Privacy policy
Effective 19 October 2026. This policy explains what data the Aman apps for Android and Windows and the website amanapp.dev handle, why, who else receives it, and the rights you have.
The short version
- Aman shows no ads and contains no advertising or analytics SDKs. We never sell or rent your data, and we never use it for advertising.
- Your habits, Quran progress, protection settings, screen time and browsing checks are processed and stored on your device. We cannot see them.
- You don't need an account. A Google sign-in is only used for Premium, and you can delete it at any time.
- “Stays on your device” doesn't mean nothing ever leaves it. When you use prayer times, the Quran or website blocking, the online services that provide them receive what they need, such as your location, the surah you open or the website name being looked up. Every one of them is listed in section 3.
Contents
- 1. Who is responsible
- 2. Data that stays on your device
- 3. Services Aman connects to
- 4. Website blocking and the VPN
- 5. Android permissions
- 6. Your account
- 7. Premium purchases
- 8. The early access list and testing
- 9. When you contact us
- 10. This website
- 11. Legal bases
- 12. International transfers
- 13. How long we keep data
- 14. Security
- 15. Your rights
- 16. Notice for US residents
- 17. Children
- 18. Changes to this policy
1. Who is responsible
Aman is developed and published by Anton Jutbo Alvarez, a Swedish sole proprietorship (enskild firma) trading as Aman apps, who is the data controller for the personal data described in this policy (“we”, “us”). This policy is written to meet the EU General Data Protection Regulation (GDPR).
For any privacy question or request, email [email protected]. We are not required to appoint a Data Protection Officer, but every request sent to this address is read and answered by us personally.
2. Data that stays on your device
Most of what Aman works with is created, processed and stored only on your device. It is not sent to us or to anyone else, and we have no way to access it:
- Habits: your habits, focus sessions, reminders, streaks and history.
- Quran: reading progress, bookmarks, memorized ayahs, revision schedule and reading settings. Downloaded Quran text and audio are cached on your device.
- Protection settings: the apps and websites you block, locks, schedules, prayer focus and commitments.
- App usage (Android): which app is on screen, used in the moment to pause blocked apps; and screen time, phone pickups and app usage per day, read from Android's usage statistics for your weekly reflection.
- Blocking activity: how often Aman stepped in and for which app or category. Websites are only named if you added them yourself; adult and gambling sites are only counted.
- Installed apps (Android): the list of apps on your phone, used to let you choose apps to block and to recognise gambling apps. The list is never sent anywhere.
- Prayer: your prayer settings, alert choices, and the last location or city used for prayer times.
The weekly reflection and any suggestions in it are calculated on your device, only for you. This data is deleted when you clear Aman's data or uninstall the app. Because it never reaches us, we cannot restore it either.
3. Services Aman connects to
Some features need information from the internet. When Aman makes these requests, the service receives the request itself and, like any internet connection, your IP address and basic technical details (such as the time of the request). Apart from sign-in and purchases (sections 6 and 7), none of these services receives your account or any identifier from Aman, and none of them is used for advertising. They act under their own privacy policies.
| Service | Used for | What it receives |
|---|---|---|
| AlAdhan (Islamic Network) | Calculating prayer times | Your coordinates or chosen city, and your calculation method and Asr setting. This is the only way your location leaves your device, apart from the row below |
| BigDataCloud (Android) | Showing the name of your city | Your coordinates, when you use your current location |
| AlQuran Cloud (Islamic Network) | Quran text, translations and recitation audio | Which surah, ayah, translation or reciter you load. This could show what you read, but not your progress, bookmarks or memorization, which stay on your device. Text and audio already cached aren't requested again |
| Cloudflare DNS (1.1.1.1), with Google Public DNS as a backup | Finding the address of allowed websites while website blocking is on | The name of each allowed website being looked up, with your IP address. See section 4 |
| GitHub | Downloading updated blocklists, and checking for updates in the Windows version installed outside the Microsoft Store | A request for the file |
| Google Firebase Authentication | Signing in for Premium (optional) | See section 6 |
| Google Play / Microsoft Store | Installing and updating Aman, and Premium payments | Handled under Google's and Microsoft's own privacy policies |
On Windows, you choose your city from a list stored in the app; only the city name is sent to AlAdhan. On Android you can choose between your current location and a city.
4. Website blocking and the VPN
What it does: on Android, website blocking uses Android's VpnService to run a filter on your device. It only handles DNS lookups, the step where your phone asks for a website's address. It does not route, read or change the content of your internet traffic, and Aman itself is excluded from it.
What data it handles: the names of the websites your apps look up (for example example.com), and on supported phones which app made the lookup. Each name is checked on your device against the adult, gambling and your own block lists.
Where it goes: blocked names are stopped on your device and go nowhere. Allowed names are sent to a public DNS service to get the website's address, just as your phone's normal DNS would:
- First, encrypted with DNS over HTTPS, to Cloudflare (cloudflare-dns.com), or to Google Public DNS (dns.google) if Cloudflare can't be reached.
- If the network you're on blocks encrypted DNS, Aman on Android falls back to standard, unencrypted DNS to the same two services (1.1.1.1 and 8.8.8.8), so websites keep working. On such a network, others on the network path could then see the website names, as they could without Aman.
- If none of them can be reached, the website doesn't load. Nothing is sent anywhere else.
What the DNS service can see: encryption protects lookups on the way, but the DNS service itself still sees the website name (for example example.com, never the full address of a page or its content) and your IP address. Website names can say something about your interests, so we chose services with strict published policies. According to those policies, Cloudflare doesn't write your IP address to disk and deletes its resolver logs within 25 hours, and Google Public DNS deletes logs containing your full IP address within 24 to 48 hours. Neither uses lookups for advertising.
What we receive: nothing. We do not receive, log or store the websites you visit, and Aman keeps no record of lookups outside your device.
Your choice: the DNS service can't be changed in the app at the moment. Website blocking is off by default and you decide whether to turn it on. With it off, your device uses its normal DNS and Aman takes no part in lookups.
What is kept: only the on-device counts described in section 2.
Why: solely to block the content you chose to block. Website lookups are never used for advertising, profiling or any other purpose, and never shared beyond the DNS services above.
On Windows: Aman runs a DNS filter on your computer and sets Windows to use it while website blocking is on. It works the same way, with one difference: on Windows, allowed lookups are only ever sent encrypted (DNS over HTTPS) to Cloudflare or Google, never unencrypted. If neither can be reached, the website doesn't load.
5. Android permissions
Each permission is explained in the app before Android asks for it, is only used for the feature described, and can be turned off at any time in Android's settings.
- Location (only while you use Aman, never in the background): prayer times for where you are. You can choose a city instead.
- Notifications, exact alarms and full-screen alerts: the athan, prayer and habit reminders, and focus sessions.
- Usage access: knowing which app is open so blocked apps can be paused, and screen time for your weekly reflection.
- Display over other apps: showing the block screen and full-screen reminders.
- VPN: website blocking, as described in section 4.
- Seeing installed apps: choosing apps to block and recognising gambling apps.
- Running in the background and after a restart: keeping protection, alarms and reminders working.
6. Your account
An account is optional and only used for Premium. When you choose “Continue with Google”, Google shares your name, email address, profile picture and a user ID with Aman through Google Firebase Authentication, which stores your account.
We use this only to recognise you and know that you have Premium. We don't send you marketing, we don't combine your account with any other data, and we never sell it. It is processed only by the service providers needed to run Premium: Google (Firebase Authentication and Google Play) and RevenueCat (section 7). Your habits, Quran progress, blocking activity and other app data are not linked to your account and stay on your device.
You can delete your account in the app (Settings → Account → Delete account) or at amanapp.dev/delete-account. This removes your account from Firebase and your customer record from RevenueCat. Google Play's own purchase records are not affected (section 13).
7. Premium purchases
Premium payments are made through Google Play. Google processes your payment details; we never receive your card or bank information. We receive confirmation of your purchase (such as the product, date and status) linked to your account's user ID, so Premium works on your devices.
To manage subscriptions we use RevenueCat, a subscription service acting on our behalf. It receives your account's user ID and your purchase records from Google Play, but not your name, email or anything you do in the app. It uses the same user ID on all your devices, which is how Premium follows you when you sign in. If you choose a reduced or free option, we don't ask for any proof or financial information.
8. The early access list and testing
When you join the early access list on this website, we store exactly four things:
- your email address,
- whether you ticked “I'd like to be considered as an early tester” (it is unticked unless you choose it),
- the date and time you joined, and
- your country, which Cloudflare works out from your connection. We don't store your IP address or any other details about you or your device.
If you sign up again with the same email, nothing new is stored. A hidden field in the form helps us filter out automated spam; it doesn't track you. We use your details only to:
- email you when Aman is available on Google Play, and
- if you asked to be considered, choose a limited group of testers and email those chosen an invitation.
Being on the list doesn't guarantee a tester place. If you're chosen and accept, we ask for the email address of the Google account you use on Google Play and add it to Google Play's tester list for Aman, so you can install the test version. Google Play then handles the test under its own terms. Feedback you send us during testing is used only to improve Aman.
The list is stored in Cloudflare Workers KV, a database run by Cloudflare, our website host, which keeps copies across its global network so it stays available (see section 12). Only we can see it. We don't share it, sell it, or add it to any mailing list for other purposes. We send launch and tester emails ourselves; if we ever use an email delivery service for this, it will act only on our behalf.
You can leave the list or the test at any time by emailing [email protected], and we'll delete your details. If the form doesn't work and you email us to join instead, we add your email address to the list the same way and handle your message as described in section 9.
9. When you contact us
If you email us, we receive your email address, the message and anything you attach. We use it only to answer you. Emails to amanapp.dev addresses are forwarded by Cloudflare and stored in a Google (Gmail) mailbox.
10. This website
amanapp.dev uses no cookies, no advertising and no tracking scripts. It is hosted by Cloudflare, which processes technical data such as your IP address and browser details to deliver the site and protect it from abuse. We may use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
11. Legal bases
Under the GDPR, we rely on these legal bases:
| What | Legal basis |
|---|---|
| Requests to prayer, Quran and DNS services when you use those features | Performance of our agreement with you, to provide the features you use (Art. 6(1)(b)) |
| Your location for prayer times | Your consent, given through Android's location permission, which you can withdraw at any time (Art. 6(1)(a)) |
| Your account and Premium purchases | Performance of a contract (Art. 6(1)(b)), and legal obligations for purchase records (Art. 6(1)(c)) |
| The early access list and tester invitations | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Answering your emails | Our legitimate interest in helping you (Art. 6(1)(f)) |
| Website hosting and security | Our legitimate interest in running a secure website (Art. 6(1)(f)) |
Aman does not process special categories of data about you on our side. Religious practice inside the app, such as your prayers and Quran reading, stays on your device. We do not make decisions about you based solely on automated processing.
12. International transfers
Some of the providers above, including Google, Cloudflare, GitHub and RevenueCat, are based in the United States or process data there. Where personal data is transferred outside the EU/EEA, it is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
13. How long we keep data
- On-device data: until you delete it, clear Aman's data or uninstall the app. Aman keeps habit history for about 400 days and its blocking counts for about 60 days, then removes them automatically.
- Your account: until you delete it. Deleting it removes it from Firebase and RevenueCat straight away. If an account has not been used for 3 years, we may delete it.
- Purchase records: Google Play is the seller and keeps its own records under its policies. We keep the sales reports Google Play gives us for as long as Swedish accounting law requires (7 years), and use them for nothing else.
- Early access list: until 6 months after Aman launches on Google Play, then deleted, or earlier if you ask.
- Emails: as long as needed to help you, and no longer than 2 years after the conversation ends.
- DNS services: we keep nothing. Cloudflare and Google keep their own logs for the short periods described in section 4.
14. Security
The best protection is the one Aman is built on: collecting as little as possible, and keeping the rest on your device. On top of that:
- All of Aman's connections to the services in section 3 use HTTPS, apart from the DNS fallback described in section 4.
- Account data is stored by Google Firebase, which encrypts it at rest. Purchase records are stored by RevenueCat and Google Play, which do the same.
- Only we can access the accounts and services that hold your data, protected with strong passwords and two-step verification.
- If a security breach affects your personal data, we will report it to the Swedish Authority for Privacy Protection within 72 hours where the law requires, and tell you without undue delay if it puts you at high risk.
15. Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it,
- correct data that is wrong,
- delete your data,
- restrict or object to how we use it,
- receive your data in a portable format,
- withdraw consent at any time, without affecting what was done before.
The data we hold and can act on is your account, your purchase records, your early access details and your emails. Email [email protected] and we'll answer within one month. We may ask you to confirm your identity first.
You also have the right to complain to a data protection authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se). You can also contact the authority where you live.
16. Notice for US residents
We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. The categories of personal information we may hold are identifiers (name, email address, user ID), commercial information (Premium purchases) and approximate location from your connection for the early access list. You may request access to or deletion of your information using the contact details above, and we will not treat you differently for doing so.
17. Children
Aman is designed for a general audience and is safe for all ages. It has no ads, no social features and no public profiles, and app data stays on the device, so children using Aman are not profiled or contacted by anyone through it.
Accounts are only for Premium and are not intended for children under 13 (or the age of digital consent where they live) without a parent's permission. We do not knowingly collect personal data from children under that age. Parents can ask us to access or delete their child's data. If you believe a child has given us personal data without permission, contact us and we will delete it.
18. Changes to this policy
We may update this policy when Aman changes. The date at the top shows when it last changed. If a change affects how your personal data is used in an important way, we'll tell you in the app or by email before it takes effect.