Privacy Policy
Privacy Policy
Last updated: 14 August 2026
English translation of the Turkish original. In case of any discrepancy, the Turkish version prevails.
In brief
The most sensitive thing you give us when using Hatip is the questions you ask. Under Turkish law, religious questions are considered "special categories of personal data", and we treat them accordingly:
- Your questions are never used for advertising, profiling or analytics.
- The text of your question is not written to server logs — it is technically redacted.
- The text of your question is kept for at most 48 hours without any link to who asked it, then automatically deleted. Details in §2.1.
- If you send us an answer using the "Report" button, that question, answer and its sources are retained for review — again separated from your identity. Details in §2.2.
- Your location never reaches our servers; prayer times and qibla are calculated on your phone.
- The app contains no advertising and no third-party advertising or analytics trackers.
- When you delete your account, your chat history is deleted with it.
In return, there is one point we must be honest about: in order to generate an answer, your question is transmitted to an artificial intelligence provider located abroad. Details below.
1. Data controller
The party responsible for processing your data and its contact addresses are listed on the Contact page.
2. What data we process
| Data | Purpose | Where it is stored |
|---|---|---|
| E-mail address | Identifying your account, signing in | Server |
| Password | Sign-in — stored irreversibly using argon2id, never kept in plain text anywhere | Server |
| School of thought (madhhab) preference | Adapting answers to your preference | Server |
| Notification preferences | Which notifications you want | Server |
| Your questions and the answers you receive | Showing you your chat history | Server |
| Question counter | Tracking your free usage allowance | Server |
| Session tokens | Not forcing you to sign in every time — stored as hashes | Server |
| Subscription status | Your premium entitlement | Server |
| Location | Prayer time and qibla calculation | Your phone only |
| Notification history | Listing notifications you received | Your phone only |
| Reading and display preferences | Theme, font size, etc. | Your phone only |
2.1 Anonymous question record
The text of your question is stored for a short period so that we can improve the product. The purpose is to see which topics we fail to answer: questions that end without a source found are a direct map of the gaps in our knowledge base.
This record contains nothing that leads back to you:
| Stored | The question text, the day, the madhhab preference, whether a source was found |
| Not stored | Your user identity, e-mail, device identifier, IP address, time of day |
| Retention | 48 hours, then deleted automatically |
The record is not linked to your account; when you delete your account it is already gone, because it never had a connection to you in the first place. Not even we can tell who asked a given question.
We can disable this record entirely; if it is disabled, this section will be removed from the policy.
2.2 Answers you report
There is a "Report" button under every answer. If you find an answer wrong or objectionable and press it, that answer goes to human review; if it turns out to be faulty, we remove the underlying knowledge base entry from search.
In order to review it, we store the question you reported, the answer, and the citation details of the sources shown in that answer. What sets this apart from other records is that we are not collecting the content: by pressing the button, you are sending it to us. No answer you did not report ever enters this record.
| Stored | The reported question and answer, citation details of the sources shown (verse/hadith reference, source name, version), the reason you selected, and your note if you wrote one |
| Not stored | Your user identity, e-mail, device identifier, IP address |
| Retention | Until reviewed, at most 90 days — reviewed records are deleted sooner |
You do not need to be signed in to report, and the record is not linked to your account. This has a consequence we must be honest about: because the record has no link to you, we cannot later find and delete a specific report of yours. That is precisely the reason for it — if we could link the record to you, we would first have to retain your identity in order to be able to delete it.
You may leave the note blank. We recommend not writing information that identifies you (your name, phone number, e-mail) in that note; whatever you write there reaches the review in that form.
What we do not process
These are deliberate decisions, not technical shortcomings:
- We do not collect advertising identifiers (IDFA/GAID).
- We do not use third-party analytics SDKs — Firebase Analytics, Meta SDK, AppsFlyer and the like are not present in the app.
- We do not request your contacts, photos, call log or installed app list.
- We do not send your location to the server.
- We do not analyse your questions on a per-person basis. Daily counters (e.g. "412 questions were asked today") contain no question text, user identity or device identifier. The anonymous question record described above also cannot be linked to a person — the two are separate records and cannot be combined.
3. Special categories of personal data and your explicit consent
Your madhhab preference and the religious questions you ask constitute special categories of personal data relating to religious belief within the meaning of Article 6 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Such data is processed only with your explicit consent.
You may withdraw your consent at any time by deleting your account or by writing to the privacy address on the Contact page. When you withdraw your consent, your chat history is deleted; you may continue using sections of the app such as prayer times, qibla and the dhikr counter without an account.
4. International transfers
This section is important, please do not skip it.
4.1 Artificial intelligence provider
In order to generate an answer, your question and the source texts accompanying it are transmitted to our artificial intelligence provider (Anthropic PBC, United States of America). Without this transfer, the question-and-answer section of the app cannot function.
Transferred: the text of your question and the selected verse/hadith excerpts. Not transferred: your e-mail address, user identity, location or device identifier. The provider does not know whom the question belongs to.
4.2 Voice questions
When you ask a question by voice, your speech is transcribed by the speech recognition service of your phone's operating system. On Android this service belongs to Google and on iPhone to Apple, and depending on your device settings your voice recording may be sent to their servers. This transfer does not pass through us and is not under our control; it is subject to those companies' own privacy policies.
You can avoid this transfer entirely by never using the voice question feature; microphone permission is requested only when you press that button.
4.3 Announcement notifications (optional)
If you enable "Receive announcements instantly" in the settings, your device registers with Google's notification service (Firebase Cloud Messaging) and a device token specific to you is generated. This token is created on Google's servers and stored by us.
This option is enabled by default. If you disable it, your device does not register with the service; the record is deleted both from our server and from your device, and announcements appear only when you open the app.
The record we keep contains no information about who you are: not your account number, not your e-mail, not your device model. Only the token itself, the operating system (Android/iOS) and whether you are a premium subscriber are kept; the last of these exists so that we can send "announcements to premium users" and does not identify you.
When you disable the option, the record is deleted both from our server and from your device. Records unused for 90 days are also deleted automatically.
Important: Prayer time, verse of the day and Friday notifications are entirely independent of this option. They are calculated and scheduled on your device; they work without an internet connection and never pass through Google's notification service. Announcements are not lost while this option is disabled either — you will see them when you open the app.
4.4 App stores and subscription management
If you purchase a premium subscription, payment is handled entirely through Google Play or the App Store. We do not see, store or receive your card details.
To verify whether your subscription is valid, we use the services of RevenueCat, Inc. (United States of America). We cannot ask the app itself whether the purchase information coming from the store is genuine — if we did, anyone modifying the app could grant themselves premium.
Transferred: your account's identification number (a randomly generated number that contains neither your name nor your e-mail), the product you purchased, and the start/end dates of the subscription. Not transferred: your e-mail address, your questions, your location.
If you do not purchase premium, this transfer never takes place. In free usage, no information — including your account's identification number — is sent to this service.
Legal basis: KVKK Art. 5/2-c — necessity for the establishment and performance of a contract. When you end your subscription, your subscription record becomes subject to the retention period stated in section 5 below.
5. How long we retain data
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Chat history | Until you delete your account; you can also delete entries individually |
| Session tokens | At most 60 days; immediately when you sign out |
| Anonymous question texts | 48 hours |
| Answers you reported | Until reviewed, at most 90 days |
| Server access logs | At most 30 days |
| Anonymous daily counters | Indefinitely — contain no personal data |
Your account deletion request is fulfilled within 30 days at the latest.
6. Security of your data
- All traffic between the app and the server is encrypted with TLS.
- Passwords are stored using argon2id; even if leaked, they cannot be reversed.
- Session tokens are kept in the database as SHA-256 hashes.
- Question text and authentication headers are automatically stripped from server logs.
- Administrative panel access rights are re-verified from the database on every request.
No system is flawless. If you notice a security vulnerability, we kindly ask you to write to the security address on the Contact page.
7. Your rights
Pursuant to Article 11 of the KVKK, you have the right to:
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether the data is used in accordance with that purpose
- Know the third parties to whom it is transferred domestically or abroad
- Request rectification if processed incompletely or inaccurately
- Request erasure or destruction
- Request notification of rectification/erasure operations to the parties to whom the data was transferred
- Object to an adverse outcome arising from analysis by automated systems
- Claim compensation if you suffer damage due to unlawful processing
You may exercise these rights by writing to the privacy address on the Contact page. You may also delete your account and all your data yourself from Settings → Delete my account in the app.
8. Cookies
The app does not use cookies. The website uses only the technical storage necessary for the page to function; there are no tracking cookies.
9. Children
Hatip is not designed for children under 13. If you are between 13 and 18, you should use the app with the knowledge of your parent or guardian. If we learn that we have processed data belonging to someone under 13, we delete that record.
10. Changes
If this policy changes, the "last updated" date above will be updated. If we make a change that broadens the types of data collected or the parties to whom data is transferred, we will additionally notify you within the app and, where required, ask for your consent again.
11. Applications and complaints
For your requests and complaints, please use the privacy address on the Contact page. If your application does not produce a result, your right to lodge a complaint with the Turkish Personal Data Protection Authority remains reserved (kvkk.gov.tr).