Behesht — Privacy Policy

Behesht is a prayer-times, Qibla, Quran and daily-worship app. It works fully without an account, has no advertising, and does not sell or share personal data. An account is optional and only exists to back up your data and carry it to another phone. This page lists exactly what the app touches and why.

Everything you record in the app is stored on your device, in the app's private storage: prayer and fasting logs, Khatam progress, memorisation progress, bookmarks, notes, settings and reading position. Prayer times and the Qibla direction are calculated on the device from your location. If you do not create an account, none of it leaves the phone, and uninstalling the app deletes all of it.

If you create an account (Explore › Settings & Support › Profile & Account), we store:

• your name, email address and password — the password is stored only as a one-way hash by our authentication provider and is never visible to us;
• a copy of the data you choose to sync — you pick the groups: settings, Quran (bookmarks, Khatam, reading history, highlights, memorisation), prayers and worship (prayer, qada and fasting logs, dhikr, Ramadan, saved duas), notes, hadith, and Learn to Read progress. Groups you switch off stay on the phone only;
• the phones signed in to the account — a model name such as "Samsung A54", the platform, the app version and when each last synced.

Your email is used to sign you in and to send a code when you reset your password, nothing else. Your GPS fix and the place name the app looked up for it are never synced; a place you choose yourself in the location picker is part of your settings, so it syncs if the settings group is on. The account is hosted with Supabase (supabase.co); every row is readable only by the signed-in account that owns it. You can sign out at any time (your data stays on the phone), and Delete account removes the account and every synced copy immediately and permanently. If you no longer have the app, see how to delete your account.

Behesht asks for location while the app is in use to calculate prayer times and the Qibla. This calculation happens on the device.

Your coordinates are sent off the device in exactly one feature: Mosque Finder, which sends them to OpenStreetMap services to list nearby mosques — the Overpass API (overpass-api.de, with maps.mail.ru, overpass.kumi.systems and overpass.private.coffee as fallbacks when it is busy) and, when the tag search finds little, komoot's Photon geocoder (photon.komoot.io) — and, only if you tap a mosque or Search in Maps, opens your maps app with the destination or the search. Nothing is stored server-side by us. Every other part of the app works with location denied by choosing your city manually; Mosque Finder then searches around that city instead.

To show Quran text, translations, tafsir and recitations the app requests public, non-personal content from: api.alquran.cloud, api.quran.com, cdn.islamic.network, mp3quran.net, qurango.net, quranapi.pages.dev, and our own content feed at kurdicode.com. These requests carry no account or identifier; like any web request they expose your IP address to the host. Downloaded content is cached on the device so it works offline.

Prayer-time and reminder notifications are scheduled locally on the device. No push service and no server is involved.

If you save a card image, the app asks for permission to add it to your photo library. If you choose one of your own photos as a card background, the system photo picker opens and the app uses only the photo you pick, to draw the card on your phone. It is never uploaded.

Crash reports may be collected to fix bugs. They contain the error, the app version and device model — not your location, your logs or your content.

The app has no ads and no messaging. The optional account is hidden in Kids mode, and without an account the app collects nothing that would identify a child.

We will update this page and the date above when anything here changes.