Nuzul Privacy Policy
Contents
This is a courtesy translation. The Turkish text at nuzul.com.tr/gizlilik is the version that was drafted, reviewed and is legally binding. If anything here differs from it, the Turkish text governs.
Last updated: 26 August 2026
Effective: 26 August 2026
1. In short
Nuzul is a Turkish audio app about what event each surah of the Qur'an was revealed in response to.
- You can listen to three episodes without an account and without giving us anything.
- The rest requires an account and a single one-time purchase. That is the point at which we take your e-mail address. There is no subscription; nothing renews automatically.
- We never see your card details. Apple or Google takes the payment.
- We show no advertising, we share no data for advertising, and we do not sell data.
- You can delete your account from inside the app.
2. Data controller
| Name | Eyüp Ensar Şanlı |
| Address | Merkez Mah. Akar Cad. I Towers Bomonti No: 3 İç Kapı No: 96, Şişli / İstanbul, Türkiye |
| Tax office / number | Maslak Tax Office, 10748566782. A sole proprietorship has no MERSİS number |
| destek@nuzul.com.tr | |
| Telephone | +90 551 689 86 83 |
| Registered electronic mail (KEP) | None. A sole proprietorship has no registered electronic mail address |
| App | Nuzul (iOS / Android) |
3. What we collect, and when
3.1 Without an account, the three free episodes
At this stage we send no data to our servers that could be linked to your identity. Your listening position and your language and sort preferences are stored on your device only. They go if you delete the app.
Technically, the only thing that reaches our servers is the ordinary network request that fetches the audio and text files, including your IP address and your device and app version. These are kept briefly for security and error diagnosis.
3.2 When you create an account
| Data | Where it comes from | Why |
|---|---|---|
| E-mail address | Sign in with Apple / Sign in with Google | To create your account and to reach you |
| Name, optional | The same | To address you in the app |
| Provider user identifier | The same | To find the same account when you sign in again |
| Account creation date | From us | Record keeping |
If you choose Sign in with Apple you can hide your e-mail. In that case a relay address ending in @privaterelay.appleid.com reaches us and we never see your real address. This is fully supported.
We do not ask for a phone number. We do not ask for date of birth, address, gender or identity details either.
3.3 When you buy
| Data | Where it comes from |
|---|---|
| Purchase state, bought or not bought | Apple App Store or Google Play |
| Identifier of the product bought | The same |
| Store transaction identifier | The same |
We do not take, see or store your payment details. Your credit card, debit card and billing details stay with Apple or Google. All that reaches us is the answer to the question "has this user bought".
The purchase is one-time and does not expire, so we keep no term end date and no renewal record.
3.4 While you use the app
| Data | Why |
|---|---|
| Which episode you are listening to and how many seconds in | To resume where you left off, and so it is not lost when you change device |
| Your language and sort preference | To remember your preference |
| App version, operating system, device model | To diagnose faults |
| Crash logs and error logs | To fix the app |
| General usage statistics | To see which episodes are listened to and improve the content |
There is no third-party analytics tool. Usage statistics are kept in the app's own backend (Supabase); no analytics SDK, advertising identifier or crash-reporting service is used and the data does not leave Supabase. Recording is subject to explicit consent and is off by default; no event is recorded until consent is given.
3.5 When you share an episode or the app
We collect no data at all about this. Sharing uses your device's own share sheet; the text and the link leave your device without passing through us. There are no invite codes, we keep no record of who invited whom, and nothing is credited for sharing, so there is no record to keep.
3.6 What we do not collect
Location. Contacts. Photos. Microphone. Health data. Advertising identifiers (IDFA/AAID). Your religious belief, your school of thought or your political views: we never ask for them, never infer them and never store them. We draw no conclusion about your beliefs from the fact that you listened to a surah, and we share no such data with anyone.
4. Why we process your data, the legal bases
Under article 5 of the Turkish Personal Data Protection Law:
| Purpose | Legal basis |
|---|---|
| Creating the account, recognising the purchase, delivering the content | Establishment and performance of the contract, art. 5/2-c |
| Keeping purchase records | Legal obligation, art. 5/2-ç, and performance of the contract |
| Fault diagnosis, security, prevention of abuse | Legitimate interest, art. 5/2-f |
| Improving the product with usage statistics | Explicit consent, art. 5/1. You may refuse; the app keeps working |
| Sending marketing e-mail | Explicit consent. If you do not want it, we do not send it |
You can withdraw consent-based processing at any time and it does not affect your basic use of the app.
5. Who we share data with
We do not sell data. We do not give it to advertising networks. The following are suppliers we buy services from:
| Who | For what | What goes to them | Where |
|---|---|---|---|
| Supabase | Database, authentication, audio files | Account, purchase state, listening progress | South Korea (Seoul) |
| Apple / Google | App distribution, payment, sign-in | Payment and purchase data, which is created at their end and never passes through us | Outside Türkiye |
| RevenueCat | Verification of the store receipt | Account identifier, store transaction identifier, purchase state | United States |
ElevenLabs is not on this list and should not be: the narration is produced by us before publication, independently of any user. No user data goes there.
In addition: if a competent court, prosecutor or administrative authority makes a request in due form, we share to the extent legislation requires.
6. Transfer abroad
All of the suppliers above are outside Türkiye, so your personal data is transferred abroad within the meaning of article 9 of the Turkish Personal Data Protection Law.
Under the regime that took effect on 1 June 2024, a transfer is made on the basis of an adequacy decision, of appropriate safeguards (the standard contract, binding corporate rules, an undertaking), or of the incidental cases listed in the law.
Nuzul relies on the standard contract published by the Board as its appropriate safeguard. Because the transfer is continuous, every sign-in and every purchase verification goes abroad, the exception for incidental cases is not used, and a continuous transfer is not made to depend on explicit consent. The standard contract is signed in the capacity of data controller by Eyüp Ensar Şanlı; Supabase's hosting region is South Korea (Seoul) and RevenueCat is in the United States.
Detail, contract types per supplier and the three implementation questions left to a lawyer: KVKK Information Notice §6.1.
7. How long we keep it
| Data | Period |
|---|---|
| Account and profile | For as long as the account is active; on a deletion request immediately, and from backups within 30 days at the latest |
| Listening progress | Deleted with the account |
| Purchase records | 10 years as financial legislation requires, art. 82 of the Turkish Commercial Code, de-identified |
| Crash and error logs | 90 days |
| Server access logs | 90 days |
When you delete your account the deletion is immediate. Your account, your e-mail and your progress leave the live systems at that moment; there is no waiting period and it cannot be undone. The 30 days in the table is only the upper bound for residual copies that may remain in regular system backups, and those backups rotate before that.
8. Your rights
Under article 11 of the Turkish Personal Data Protection Law:
- To learn whether your personal data is being processed,
- To request information about it if it has been,
- To learn the purpose of processing and whether it is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom it is transferred,
- To request correction if it has been processed incompletely or incorrectly,
- To request erasure or destruction within the conditions set out in the law,
- To request that correction and erasure be notified to the third parties it was transferred to,
- To object to a result against you arising from analysis solely by automated systems,
- To claim compensation if you suffer damage because of unlawful processing.
How: write to destek@nuzul.com.tr, or use the options under Menu → Account Details in the app. We conclude your application within thirty days at the latest. The application procedure is subject to the Communiqué on the Procedures and Principles of Application to the Data Controller.
9. Deleting your account
From inside the app: Menu → Account Details → Delete my account.
On the web: https://nuzul.com.tr/en/account-deletion
What is deleted: your account, your e-mail, your listening progress and the mapping of your purchase.
Deleting your account does not refund your purchase.
The purchase is one-time; there is no renewing charge to cancel and deleting your account does not cause you to be charged again. Deleting does, however, remove the record of your purchase on our side. Your receipt remains with Apple or Google: if you create a new account, "Restore purchases" gives your access back and you do not pay again.
Refund requests are made through the store only: iOS
https://reportaproblem.apple.com· Androidhttps://play.google.com/store/account/orderhistory
10. Security
All connections are encrypted with TLS. Access to the database is restricted with row level security: a user can read only their own record. We hold no account password; sign-in goes through Apple and Google, so there is no password to steal.
No system is absolutely secure. In the event of unlawful acquisition of personal data, notification is made to the Authority and to the individuals concerned as the law requires.
11. Children
The app is not directed at children under 13 and we do not knowingly collect data from them. If we learn that we have collected data belonging to a child under 13, we delete it.
12. Changes
If we update this policy we publish the new version at this address and change the date at the top. If a change is material we notify you in the app. If the data behaviour of the app changes, the text changes with it; this is not a calendar-driven update.
13. Contact and complaints
destek@nuzul.com.tr
Your right to complain to the Turkish Personal Data Protection Authority is reserved: kvkk.gov.tr. The law requires you to apply to the data controller before applying to the Board.