Privacy Policy — Mutaba

1. Introduction

Welcome to Mutaba ("we," "our," or "us"). Mutaba is a mobile and web application designed to help Muslims track their daily ibadah (worship), read and listen to the Quran, follow prayer times, find Qibla direction, count tasbih, read doa and dzikir, track Ramadan progress, and enhance their spiritual journey.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Mutaba application on Android (Google Play Store), iOS (App Store), or the web version. Please read this policy carefully. By using Mutaba, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Preferences & Settings: Language preferences, prayer time calculation method (among 23+ global methods), adzan notification settings (per-prayer toggle, muazin voice selection, sound mode), notification preferences, display preferences (dark/light mode), Quran reading settings (script type, font size, transliteration/translation toggle, word-by-word mode), and tasbih counter settings (vibration, sound, default target).
• Ibadah (Worship) Data: Daily prayer tracking records (5 obligatory prayers + sunnah practices like Rawatib, Dhuha, Tahajjud, and Witir), custom ibadah items you create, prayer completion reasons, and fasting logs.
• Quran Reading Data: Last-read position (surah, ayat, and Mushaf page number), bookmarks (surah + ayat references), khatam (completion) targets and progress, surah read marks, reading sessions (duration and surah), and reading targets (minutes per day).
• Tasbih Data: Dzikir counter session history including preset name, count, and target for each session.
• Personal Notes: Any notes you create within the app, including title and content.
• Ramadan Data: Daily Ramadan checklist data (sahur, puasa, tilawah, sedekah, tarawih, witir, qiyamul lail, doa, dhuha, dzikir) and custom Ramadan items.

2.2 Information Collected Automatically

• Location Data: With your explicit permission, we access your device's GPS coordinates to provide accurate prayer times, Hijri calendar dates, and Qibla direction. Location data is cached locally on your device (refreshed every 6 hours) and sent to third-party APIs (AlAdhan for prayer times, BigDataCloud for city name resolution) but is not stored on our servers. If location permission is denied, the app defaults to Jakarta coordinates.
• Device Information: Device type, device model name, operating system version, app version, and screen dimensions to optimize your experience and for push notification registration.
• Push Notification Token: When you grant notification permission, your Expo Push Token (or Web Push subscription on browser) and device model name are sent to and stored on our backend server to deliver push notifications and in-app announcements. This is the only personal-adjacent data stored on our servers.
• Usage Analytics: Anonymous usage patterns (screen navigation events with screen name and route segments) to improve the app. We use Aptabase (self-hosted at aptbase.awans.id), a privacy-first analytics platform. No personal data, location, or worship records are included in analytics events.
• Compass & Motion Sensors: The Qibla compass feature accesses your device's magnetometer (compass) and heading sensors. This data is processed entirely on-device in real-time and is never transmitted or stored.

2.3 Information We Do NOT Collect

• We do not collect your name, email address, or phone number.
• We do not require account registration or login.
• We do not collect payment information.
• We do not track your browsing history outside the app.
• We do not sell your data to third parties.
• We do not use advertising SDKs or ad trackers.
• We do not record audio from your microphone.

3. How We Use Your Information

We use the collected information to:

• Provide accurate prayer times based on your location and selected calculation method.
• Display correct Qibla direction using your GPS coordinates and compass sensors.
• Calculate and display Hijri calendar dates.
• Store your ibadah tracking data, Quran bookmarks, reading progress, tasbih history, notes, and Ramadan data locally on your device.
• Deliver push notifications for prayer time reminders (adzan) and app announcements.
• Fetch and display in-app notifications about updates, promotions, or important information.
• Stream Quran recitations (murottal) and Haramain audio recordings.
• Fetch Quran text data (Arabic, translation, transliteration, tafsir) from content APIs.
• Fetch doa/dzikir content and Islamic articles.
• Provide clipboard functionality when you copy Quran ayah text.
• Deliver haptic feedback for tasbih counting, Qibla alignment, and UI interactions.
• Personalize your app experience (theme, language, Quran font, reading preferences).
• Deliver over-the-air (OTA) app updates via Expo Updates to fix bugs and add features without requiring a store update.
• Improve app performance and fix bugs through anonymous analytics.

4. Data Storage & Security

4.1 Local Storage (On-Device)

All personal data — including ibadah records, Quran reading progress, bookmarks, tasbih counts, notes, Ramadan checklist, and preferences — is stored locally on your device using two storage mechanisms:

• SQLite Database (mutaba.db) — the primary storage for all user data on native platforms (Android/iOS). Uses WAL (Write-Ahead Logging) mode for performance.
• AsyncStorage — secondary/backup storage and primary storage for the web version. Also used for API response caching.

We do not maintain central servers that store your personal worship data. Your data lives entirely on your device.

4.2 Server-Side Storage

The only data stored on our backend server is:

• Push notification tokens — your Expo Push Token and device model name, used solely to deliver notifications to your device.
• Cached content data — Quran text, doa/dzikir content, murottal metadata, and Haramain recordings metadata are cached on our server to serve the app. This is publicly available Islamic content, not personal data.

4.3 API Calls & Data Flow

The app makes requests to the following APIs:

Our Backend API (api.mutaba.net)

• Push notification token registration (your token + device model)
• In-app notification delivery (announcements, updates, promotions)
• Quran text data (sourced from Quran.com API, cached on our server)
• Doa/dzikir content (sourced from BekalIslam.online, parsed and cached)
• Murottal reciter and surah listings (sourced from archive.org)
• Haramain recording categories and audio listings (sourced from haramain.info)

All requests to our backend are authenticated with an API key. No personal worship data is ever sent to our server.

Third-Party APIs (Direct)

• AlAdhan API (aladhan.com) — prayer times, Hijri calendar conversion, and Qibla direction. Only your latitude/longitude coordinates are sent.
• BigDataCloud API (bigdatacloud.com) — reverse geocoding (converting GPS coordinates to city/province names). Only coordinates are sent.
• Quran.com API (api.quran.com) — Quran verse data including Arabic text, translations, transliterations, and word-by-word data. No personal information is sent.
• Rumaysho.com (WordPress REST API) — Islamic article content. No personal information is sent.
• IslamCan.com — adzan audio files for notification sounds. No personal information is sent.
• Archive.org — murottal (Quran recitation) audio streaming. No personal information is sent.
• Aptabase (aptbase.awans.id) — anonymous screen navigation analytics only.

4.4 Caching

To improve performance and enable offline access, the app caches various content locally:

• Prayer times and Hijri dates — cached for 24 hours
• City name (reverse geocoding) — cached for 24 hours
• Location coordinates — cached for 6 hours
• Quran text (surah, mushaf pages, tafsir) — cached in SQLite indefinitely until manually cleared
• Doa/dzikir content — cached for 24 hours
• Islamic articles — cached for 6 hours

You can clear Quran text cache from the app settings. All other caches expire automatically.

4.5 Security Measures

• Data encryption in transit (HTTPS/TLS for all API calls).
• API key authentication for all backend requests.
• Local storage using platform-native security (SQLite on native, AsyncStorage on web).
• No transmission of personal worship data to external servers.
• Self-hosted analytics platform (Aptabase) — data not shared with third-party analytics companies.

5. Device Permissions

Mutaba may request the following device permissions:

• Location (GPS): For prayer times, Qibla direction, and city name display. Required for core features, but the app falls back to Jakarta if denied.
• Notifications: For adzan (prayer time) reminders, in-app announcements, and app updates. Optional — the app works fully without notifications.
• Compass / Magnetometer: For the Qibla compass feature. Used only on the Qibla screen, processed on-device only.
• Haptics / Vibration: For tasbih counting feedback, Qibla alignment confirmation, and UI interactions. Can be disabled in tasbih settings.
• Audio Playback: For murottal (Quran recitation), Haramain recordings, and adzan notification sounds. No microphone access is requested.
• Clipboard: Only when you explicitly tap the copy button to copy Quran ayah text. We never read your clipboard automatically.
• Internet: For fetching content, prayer times, and delivering notifications. Many features work offline after initial data load.

6. Third-Party Services

Mutaba uses the following third-party services:

• Google Play Store / Apple App Store — for app distribution (their respective privacy policies apply).
• Expo / EAS — app development framework and over-the-air update delivery. Expo collects minimal metadata for update delivery (see Expo's privacy policy).
• Aptabase — self-hosted, privacy-first analytics. Only anonymous screen navigation events are tracked. No personal data is shared.
• AlAdhan.com — Islamic prayer times and Qibla direction API (see their privacy policy).
• BigDataCloud — reverse geocoding API (see their privacy policy).
• Quran.com — Quran verse data API (see their privacy policy).
• Rumaysho.com — Islamic articles via WordPress REST API.
• Archive.org — Quran recitation (murottal) audio hosting.
• IslamCan.com — Adzan audio files for notification sounds.

7. Data Handling by Feature

The following table details what data each feature uses, where it is stored, and what is transmitted:

8. Children's Privacy

Mutaba is suitable for users of all ages. We do not knowingly collect personal information from children under 13 (or applicable age in your jurisdiction). The app does not require registration and stores data only on the device. The only server-side data (push notification tokens) does not contain personally identifiable information.

9. Your Rights

You have the following rights regarding your data:

• Access: All your worship data is stored on your device and is accessible to you at all times.
• Deletion: You can delete all app data by clearing the app's storage or uninstalling the app. You can also clear specific data:
  • Clear Quran cache from Settings → Reading Settings
  • Clear tasbih history from the Tasbih screen
  • Delete individual notes from the Notes screen
• Portability: Your data is stored locally and can be managed through your device's settings.
• Opt-out of Location: You can revoke location permissions at any time through your device settings. The app will default to Jakarta coordinates for prayer times.
• Opt-out of Notifications: You can disable push notifications through your device settings, or disable adzan notifications individually per prayer within the app's Adzan Settings.
• Opt-out of Analytics: Aptabase respects Do Not Track (DNT) browser settings. On mobile, analytics are minimal and anonymous (screen views only).

10. Data Retention

• Local data: Retained on your device until you clear app data or uninstall the app. Reading sessions are retained for 90 days, tasbih history retains the last 100 sessions.
• Push tokens: Stored on our server until the token becomes invalid or you uninstall the app.
• Analytics: Anonymous screen view events are retained on our self-hosted Aptabase instance according to Aptabase's default retention policy.
• API caches: Automatically expire (6–24 hours depending on the data type).

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last Updated" date at the top of this page. Significant changes may be communicated via in-app notifications. We encourage you to review this Privacy Policy periodically. Continued use of the app after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or Mutaba's data practices, please contact us at:

• Email: privacy@mutaba.net
• Website: https://mutaba.net
• Telegram: t.me/mutabanet

13. Governing Law

This Privacy Policy is governed by the laws of the Republic of Indonesia. Any disputes arising from this policy shall be resolved in the courts of Indonesia.