for the “Proximity” function we use the place stated in your profile or the location you have shared.

Content in public areas, in particular in the feed, on the public profile, in the Show and in hubs, is visible to other users. Please bear this in mind when publishing personal information.

The legal basis is Art. 6(1)(b) GDPR and, for security and moderation measures, Art. 6(1)(f) GDPR.

In private chats you exchange messages, photos and voice messages with one other user. We store this content in our database in order to make it accessible to both participants. Messages may be unsent, scheduled or given an automatic deletion period. Transmission is encrypted in transit; there is no end-to-end encryption.

The content of private chats is confidential. No automated analysis of content takes place; photos in private chats are not reviewed automatically when sent. We inspect a private conversation only if it has been reported, and only to the extent necessary to handle the report, or if you expressly authorize us to do so in the context of a support request. Where a conversation has been reported, the photos contained in it may be subjected to an automated review in accordance with section 14. Every access is logged with time and reason.

Hubs are group spaces. Messages, posts, media, events, ride shares and any shared location are visible to the members of the respective hub together with your name and your role.

For your protection, chat rules, word filters, the automatic deletion of messages and reporting and blocking functions are available.

The legal basis is Art. 6(1)(b) GDPR and, for the handling of reports, Art. 6(1)(f) and (c) GDPR.

If you enable location access in the settings of your device, the app uses your location for prayer times, prayer direction and the sundial, for displaying places of prayer in your vicinity, for the “Proximity” function in the Discover area and for sharing a location in a hub. The location is retrieved exclusively while the app is in active use, for the first time when the home screen is opened. You may remove a shared location at any time.

Without such access you determine your place by manual selection. Your location is not determined by any other means, in particular not on the basis of your IP address.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time via the settings of your device.

In order to provide individual features, the app retrieves content from external services. In doing so, your IP address and the respective request, for example a place name or coordinates, are transmitted to the service concerned. The providers of these services are independently responsible for the processing carried out by them.

The following are integrated: services based on OpenStreetMap for place search, places of prayer and travel times; CARTO for map tiles; Mawaqit for information on mosques; AlAdhan for prayer times and the calendar; alquran.cloud for the text of the Qurʾān, translations and recitation; Wikimedia Commons for photos of mosques; Cloudflare for the map library and for audio files of the app.

We convert the place stated in your profile into coordinates by means of the place search in order to provide the “Proximity” function. When you open directions or an external link, an application or website of a third party is opened, to which that party’s privacy provisions apply.

Some of these providers are established outside the European Union; in this respect reference is made to section 22. The legal basis is Art. 6(1)(b) and (f) GDPR.

With your consent we send you notifications, in particular about new messages in chats and hubs, friend requests and replies from support. For this purpose we process a device-related push token and associate it with your user account. A notification may contain the name of the sender and a short preview of the message. Delivery is effected via a delivery service provider in the USA and via Apple’s notification service.

The legal basis is Art. 6(1)(a) GDPR. Notifications may be disabled at any time in the settings of your device.

IVA is an assistant developed and operated by us and based on artificial intelligence; it is not a natural person. For its technical operation we use the platform of ElevenLabs Inc., USA; the answers are generated in accordance with our specifications by a language model of the provider Anthropic integrated there. Conversations with IVA are recorded and transmitted to the aforementioned service providers for this purpose.

Before first use we obtain your explicit consent. Without consent no connection to the aforementioned services is established.

The data transmitted comprise your input in the form of text, photos and voice messages, your name, an internal identifier, the language chosen, the previous course of the conversation and, if you have activated the “Memories” function, notes from earlier conversations. IVA receives profile information only to the extent that you have released it under “Profile access”; religion, school of thought, “Islam means to me”, date of birth and relationship status are not released by default. The “Memories” function is disabled by default.

We store the conversation history, saved chats and memories with your user account; the conversations are also held at ElevenLabs. Conversations and memories may be deleted in the app. Upon deletion of your user account we also arrange for the deletion of the conversations stored there. The giving and withdrawal of consent are logged with the time.

If you share a conversation with IVA publicly or with friends, it is visible under your name and may be rated and commented on by other users. In a shared call your voice can be heard.

The answers given by IVA are generated automatically, may be inaccurate and are no substitute for qualified religious, legal or medical advice.

The legal basis is your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). Consent may be withdrawn at any time in the settings; IVA is no longer available after withdrawal.

During a voice call the app accesses the microphone once you have granted permission. Your speech is transmitted to ElevenLabs in real time and is transcribed and processed there so that IVA can answer; IVA’s voice is synthetically generated. The recording and transcript of the call are stored so that you can view the history and so that IVA can refer to earlier conversations where the “Memories” function is activated.

The legal basis is your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). Microphone access may be revoked at any time in the settings of your device.

Photos posted in public or communally accessible areas of the app are subjected, prior to publication, to an automated review for breaches of section 7 of the Terms of Use. This covers profile and cover photos, the gallery, the Show, posts, stories, hubs, quizzes, chat backgrounds and attachments sent to support. Photos in private chats are reviewed only where a report has been made (section 8).

For the review, a reduced copy of the photo is transmitted to an AI service of Google (Gemini) without your name or user identifier. Under the provider’s contractual terms the photos are not used to improve its own products; requests are, however, logged for a limited period for the purpose of detecting abuse. Processing in the USA cannot be excluded.

In the course of the review, image-related attributes are determined and stored with the photo, namely the result of the review, the assignment to content categories, a short description of the image content, the number of persons depicted and information on the degree of clothing. No biometric identification or facial recognition takes place. Other users are provided only with such information derived from this as is necessary to implement the display filters individually chosen by them; this information is stored without a user identifier.

If a photo clearly breaches the Terms of Use, it is automatically excluded from publication. This constitutes automated individual decision-making within the meaning of Art. 22 GDPR. You receive a reasoned notice and have the right to obtain review by a natural person, to express your point of view and to contest the decision. In cases of doubt the content remains hidden until it has been reviewed by a natural person. User accounts are never banned automatically.

We retain a reduced copy of an excluded photo for up to 30 days and, where a report or complaint is pending, until it has been concluded, but for no longer than 180 days. Review results are deleted after 90 days and, in the case of photos that have been excluded or flagged for review, after 180 days.

The legal basis is Art. 6(1)(f) GDPR (ensuring a safe and rule-compliant platform) and Art. 6(1)(c) GDPR in conjunction with Regulation (EU) 2022/2065 (Digital Services Act); for attributes relating to special categories of personal data, your consent pursuant to Art. 9(2)(a) GDPR; and for the automated decision, Art. 22(2)(a) GDPR.

If you report content or a profile, we store the report with its time, type, your statement of reasons and the reported content. Every report is reviewed by a natural person. The reporting person and the person concerned are informed of the status and the outcome.

If we remove content, terminate a conversation or ban a user account, the decision is stored together with its statement of reasons. In the event of a permanent ban we maintain a block list containing the email address, reason and date in order to prevent re-registration under the same address.

In order to handle reports, support requests and malfunctions we may inspect and rectify account and content data, for example an incorrect Deenar entry. Section 8 applies to private chats. We sign in to your user account for troubleshooting purposes only with your approval or in order to handle a report; in doing so we have read-only access, and acts in your name are excluded. Every access is logged and is shown in your data copy.

The legal basis is Art. 6(1)(f) GDPR and Art. 6(1)(c) GDPR in conjunction with the Digital Services Act.

We store your quiz results, points, medals, your Questar status and completed tasks. In leaderboards your name, your photo and your score are visible to other users. Quizzes created and published by you are publicly accessible under your name and may be rated and commented on by other users.

The legal basis is Art. 6(1)(b) GDPR.

Deenar packages are purchased exclusively via Apple’s In-App Purchase. Payment processing is the responsibility of Apple as an independent controller; we do not receive payment data such as card numbers. We receive the purchase receipt showing the product, time and transaction identifier and verify it with Apple.

All movements of your Deenar balance, namely purchase, use, refund and correction, are documented in a ledger. Deenar serve to unlock services within the app, for example IVA Pro, IVA Credits, quiz energy or design elements.

We retain purchase receipts in accordance with the retention obligations under commercial and tax law, as a rule for up to ten years. This also applies after deletion of your user account.

The legal basis is Art. 6(1)(b) and (c) GDPR.

In the case of inquiries via the support form of the app, we process your display name, the email address of your user account, the area and subject, the content of your message, any attachments and the time. You receive our reply in the inbox of the app under Profile › Chats › Notifications. Alternatively, you can reach us by email at support@deenquest.de.

Support messages and attachments are visible exclusively to you and to us. They are removed at the latest upon deletion of your user account.

The legal basis is Art. 6(1)(b) and (f) GDPR.

The operation of the app generates technical data, in particular timestamps, device and connection information and server and error logs. We process these data to ensure operation, to remedy malfunctions and to prevent abuse. The app contains no analytics or advertising services; no tracking across apps or websites takes place. Updates are obtained via an update service, which in the process receives technical information about your device.

On your device the app stores the information required for it to function, namely sign-in status, settings, language, drafts, the passage of the Qurʾān last read, saved places of prayer and the current IVA chat, as well as the switch key and device identifier referred to in section 5. Such storage is strictly necessary for the provision of the features expressly requested by you (Section 25(2) no. 2 TDDDG).

The legal basis is Art. 6(1)(b) and (f) GDPR.

The website is operated with our cloud service provider. When it is accessed, the provider processes your IP address and technical details of the request in order to deliver the page and to secure operation. The website does not use cookies and contains neither analytics or advertising services nor embedded third-party content; fonts and images are delivered by the website itself. No contact form is provided; contact is made by email.

The legal basis is Art. 6(1)(f) GDPR.

We use external service providers for hosting, database, file storage, authentication and server-side functions (cloud infrastructure), for sending notifications and for providing app updates. As AI services we use ElevenLabs for IVA, with an integrated language model from Anthropic, and Google for the automated photo review. Apple receives data in connection with sign-in, purchases and notifications, and Google in connection with signing in with Google. In addition there are the providers named in section 10.

Contracts pursuant to Art. 28 GDPR are in place with our processors. Personal data are not sold or passed on for advertising purposes. Data are disclosed to authorities exclusively within the scope of statutory obligations, in particular where there is suspicion of a criminal offense involving a threat to the life or safety of persons.

The specific recipients to whom your data have been disclosed are shown in your data copy (section 25) and will be communicated to you on request.

Part of the processing takes place in the United States of America. The database and file storage are operated with a cloud service provider in a US region; account, profile and content data are stored there. The AI services for IVA and the photo review and the sending of notifications also process data in the USA. Our server-side functions are executed in the European Union (Frankfurt am Main).

Where recipients are certified under the EU-US Data Privacy Framework, the transfer is made on the basis of the adequacy decision of the European Commission (Art. 45 GDPR). In all other cases we base the transfer on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). We will provide a copy of the safeguards on request.

We store personal data only for as long as is necessary for the respective purposes or as statutory retention obligations exist. Account and content data are stored for as long as your user account exists or until you delete them. In detail, the following applies:

• Removed posts: hidden immediately and permanently deleted after 14 days; during this period they are visible only to the author and to our moderation.

• Reports: deleted 14 days after conclusion; the reasoned notice remains in your inbox for as long as the user account exists.

• Permanently banned user accounts: content and profile deleted after 14 days; the entry in the block list deleted after two years at the latest.

• Copies of excluded photos: up to 30 days and, where a report or complaint is pending, no longer than 180 days.

• Results of the automated photo review: 90 days and, in the case of photos that have been excluded or flagged for review, 180 days.

• Profile history: 14 days.

• Permissions to inspect a private conversation or your user account: until the report has been concluded and, where granted by you, 30 days or until withdrawn.

• Log of our access to private conversations and user accounts: until the end of the third year following the access, even if the user account is deleted beforehand.

• Conversations with IVA: until deleted by you or until the user account is deleted.

• Data copy: until a new copy is created or until the user account is deleted.

• Purchase receipts: up to ten years in accordance with statutory retention obligations.

Subject to the statutory requirements, you have the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You also have the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

You may delete your user account in the app at any time. Upon deletion we remove the data stored with your account, namely profile, posts, stories, chats including photos and voice messages, posts in hubs, friendships, shared locations, conversations with IVA, results of the photo review and uploaded files. This does not apply to purchase receipts subject to statutory retention obligations, the log of our access (section 23) and, in the event of a ban, the entry in the block list. If you do not have access to the app, you may request deletion by email to support@deenquest.de.

Automated individual decision-making takes place exclusively in the context of the automated photo review (section 14). In this respect you have the right to obtain human intervention, to express your point of view and to contest the decision. All other decisions, in particular the banning of a user account, are taken by a natural person.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Under Settings › Account › “Download my data” you may at any time create a copy of the data stored with your user account, both as a readable PDF document (access pursuant to Art. 15 GDPR) and as a JSON file (data portability pursuant to Art. 20 GDPR). The copy also sets out purposes, recipients, retention periods and your rights. Data held exclusively by a service provider, such as the recording of a call with IVA, will be made available to you on request.

The copy is generated on our servers and stored in a protected area which only you can access via your user account. When a new copy is created, the previous one is deleted; for technical reasons this is possible no more than once every ten minutes. After downloading, the file is located on your device and must be protected by you against access by third parties.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 15 and Art. 20 GDPR.

The service is intended exclusively for persons who have reached the age of 18. We do not knowingly process data of minors. If we become aware that a user account is held by a minor, we close the account and delete the associated data.

We amend this Privacy Policy whenever changes to the processing of data or to the legal situation so require, for example upon the introduction of new features. The version published in the app with the date stated above is authoritative. We inform you of material changes in the app. Where a change requires your consent, we obtain it in advance.

Hikmah Hub, owned by Chris Richter
c/o MDC#962, Welserstraße 3, 87463 Dietmannsried
support@deenquest.de