Privacy Policy: Tilawi
Last updated: October 2026 (Tilawi 3.1)
Tilawi (Android package and iOS bundle com.durako.tilawi) is published by Durako.
Tilawi is built to need almost nothing about you. There is no account. The AI runs entirely on your device, your recitation is never uploaded, and your progress stays on your phone. A few features send something off the phone; this page lists each of them.
On this page
Your data stays on your phone
Your reading position, memorisation progress, statistics and preferences are stored on your device, and in your phone's own backup (iCloud or Google) if you use one; Tilawi has no copy of them on a server. Deleting the app deletes them from the phone, not from your phone's backups. What the features below send off the phone is not deleted with the app; each section says how to remove it.
On-device AI
Voice search and Practice (checking your recitation from memory) are processed entirely on your device. Your recordings are never uploaded and never leave your phone.
Location
If you allow it, your location is used on your phone to calculate prayer times and the qibla, to show places near you, and to check that you are at a place you report as halal. You can choose a city instead. On Places' map, once you have allowed your location, the map shows where you are, and the map's provider (below) may receive your position.
Qur’an audio, lectures, places and updates
Recitations are downloaded from EveryAyah (everyayah.com); Learn's catalog and lectures, the list of mosques and halal places and, when you add a place, the restaurants and food shops of the area around you from media.tilawi.ai (Cloudflare); podcasts from their publishers; the app checks Expo's update service (expo.dev) for new versions of its code, sending only what is needed to deliver the right update (app version, platform, a random installation identifier). These services see your IP address, as with any web request.
A mosque's own prayer times
When you open a mosque, its own times are read from the timetable service it uses (Mawaqit, My-Masjid or vaktija.ba). That service receives the mosque's reference and your IP address.
The map
Places' map shows maps from Apple Maps on iPhone and Google Maps on Android. The provider receives the area you look at and your IP address, your position when you have allowed your location, and usage and diagnostic data for its own service (Google counts the daily users of its map on Android). Their privacy policies apply: Apple (apple.com/legal/privacy) and Google (policies.google.com/privacy). The pins come from the list on your phone.
Directions
When you tap Directions on a mosque or halal place, the place's position and name are handed to your phone's maps app (Apple Maps on iPhone, the app you choose on Android), under its own privacy policy.
Reports on places
When you report something about a halal place or a mosque (for example that you saw a halal certificate, that alcohol is served, or that a mosque has a prayer space for women), or mark a place as a favourite, Tilawi's server (community.tilawi.ai, Cloudflare) receives the place, what you reported and a random key made on your phone; for a place from OpenStreetMap that is not on Tilawi's list yet, its name, kind and position as OpenStreetMap has them; for a report that a place is halal, that your phone found you at the place (your position itself is not sent). Apple's App Attest or Google's Play Integrity checks that the request comes from the real app on a real phone. No name. Everyone sees the counts, never who. To limit abuse, the server keeps the key's registration (the public key of its attestation) and, for a phone that broke the rules, a block; your IP address only as a hash salted per day, deleted by a regular cleanup within about two days. You can remove all your reports at any time in the app (All of Tilawi › Privacy › Remove all my reports). Only the app can do this: the key is known only to your phone, so a request by mail could not be matched to you.
Supporting Tilawi
Tips and monthly support are paid through the App Store or Google Play and processed by RevenueCat. RevenueCat is contacted when you open the Support Tilawi page and, while you support monthly, when the app starts or comes back to the front; it receives an anonymous identifier made for the app (the Support ID), your device platform, app version and country, and your purchases (see RevenueCat's privacy policy, revenuecat.com/privacy-policy). Tilawi never sees your payment details. Every tip and every new monthly support appears on the list of recent supporters (support.tilawi.ai) with its country and day, whether it is a tip or monthly support, and the duʿāʾ if you chose one; nothing else about you is shown. To keep that list and its counts, Tilawi's server keeps the purchase records (the store's transaction, the Support ID, the product, the time, renewals and refunds). To have RevenueCat's and Tilawi's records deleted, write to us with the Support ID shown on the Support Tilawi page. Apple and Google keep their own purchase records, and deleting does not cancel monthly support: that is done in the store.
Notifications
Prayer-time notifications and the optional listening reminder are scheduled on your phone. There is no push service and no notification token.
Donations
If you donate on this website, the payment is handled by PayPal under their own privacy policy. We never see or store your payment details.
No ads and no tracking
There are no ads and no tracking in the app, and Tilawi itself has no analytics of how you use it. The map's provider collects usage and diagnostic data for its own service, as described above.
This website
tilawi.ai sets no cookies and runs no analytics or third-party scripts; its fonts are served from this site. Your language choice is remembered in your browser's local storage. Like any web host, our hosting provider (Cloudflare) processes your IP address to deliver the pages.
Changes to this policy
We may update this policy. We will post the new policy on this page and change the date above.
Contact
Questions or requests about this policy: [email protected].