IqraPlay privacy policy

Version 2026-11-07

1. Who we are

IqraPlay is provided by Cognizen Arge Mühendislik ve Yazılım A.Ş., Üniversiteler Mah. Şehit Mustafa Tayyarcan Cad., Tepe Binası Blok No:5, İç kapı no: Z44, Çankaya, Ankara, Türkiye, the data controller for the information this policy describes. You can reach us at support@cognizen.ai.

2. What this covers

This policy covers the IqraPlay app and the website at play.cognizen.ai.

3. The short version

No ads, no tracking and no third-party analytics. We collect what the game needs in order to work and to keep rooms safe, and we keep it only as long as this table says. We also count how the game is used, on our own servers, and share those counts with nobody.

4. What we collect, by what you do

4.1 Solo

When you recite in Solo, our server passes your recording to the scorer. Your recording is scored on our servers at Amazon Web Services in Frankfurt (eu-central-1), in memory, and the scorer never stores it. We keep a Solo recording only if you share the session (section 4.12) or publish it on your profile (section 4.14). Your Solo progress stays on your phone, unless you sign in, when it is kept with your account (section 8).

4.2 Playing online

The first time you tap Online, we ask your month and year of birth, and you accept these terms. We then keep a keyed hash of your phone's device key, your birth month and year, your display name, your Player ID, and which terms version you accepted and when. When the terms change, we show them to you again before you next play online, and we keep the latest version you accepted. Players under 13 get a name chosen for them.

During your own turn, the players in the room hear your recitation live. Our server also records the turn and sends it to the scorer. Your recording is scored on our servers at Amazon Web Services in Frankfurt (eu-central-1), in memory, and the scorer never stores it. We keep each recording for 7 days in case someone reports the turn, and then it is deleted, unless you publish the turn on your profile (section 4.14). Faces, phrases and gifts you send are passed on to the room. Joining a room's voice call sends your display name, your Player ID, the room code and your IP address to our LiveKit voice server at Amazon Web Services in Frankfurt (eu-central-1), which carries the voice.

4.3 Signing in

Players aged 13 and over can sign in with Apple, Google or a code sent by email. We keep only keyed hashes of your sign-in identity and, for Google and email codes, of your verified email address, so that a new phone can find your account. We use your email address in the clear only for the moment it takes to send a code; our email service keeps an address only if a message to it bounced or was marked as spam. If you sign in with Apple, we keep Apple's token, encrypted, so that we can end Apple sign-in for IqraPlay when you delete your account.

4.4 Friends and messages

If you are 13 or over and signed in, we keep your friends and friend requests, a "Played with" list of the people you were seated with (kept 30 days), and text you send to friends in a room (kept 7 days). Invites last 10 minutes and are kept only in memory.

4.5 Safety

We keep who you blocked and who blocked you, removals from rooms, flags, restrictions such as mutes and bans, and bans on the phones a banned player used. The person you block is never told.

When you report a player, we keep the category you chose, any details you add (players 13 and over, up to 500 characters), and what the room itself recorded: the room, names, the last lines of the room, a reported message, and the recordings of the reported player's last turns, which we keep for 90 days as evidence. Reports are kept 365 days, open or closed. The reported player is never told who reported them.

If you delete your account, your recordings, evidence audio and social data go from our systems at once, other than in backups (section 8). Reports about you are stripped down to their category and dates. Only a player who was flagged or banned has their keyed hashes and moderation records kept for 90 days after deletion, and never a player under 13.

4.6 Gifts, coins and purchases

We keep your gift points, your gift wall, your wallet and coin ledger, and your gift history, including the daily window of the free MashaAllah. Gift history is kept 90 days, and the totals while your record exists. The looks and room backgrounds you buy with coins are kept while your record exists and deleted with it. Coins are bought through Apple or Google; we never see your card details. We keep each purchase's store transaction id, product and time, verified with Apple or Google, for 24 months, with your identity removed if you delete your account. Store notifications about purchases are kept 180 days.

4.7 Feedback

Feedback is optional. If you send it, we keep the category, your message or the ready-made sentence you picked, your email address only if you give one for a reply, and your app and device details only if you switch them on (they are off until you do). When your phone has a player record, the feedback is linked to it, so that we can help with your account and so that deleting your account deletes it. We keep feedback for 12 months, and it is also emailed to our support mailbox.

4.8 Crash reports

When the app breaks, it sends a crash report: what went wrong, the screen it happened on, the app version, the operating system, the phone model and the app's language. A crash report carries no identifier: no Player ID, no device key, no name, no message and no voice. Crash reports are on by default and you can switch them off in Settings. They are kept 30 days.

4.9 Server logs and security

Our servers see your IP address on every connection. We use it in memory to limit abuse, and our server logs keep it for 30 days, with room activity such as room codes, Player IDs, joins, removals and turn outcomes. The feedback, crash report and scoring routes never write your address to a log.

4.10 On your phone only

Your Solo profile, your progress while you are signed out, your settings, your country (it goes to a room when you join one, so the other players see your flag; if you are 13 or over and signed in, your profile keeps a copy, section 4.14), your reminder time, your recent rooms, the room code in an invite link that installed the app, which MashaAllah notes you have already seen, which new recitations from people you follow you have already seen, and the age answer the feedback form may ask stay on your phone. The best recording of each ayah during a Solo session also stays on your phone, until the session ends, unless you share it (section 4.12) or publish it (section 4.14). Reminders are scheduled on your phone; we send no push notifications.

We do not collect your location, contacts, photos or camera, advertising identifiers, push tokens or browsing. We use no analytics service or SDK: the usage counts in section 4.11 are made on our own servers and never leave them.

4.11 Counting how the game is used

Our server writes a short line when something happens in the game: the app opening, a Solo or practice attempt being scored and how long that took, a Quick Play search and whether it found a match, a room filling, a game finishing, a gift sent, coins bought, a look or a room background bought with coins, and a sign-in. Each line carries the time and your player record's internal number, so we can tell how many players come back. It never carries your voice, your name, your messages, your device key or your IP address. A line about a player under 13 carries no number at all. These lines stay on our servers at Amazon Web Services in Frankfurt, are kept 90 days, and are shared with nobody.

4.12 Sharing a practice session

At the end of a Solo session you can choose to share it with family. Nothing is shared unless you tap Share, and each tap makes one new link. The link's page shows your name, the surah or ayahs you practised and your best score for each. If you are 13 or over, it also has your best recording of each ayah. Until you tap Share, those recordings stay on your phone, and they are deleted from it when the session ends. When you share, we store them in a private storage area at Amazon Web Services in Frankfurt (eu-central-1). Each play gives the listener access for a few minutes only. A link and its recordings are deleted after 14 days, when you revoke it under Settings → Links I shared, or when you delete your account or data, whichever comes first. Anyone you send the link to, and anyone they forward it to, can open it until then. For players under 13, the page shows scores only, with no name and no recording, and no child's voice is stored. If someone who opens the link taps MashaAllah, we note the time on that link and your phone shows you a note once; we keep nothing about who tapped.

4.13 Learning with a teacher

If your teacher uses IqraPlay, you can join their class with a code or link they give you. Nothing is shared until you join, and joining is always your choice. Before you join, the app shows you exactly what your teacher will see: the surahs you practise in Solo, your best score for each ayah, the words the judge flagged, how many days you practised this week, and when you last practised. Your teacher will never see your recordings, your messages, your friends, your coins or gift points, or the rooms you play in, and they cannot send you messages through IqraPlay. Your teacher sees you by your name in the game. We keep a record of each practice attempt you make while you are in the class (the ayah, the score, the flagged words and the time, never your voice) on our servers at Amazon Web Services in Frankfurt (eu-central-1). For a child under 13, joining waits for a family confirmation: the app asks the child to send a link to a parent or guardian, and the class starts only when someone confirms it from that link. The link shows the class, the teacher's name and what the teacher will see, and it can end the class for the child at any time. We cannot check who opens or confirms the link, so this step is meant to be done with a parent, but it does not verify one. You can leave under Settings → My class teacher, your teacher can remove you, and the class can be ended from the family link. When it ends, the record of your practice in that class is deleted at once. Otherwise each practice record is kept for 90 days, and everything is deleted when you delete your account or data.

4.14 Your profile and published recitations

If you are 13 or over and signed in, you have a profile: you can publish recitations on it, follow other players, and listen to theirs on the Listen screen. Guests and players under 13 have no profile, and cannot publish, follow or open the Listen screen.

Your profile shows your name in the game, your character, your country's flag if you show one, your gift card (gift level and gift points), the surahs you have practised (you can hide them) and the recitations you published. Only signed-in players aged 13 or over see profiles in the app. A profile starts public, and you can make it friends-only or private at any time. We keep these settings, and the list of practised surahs your phone sends, while your account exists.

Following needs no approval. We keep who follows whom, and since when. The player you follow sees you in their list of followers and can remove you from it; nobody else sees who follows whom. A block between two players ends their follows both ways, and neither is told.

Publishing happens only when you choose it. You can keep one of your own turns from an online game (within its 7 days), pin an accepted take from Solo or surah practice, or record a passage of up to 30 ayahs in the recitation booth. Your recording goes to our servers, the judge listens to every ayah again, and only a recitation the judge accepts is published. On our servers at Amazon Web Services in Frankfurt (eu-central-1) we join the ayahs into one recording, cut the first 15 seconds as a preview, and keep both in a private storage area there, with the surah and ayahs, the judge's score for each ayah, and when each ayah starts. An upload that is never finished, or a recitation the judge does not accept, is deleted after a day. We also note the time of each recitation you start, for 2 days, to keep everyone to 30 a day.

Who hears it. When you publish, you choose the recitation's audience, and whether your score shows. Everyone means every signed-in player aged 13 or over who can see your profile; Women only means only those of them who said they are a woman; Friends means only your friends. The audience cannot be changed later: delete the recitation and publish it again instead. Each play gives the listener access for a few minutes only. Recitations appear on your profile and, for listeners they are allowed to reach, on the Listen screen, by surah, in "New from people you follow", and in Featured, which we choose by hand. An Everyone recitation by a player 18 or over may also reach other players, as the next paragraph says.

How we may use an Everyone recitation. If you are 18 or over when you publish a recitation to Everyone, you have accepted the terms that allow this (their section 7), and it scores well, we may use it in the game. We use a recitation this way only while it is on a public profile. We may play it to other players as an example. We may also play it in Quick Play rooms as a recorded player, under a character's name and not yours, and we may change how the voice sounds, so it may not sound like you. Everyone in such a room hears it, including guests and players under 13 in the audience, and no player is marked as recorded. The publish sheet says this beside Publish. We never use a recitation published to Women only or Friends, a recitation by a player under 18, or one published before you accepted those terms. We do not use your Solo recordings or your online turns, unless you publish one to Everyone yourself: a Solo recording is still not kept, and an online turn is still kept for 7 days. To tell which recitations this covers, we keep with each recitation the terms version you had accepted when you published it. If you delete the recitation, or your account or data, we stop using it and delete any copy made for this use. We also stop as soon as your profile is friends-only or private, if the recitation is hidden or removed, or if your birth month is corrected to under 18. No company outside the ones in section 6 receives your voice for this; if that changes, we will name the company in section 6 before any recording goes to it.

Your declared sex. When you first choose Women only for a recitation you publish, or open a Women only recitation, the app asks once whether you are a man or a woman; publishing to Everyone or Friends never asks. You can cancel, and then nothing happens. Nothing is checked. We keep your answer and when you gave it while your account exists, and use it only to decide who may publish and hear Women only recitations; we show it to nobody, and a Women only recitation is never listed to anyone who has not said they are a woman. Because only a player who said they are a woman can publish to Women only, its listeners can tell that its reciter did. You can change your answer only by writing to us.

Share pages. An Everyone recitation on a public profile has its own page on play.cognizen.ai, and a public profile has one with up to six of its pinned Everyone recitations. Anyone with the link, whether or not they use IqraPlay, sees your name in the game, your character, the surah and the ayahs, and can hear the first 15 seconds; the whole recitation plays only in the app. When you publish to Everyone, your phone also makes a picture for chat apps' link previews: the ayah's Arabic text, the surah, your character and your name in the game, never a score. We keep it with the recitation, and delete all your pictures when your name changes. A page closes as soon as you delete the recitation, make your profile friends-only or private, or delete your account, or when the recitation is hidden or a ban is placed on you. Chat apps may keep their own copy of a link preview after that, which we cannot delete. The pages set no cookies and carry no analytics and nothing from anyone else.

Listens, MashaAllah and gifts. When someone hears 10 seconds of your recitation, or all of a shorter one, we note that they listened that day. When they say MashaAllah, we note who and when. Gifts on a recitation are kept like any other gift (section 4.6). Only you see each recitation's listens (rounded down to 5), MashaAllahs and gift points, and nobody sees a list of who listened or said MashaAllah. We keep these while the recitation and the listener's account exist.

Reports. Anyone who can hear a recitation can report it, and a report copies the recording as evidence for 90 days (section 4.5). Two reports from different players can hide it until we review it, and a ban hides all of a player's recitations while it lasts. We remove a recitation that breaks the rules.

Deleting. You can delete any recitation at any time: its recording, preview, picture, listens and MashaAllahs go at once, and gifts already given keep the gift points they gave. Deleting your account or data deletes your profile, your follows both ways, your declared sex and all your recitations; whatever audio cannot be deleted at that moment is retried every few minutes until it is gone. If a record that claimed to be 13 or over is corrected to under 13, the same is deleted.

5. Children

Players under 13 can practise in Solo. Online they are guests in the audience: they watch games, send faces and phrases, and send one free MashaAllah a day. For them we keep only the device key hash, the birth month and year, a name chosen for them, their Player ID and their terms acceptance, their session tokens, the gifts they send and the free MashaAllah's daily window (gift history 90 days), any restriction a review places on them, quick feedback reports (a ready-made sentence, never free text or an email address), crash reports with no identifiers, the game's usage counts, with no identifier, and the IP address and room activity in our logs. The flag of the country they choose, or of their phone's Region setting, is shown to the room while they are in it, and is not kept on our servers.

A child can share a session's scores with family; no recording or name is included.

A child can join a teacher's class only after it is confirmed from a link the child is asked to send to a parent or guardian (section 4.13). We do not check who confirms it. The teacher sees the child's practice scores and flagged words, never their voice.

A child has no profile, cannot publish a recitation, follow anyone or open the Listen screen, and is never asked their sex.

A child never signs in, recites online, types, adds friends or buys anything, so no child's voice is kept and no free text is collected from a child. Listening to a room means joining its voice call, so our LiveKit voice server receives a listening child's Player ID, chosen name, the room code and IP address, but never their voice. A child's recitation in Solo is scored on our servers at Amazon Web Services in Frankfurt (eu-central-1), in memory, and the scorer never stores it. Nothing of a child's is kept after deletion. If a record claimed to be 13 or over and is corrected to under 13, its recordings and social data are deleted, with its profile, follows, published recitations and declared sex.

A parent or guardian can ask us to delete a child's data by writing to support@cognizen.ai with the child's Player ID, or can use Delete my data on the child's phone. We do not knowingly collect more from a child under 13 than this section lists, in line with the US Children's Online Privacy Protection Act.

6. Who processes data for us

None of these companies sells your data, advertises to you or tracks you. They act on our instructions.

7. International transfers

Where our mail provider processes data outside the European Economic Area, the European Commission's standard contractual clauses or the EU-US Data Privacy Framework apply, as its data processing agreement sets out.

8. How long we keep data

"Deleted" below means gone from our systems. Database backups roll over within 14 days; deleted data leaves them then. A record that was flagged or banned keeps only its device and identity hashes and its moderation records (removals, the reports and signals about it, and its restrictions) for 90 days after deletion, and then those go too. A record whose owner is under 13 is never kept after deletion.

9. Your rights

• Access and a copy: email us and we send you your data.
• Correction: if your birth month or the sex you declared is wrong, write to us with your Player ID and we correct it.
• Deletion: in the app, under Settings, then Account; or without the app, as the support page explains, after you answer our confirmation reply. You can delete a published recitation on its own at any time, from your profile.
• Objection: you can object to processing we base on our legitimate interests. That includes the use of your Everyone recitations in section 4.14, which also stops as soon as you delete the recitation or make your profile friends-only or private.
• Withdrawing consent: leave the reply address empty, leave device details switched off, switch crash reports off in Settings, delete a published recitation, or make your profile private.
• Complaint: you can complain to a data protection authority; the European Data Protection Board lists them at edpb.europa.eu.

We answer every request within one month.

10. Security

Everything travels over TLS. Device keys, sign-in identities and sign-in email addresses are kept only as keyed hashes. Our keys live in AWS Secrets Manager, and access to our systems is limited to what each part needs.

11. Changes

The version date at the top changes with every change to this policy. We announce material changes in the app before they apply.

12. Contact

Write to support@cognizen.ai.

Appendix: legal bases

• Contract: providing the game, sign-in and purchases, and profiles, following, listening and gifts on recitations.
• Legitimate interests: safety and moderation (including hiding reported recitations and the daily publishing limit), security logs, crash diagnostics, counting how the game is used, and deleting unused guest records. They also cover playing to other players recitations on a public profile that players 18 or over publish to Everyone, as examples and as recorded players in Quick Play (section 4.14). We do not ask for a separate consent to this use: the terms set it out, the publish sheet says so, and you can stop it at any time by deleting the recitation or making your profile friends-only or private.
• Consent: the feedback reply address and device details, joining a teacher's class (your join; for a child under 13, the confirmation from the family link), publishing a recitation to the audience you choose, and the sex you declare for Women only recitations.
• Legal obligation: purchase records, and answering your requests.