← Back to Noor Al Dua

PRIVACY POLICY

Noor Al Dua, published by Daynoor LLC • Last updated: 30 September 2026

This Privacy Policy explains how Daynoor LLC trading as Daynoor (“Daynoor,” “we,” “us”) collects, uses, stores, and shares information when you use the Noor Al Dua mobile application and related websites (together, the “Services”), including https://www.nooraldua.com.

By creating an account, redeeming a family login code, or using the Services, you agree to this Policy. If you do not agree, do not use the Services.

1. Who we are

Daynoor operates Noor Al Dua, a dua and azkar memorization app (lessons, recitation practice, optional community listening for eligible adult users, reminders, and progress such as streaks and badges).

Controller: Daynoor LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.
Privacy and support contact: svhr93@gmail.com

2. Who the Services are for; how accounts are created

Independent email or Google accounts are only for users who are 13 years of age or older. We do not create independent email or Google accounts for children under 13, and we do not permit a parent to create an independent email or Google account in a child’s name.

Before you create an independent account, we will ask you to confirm that you are 13 or older and that you are creating the account for yourself, not for a child under 13. By continuing with email or Google, you represent that those statements are true.

We also ask for age during setup. If you indicate that you are under 13 after an independent account has been started, we will not complete setup. We will close that account and delete the personal information collected during sign-up. An under-13 user must not continue on that email or Google session, including by “switching” it into a child login.

A child under 13 must not use email or Google. A parent or organizer who is 13 or older (the person who pays for a family package should be an adult) may buy a family package and generate family login codes. The organizer sets each child’s age and role. The child authenticates only with that parent-issued code. A family login is not an email or Google account. Children in kids mode cannot use Community. Recitations a child records for lessons are available only to that child’s parent(s) in the same household, not to siblings as a public feed, not to other families, and not to Community.

Store age ratings (for example 8+) describe content intensity. They do not allow a child to create an independent email or Google account. If you believe a child under 13 has an independent email or Google account, contact svhr93@gmail.com and we will delete it.

3. Information we collect

a) Independent account and profile (13+ email or Google)

Email address, password (stored hashed by our auth provider), and, if you use Google Sign-In, your Google account identifier, name, and email. Your confirmation that you are 13 or older. Profile fields you provide: display name / username, gender, age, Arabic level, transliteration preference, weekly practice commitment, reminder time, language (English or Urdu). Internal user ID (a random identifier, not your email).

b) Family-code child logins

Nickname, age (set by the parent for lesson pacing), household membership, and progress. We do not require a child’s email or Google account. We do not collect a child’s gender unless a future feature truly needs it (Community is off for kids).

c) Learning progress

Lessons and stars completed, XP, streaks, badges, review due dates, practice minutes, stored on the device and synced when signed in.

d) Audio and recitation

Microphone audio when you choose to practise or record a dua. On-device or operating-system speech recognition may run on the device. Recordings submitted for scoring are sent to our recitation evaluation service to produce a transcript and word-level scores. We do not use children’s recordings to train or improve detection. If an eligible adult shares a recitation with Community, we store the audio and related metadata so other eligible users can listen. Children cannot publish to Community. A child’s lesson recordings are stored so the parent(s) in the household can listen and delete them.

e) Community and reports (adults)

Recitations you publish, word marks and reviews, listener activity, and reports (app issues or unfaithful reviews).

f) Notifications

If you enable reminders or announcements: device push token, reminder schedule, and in-app inbox / announcement receipts. We use Firebase Cloud Messaging for some notifications. Child logins do not receive Community social pings.

g) Product analytics (Help improve the app)

If this setting is on (it is on by default), we send usage events so we can see where people get stuck and what to improve. Examples: screens opened, lessons started or quit, quiz and revision sessions, search you submit (not every keystroke), Community listen/share/mark, and similar actions.

Those events are tied to your internal user ID, not your email or name. They may include coarse product facts such as Arabic level, weekly commitment, whether onboarding is done, app language (English or Urdu), and transliteration on/off. They do not include your email, display name, gender, exact age, lesson Arabic, recitation audio, transcripts, or evaluator scores.

If you search the library, we may store the search words you committed (tap a result, tap a suggestion, or leave the search screen), shortened and without email-like text. We do not log each letter as you type.

We do not record your screen, tap heatmaps, or session replay.

You can turn this off in Settings → Help improve the app. Crash reports (below) stay on so we can fix crashes.

h) Crash and diagnostics

If the app crashes on Android, we may receive a crash report (device type, OS, app version, and the screen or lesson in progress) through Firebase Crashlytics. Crash reports are for fixing bugs. They are not used as product analytics. We instruct Crashlytics not to include emails, recitation audio, or evaluator payloads.

i) Device and technical data

App version, device OS, language, approximate timezone (for reminders), and local cache such as reciter audio.

j) We do not currently

  • Show third-party advertising or sell personal information.
  • Collect advertising IDs.
  • Collect precise GPS, contacts, or photo-library access (sharing a badge image creates a file you choose to share).
  • Require payment to create a 13+ independent account. A paid family package is a separate product.

4. How we use information

  • Provide lessons, reciter audio, progress sync, badges, and reminders.
  • Verify eligibility for independent accounts and close accounts that are not eligible.
  • Score recitations and (if an adult opts in) improve detection quality. Children are opted out of detection-improvement and cannot opt in.
  • Run Community with gender-respecting listening for eligible adults (female recitations are only played to users who have identified as female).
  • Let parents review their own children’s lesson recordings.
  • Moderate content, handle reports, prevent abuse and fraud, and secure accounts.
  • Send service messages and, if you allow, study reminders and admin announcements.
  • Understand product usage (with Help improve the app on) so we can fix drop-offs and catalog gaps.
  • Diagnose crashes.
  • Comply with law and enforce our Terms.

5. Legal bases (EEA/UK, if applicable)

We process data to perform the contract, with consent (microphone, optional detection improvement for adults, optional notifications, optional product analytics), for legitimate interests (security, eligibility, aggregate improvement, fraud prevention, crash diagnosis), and to meet legal duties. A paid family package purchase by the parent is the consent event for creating a child login and processing that child’s lesson recordings for scoring and parental review.

6. Sharing

Processors under contract:

  • Supabase — authentication, database, file storage.
  • Google — Google Sign-In for 13+ users; Firebase Cloud Messaging; Google Fonts; Firebase Crashlytics (Android crash reports); Google Analytics (GA4) only for account conversion events (sign_up and login), not for search text or lesson content.
  • PostHog, Inc. — product analytics on PostHog Cloud United States. Usage events described in section 3(g). No session replay. IP addresses are anonymized in our PostHog project.
  • Cloudflare — published reciter audio via audio.nooraldua.com.
  • Our recitation evaluation host — audio submitted for scoring.
  • Apple and Google as platform operators.

We do not sell personal information. Other users hear an adult Community recitation only if that adult published it. They do not hear children’s lesson recordings. Other Community users do not see your name; we do not label posts “Anonymous.”

7. Retention

  • Independent 13+ account and profile: until you delete the account or we close it.
  • If we close an account because the user is under 13: we delete personal information collected during that sign-up, except limited records we must keep to prevent repeat abuse or to meet law (for example, that an ineligible signup was refused).
  • Child login and lesson audio: until the parent deletes the child login / audio or the household is closed.
  • Progress: while the account exists; local copies remain until uninstall.
  • Adult Community audio: until removed by the user or by moderation.
  • Evaluation audio: processed to produce scores; not used for detection improvement when opted out or for children.
  • Product analytics events: retained by PostHog and (for sign_up / login) Google Analytics according to those products’ retention settings, until you opt out of collection going forward or we delete the account-linked identifier.
  • Crash reports: retained by Firebase Crashlytics according to that product’s retention.
  • Push tokens: until sign-out, uninstall, or expiry.
  • Reports: as needed for safety.

8. Security

Transport encryption, access controls, and database rules. No method of transmission is 100% secure.

9. International transfers

Processors may store data outside your country (including the United States). PostHog and Google process analytics and crash data in the United States. Where required (including GDPR), we rely on those providers’ data processing terms and standard contractual clauses or equivalent safeguards.

10. Your rights

Depending on where you live, you may request access, correction, deletion, export, or restriction, and object to certain processing. Contact svhr93@gmail.com. You may complain to your local data protection authority.

You can edit some profile and reminder settings in the app, turn Help improve the app off (stops new product analytics events; does not erase history already stored with our processors), turn recording-improvement off (adults), disable notifications, sign out, and request account deletion in Settings (or svhr93@gmail.com until the in-app control exists). Parents can revoke family codes and delete child logins and that child’s recordings.

11. Children’s privacy

We do not knowingly create independent email or Google accounts for children under 13. We ask for a 13+ confirmation before independent sign-up. If we learn a user of an independent account is under 13, we close that account and delete sign-up data as described in sections 2 and 7.

Child logins exist only under a parent’s family package, without Community, with lesson recordings limited to parents. We do not send product analytics search terms or recitation audio for the purpose of advertising. Parents who believe we have data we should not have should email svhr93@gmail.com.

12. Third-party services

Reciter recordings, fonts, sign-in, notifications, crash reporting, and analytics rely on third parties listed in section 6. Their own privacy notices apply to their processing as processors or independent controllers where the law treats them that way.

13. Changes

We will post updates here and change the “Last updated” date. Material changes may also be notified in the app or by email.

14. Contact

Daynoor LLC / Noor Al Dua
30 N Gould St Ste R
Sheridan, WY 82801
USA
svhr93@gmail.com