Zikrist Privacy Policy
Last updated: 6 October 2026
Who we are: Zikrist is published by Khizar Javed, an individual developer in the United Kingdom, who decides how your data is used (the "controller").
Privacy questions: privacy@zikrist.com · Everything else: support@zikrist.com
In short
- Zikrist works on your phone. Without an account, your recitations, journal, photos, prayers, feelings and location stay there.
- Signing in is optional. If you sign in, Zikrist keeps a copy of your journal and photos, reading sessions, bookmarks, prayers and feelings, and settings, so you can get them back on another phone. Only you can see it, and you can delete it at any time.
- Your voice is processed on your phone and never saved or uploaded.
- There are no ads, no tracking and no analytics, and Zikrist never sells your data.
- Unless you turn them off, anonymous crash reports help fix problems.
Using Zikrist without an account
Microphone and recitation
Zikrist uses the microphone to follow your recitation. While Home is open, it listens for the opening Bismillah or a surah, so you can begin without touching the screen; your phone shows a microphone indicator while it listens. While you read a passage, it can listen to follow along, and once a recitation starts it can keep listening while the screen is locked, until you stop.
The sound is processed by a speech model that runs on your phone. Audio is never saved or uploaded, and no one else hears it.
Zikrist keeps a history of your reading sessions: when you recited or read, and which surahs and ayahs you reached. On iPhone, a Live Activity on the lock screen can show the surah you are reciting; it is made on your phone.
Location, Qibla and prayer times
With your permission, Zikrist uses your location while the app is open to find the direction of the Kaaba and to work out prayer times. The calculation happens on your phone. For prayer times and the azan, Zikrist keeps a rounded position, to about 1 km, on your phone. Your location is never sent anywhere, and it is not part of your account's backup.
Your phone's location service decides where you are, using GPS, Wi-Fi or mobile networks under your phone maker's terms. If you say no, everything except the Qibla, prayer times and the azan works as usual.
Journal, photos, prayers and feelings
Journal pages, drafts, drawings and photos are stored on your phone. You add photos through your phone's photo picker, so Zikrist receives only the photos you choose. It does not use the camera.
When you record your daily prayers or how you feel, Zikrist keeps that on your phone too. It uses the feelings you pick, on your phone, to suggest ayahs and recitations that suit them.
Downloads from public services
The Arabic Quran, an English translation and the Al-Mukhtasar commentary are built into the app. Zikrist goes online to download only what you use:
| What | From |
|---|---|
| A translation you choose, and the list of available translations | QuranEnc (quranenc.com), Al Quran Cloud (api.alquran.cloud), Quran.com (api.quran.com), and the Quran API on jsDelivr (cdn.jsdelivr.net) |
| Recitations, for listening and for passages Home suggests | Islamic Network (cdn.islamic.network) |
| The azan voice you choose | Zikrist's public audio collection on GitHub (github.com/Khizar699/zikrist-audio), through jsDelivr or GitHub |
Recitations are kept on your phone, up to 300 MB, and the ones played longest ago are removed first. These downloads can use mobile data.
Like any website, these services can see your IP address and which file was asked for. Zikrist sends nothing else with the request.
Azan
If you turn on the azan, Zikrist asks permission to show notifications and schedules them on your phone for the prayer times you choose. No server sends them.
With an account
Signing in
You can sign in with Apple (on iPhone and iPad), Google, or a code sent to your email. Zikrist never sees a password.
- Apple gives Zikrist an account identifier and an email address, which can be a private relay address that hides your real one. The first time only, it also gives the name you choose to share.
- Google gives Zikrist an account identifier, your email address and your name.
- Email codes are sent by Resend, an email service, to the address you type.
To sign in you confirm that you are 13 or older.
What is backed up, and why
When you sign in, Zikrist keeps a copy of these on its servers, so you can get them back on another phone or after reinstalling:
- journal pages and their photos;
- finished reading sessions (when, and which surahs and ayahs);
- bookmarks, and the last ayah you read;
- your daily prayers and the feelings you picked, with their times;
- settings: reading view, prayer-time method, azan choices, reciter and translation.
It does not back up recitation audio, downloaded translations or azan voices, your location, journal drafts, or whether the azan is switched on.
Some of this shows your faith and how you feel. The law treats that as special category data, so Zikrist backs it up only with your explicit consent. The sign-in screen asks for it in plain words, and Zikrist records which version of that agreement you accepted and when. You can withdraw it at any time by signing out and choosing Remove from this phone, or by deleting your account.
The backup is used only to keep your data and return it to you. No one at Zikrist reads it, except to fix a fault you report and ask us to look at.
Where it is stored, and how it is protected
The backup and your sign-in are held by Supabase, in Mumbai, India. Photos are stored as private files in your own folder there. The data is encrypted in transit and at rest, and access rules on every table mean each account can reach only its own data. The backup is not end-to-end encrypted, so it is protected by those rules rather than by a key only you hold.
For security, Supabase keeps a record of sign-ins, including the time, IP address and device type, for a limited time.
Signing out and deleting your account
- Sign out in Profile › ACCOUNT. You choose to keep your data on the phone or remove it from the phone. Either way, the backup stays in your account until you delete it.
- Delete account in Profile › ACCOUNT. Your login, the backup and your photos are deleted at once. Copies in Supabase's own backups expire within 7 days. What is on your phone stays until you remove it or uninstall the app.
- Without the app: email privacy@zikrist.com from the address on your account, and we will delete it within 30 days.
Crash reports
If Zikrist crashes or hits an unexpected error, it sends a report so the problem can be fixed, unless you turn this off in Profile › ABOUT › Send crash reports. The choice belongs to that phone.
Reports go to Sentry, a crash-reporting service, and are stored in the European Union (Germany). A report holds the error and where in the app's code it happened, a short list of recent app events (such as which screen was open), the app version, and the phone model and system version. It never holds your audio, recitations, journal, photos, prayers, feelings, location, name, email or account. Zikrist removes such details before a report leaves your phone and asks Sentry not to store your IP address. Reports are deleted automatically within 90 days.
What Zikrist does not do
Zikrist has no ads, advertising identifiers, analytics or tracking across other apps and websites. It does not sell or share personal data, and it does not make decisions about you automatically. It is free, with no purchases or subscriptions.
Who handles your data for us
These services process data only to run Zikrist, under their data processing terms:
| Service | What it handles | Where |
|---|---|---|
| Supabase | Your sign-in and the backup | Mumbai, India |
| Resend | The email address a sign-in code is sent to | Ireland |
| Apple, Google | Signing in with them, under their own privacy policies | Their services |
| Sentry | Crash reports | Germany |
| Cloudflare | Emails you send to our @zikrist.com addresses, forwarded to our inbox | Cloudflare's network |
When your data is held outside the UK or the European Economic Area, as in India, it is protected by the standard data protection clauses in each provider's terms.
Why the law lets us use your data
- The backup and sign-in: your consent, which is explicit consent for the faith and feelings it includes.
- Crash reports, sign-in security records and downloads: our legitimate interest in keeping Zikrist working and secure, which you can object to (for crash reports, by turning them off).
- Answering your emails: our legitimate interest in replying to you.
How long we keep it
| Data | Kept |
|---|---|
| The backup and your sign-in | Until you delete your account |
| Supabase's own backups | 7 days after a deletion |
| Crash reports | Up to 90 days |
| Emails you send us | As long as needed to answer, then up to 2 years |
Your rights
You can ask to see, correct, download or delete your data, to limit how it is used, or object to its use, and you can withdraw consent at any time. Most of this you can do in the app; for the rest, email privacy@zikrist.com and we will answer within 30 days. If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.
Device backups
Your phone's own backup (iCloud on iPhone and iPad, Google on Android) may include Zikrist's data on the phone, depending on your settings. Apple or Google keep those backups under their own terms. You can leave Zikrist out of them in your phone's settings.
Children
Zikrist is for a general audience. Accounts are for people 13 and older, or older where local law sets a higher age for consent. Without an account, what a child does in Zikrist stays on the phone. If you believe a child under 13 has an account, email privacy@zikrist.com and we will delete it.
Changes to this policy
When this policy changes, the new version is published at zikrist.com/privacy with a new date. If a change affects what is backed up or why, the app asks for your consent again.
Contact
Privacy questions and requests: privacy@zikrist.com. Zikrist is published by Khizar Javed, United Kingdom.