Privacy Policy

Last updated 10 October 2026MUSA Limited, 240240900508

This policy explains what personal data we receive when you use the MUSA app for iPhone, iPad and Android or the musa.kz website, why we need it, where it is stored, who it is shared with and how you can control it.

You give your consent to data processing when you sign in to the app: on the sign-in screen you accept the Terms of Use, which include consent to data processing under this policy. Your device asks separately for permissions, such as location or notifications, when they are first needed. If you do not agree with this policy, do not sign in to an account: Quran, Learning, Zikr & Dua, Names of Allah and prayer times also work without an account.

This policy describes how the app and our servers work today. Where automatic deletion is not yet set up, we say so plainly and delete such data at your request.

01Who processes your data

Owner and operator of personal data: MUSA Limited, a private company, BIN 240240900508, a participant of the Astana International Financial Centre (AIFC). Address: Mangilik El Ave 36/1, apt. 10, Yesil district, Astana, Republic of Kazakhstan.

We process data in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” and the data protection acts of the AIFC.

The company has appointed a person responsible for organizing the processing of personal data. You can contact this person at account@musa.kz.

02Where data is stored

Accounts, progress, voice recordings and their backups are stored on servers in the Republic of Kazakhstan, in Yandex Cloud, Kazakhstan region.

Some data is processed by services outside Kazakhstan. They are listed in the “Who we share data with” section, together with the data each of them receives.

03What data we receive

We only receive what the sections need in order to work. You enter some data yourself, the app receives some with your permission, and some is generated as you use the app.

Data	When we receive it	Purpose
Phone number	You sign in with your phone number	Signing in with a one-time code
Apple or Google identifier, email address, name	You sign in with Apple or Google	Signing in to your account
Name, photo, gender, date of birth, country, city	You fill in your profile	Your profile, league rankings, selecting content for you
Location	You allow access to it in the Prayer section	Your city, prayer times and qibla direction. Your exact coordinates are sent to our server to find the nearest city. Only the city is saved in your account, while the coordinates remain in the server technical logs. Without access, your city is determined by your IP address or you choose it yourself
Voice recordings and teacher replies	You hand in a lesson by voice in the Academy	An Academy teacher checks your reading
Progress	You use the sections	Bookmarks and collections, khatm and reading goal, memorized and reviewed ayahs, test results, Learning and Names lessons, adhkar, day streak, leagues
Search queries	You search the Quran	Search by meaning. Queries are processed on our servers
Subscription status	You make a purchase in the App Store or Google Play	Activating your subscription on all your devices
Notification token and reminder settings	You allow notifications	Reminders about lessons, prayers and adhkar
Device and sign-in data	Automatically	Device model and name, operating system and its version, app version, language, time zone, whether the device has root access, device identifier, IP address at sign-in. Used for account security and for the list of your devices
Usage events and crash reports	Automatically	Understanding which features are useful and fixing crashes. They are linked to an internal account identifier. Any coordinates in them are rounded to city level, and the event for opening a link includes the link's full address, for example one with a league invitation code
Server technical logs	Automatically	IP address, the time and URLs of requests, including coordinates when your city is determined and your phone number when you sign in or change your number, and service messages. Used to run and protect the service
App ratings and feedback	You answer a survey in the app	Understanding what to improve
Bug reports	You send them from the app	Fixing the bug. The app version and device data are sent along with the text
Travel section documents: full name, IIN (individual identification number), phone number, document details and photo	You added a document while the Travel section was available in the app	Arranging a trip. The section has been closed, and new documents are no longer accepted
Correspondence	You write to us	Replying to your request

We do not ask you to state your religion. However, the mere fact of using the app may indicate a person's religious beliefs, so we treat all app data as sensitive: we do not use it for advertising, do not sell it and do not draw conclusions about a person's faith.

We do not receive bank card details: payments are accepted by Apple and Google. We do not request access to your contacts. The camera and photos are needed only to choose a profile photo or a league image, and the microphone only to record a lesson in the Academy.

04Why we use data

to let you sign in and keep your progress on all your devices;
to make the sections work: prayer times for your city, ayah review on the right day, the day streak, league rankings, lesson checks in the Academy;
to activate a MUSA Hafiz subscription or access granted by an organization or the Academy;
to send the reminders you have turned on;
to protect accounts from hacking and abuse;
to respond to your requests;
to find and fix crashes and to understand which features are useful;
to comply with legal requirements.

We do not sell personal data, do not show ads and do not share data for third-party advertising. We do not make decisions with legal consequences for you based solely on automated processing.

06Who we share data with

We share data only with those who help us provide the service, and only to the extent needed:

Who	Purpose	What data	Where
Yandex Cloud	Servers, databases and backups	Account data and progress	Kazakhstan
Google Firebase (Google LLC)	Analytics, crash reports, notification delivery	Internal account identifier, usage events, URLs of opened links, device data, notification token	USA
AppMetrica (Yandex)	Analytics and crash reports	Internal account identifier, usage events, URLs of opened links, device data	Outside Kazakhstan
RevenueCat, Inc.	Tracking subscriptions from the App Store and Google Play	Internal account identifier, purchase and subscription period details	USA
Apple and Google	Sign-in with their accounts, subscription payments, notification delivery	Data you give them when you sign in and pay	USA
Google Maps (Google LLC)	Qibla direction map on Android	IP address and the map area shown	USA
Mobizon, Telegram, VerifyWay	Delivering sign-in codes by SMS, Telegram or WhatsApp	Phone number and code	Kazakhstan and other countries
MyUstaz by Malika Ustaz academy	Academy courses and lesson checks	Name, photo, voice recordings and progress of a student who has enrolled in a course	Via our servers
Telegram	Notifications to Academy teachers and coordinators	Student's name and photo, the fact that a lesson was handed in	Outside Kazakhstan
Google Workspace (Google LLC)	Email: correspondence with you and bug reports from the app	Email address, the text of emails and bug reports	USA
Yandex Metrica	Website statistics, only with your consent	Browser data, IP address, page views and clicks on the website	Outside Kazakhstan

Other users can see your name, photo, points, level and achievements in league rankings. The ranking server also sends your gender, country and city to other users' apps.

The “Incognito” toggle in your profile settings currently only saves your choice and does not hide this data. When hiding starts working, we will let you know in the app and update this policy.

Academy classes with a teacher take place in the Zoom app. We do not share your data with Zoom: what you provide when joining a class is processed by Zoom Video Communications under its own policy.

Services outside Kazakhstan receive only the data listed in the table. We choose services that are contractually obliged to protect data and to use it only for the task they perform for us.

We disclose data to government authorities only in response to a request based on the law. If the company is reorganized, the data will pass to its legal successor, which is obliged to comply with this policy.

07How long we keep data

account data and progress: for as long as the account exists, with the exceptions after deletion listed below;
voice recordings and teacher replies in the Academy: 365 days from the date of recording, then deleted automatically;
backups: up to 30 days;
sign-in and registration records (phone number, one-time codes, name, gender and date of birth from the registration form, notification token), the log of sent notifications and subscription event details: no retention limit yet, automatic deletion is not set up;
server technical logs: no retention limit yet;
analytics events and crash reports: for the periods set by Firebase and AppMetrica;
correspondence: kept in our mailbox with no set period;
documents under contracts with organizations: for the periods set by law.

When you delete your account, your profile and most of your data are deleted immediately, and they disappear from backups within 30 days. Some data still remains after deletion for now: see the list on the Delete your account page.

We will delete data with no set retention period at your request sent to account@musa.kz. We are setting up automatic deletion for it and will state exact periods in the next version of this policy.

08Your rights

You have the right to:

know whether we process your data, and receive it;
correct and supplement your data;
withdraw your consent to processing;
require us to block or delete your data if its processing is unnecessary or unlawful;
object to processing;
challenge our actions.

You can change your profile data in the app: Profile, “Settings”, “My details”.

To exercise a right, write to account@musa.kz and include the phone number or email address you use to sign in to the app. We will reply within the time limits set by law.

If you believe we are violating your rights, you can contact the authorized body of the Republic of Kazakhstan for personal data protection or the AIFC Commissioner of Data Protection, or go to court.

09Deleting your account

In the app: Profile, “Settings”, “My details”, “Delete account”. Without the app: follow the instructions on the Delete your account page.

Deleting your account does not cancel a subscription in the App Store or Google Play. You need to cancel it in the store.

10Children

The app is used by people of all ages, including children learning the Arabic alphabet. If you are under 18, consent to data processing is given by your parent or legal representative, and you must register with their involvement. If you learn that a child has registered without such consent, write to us and we will delete the account.

11How we protect data

The app and the website transmit data over a secure connection. Databases are located in a private network, and only employees who need access for their work have it. Voice recordings are kept in private storage and are opened through links that are valid for one hour.

If there is a data breach that affects your data, we will notify the authorized body within the time limit set by law and tell you what happened and what to do.

12Website and cookies

The musa.kz website works without signing in and without an account. Necessary data is stored only in your browser: the musa_lang cookie remembers the site language for one year so that musa.kz links open in it, and browser storage remembers your cookie choice and the steps you have completed on the pages.

The Yandex Metrica counter loads only after you click “Accept” in the banner. It collects browser data, IP address, the pages you view, and clicks on links and store buttons. Session recording is turned off. You can change your choice with the “Cookie settings” link at the bottom of the site.

13Changes to this policy

We update this policy when the app or the law changes. The date of the current version is shown at the top. We will notify you of significant changes in advance through the app, and if they require new consent, we will ask for it.

14Contacts

MUSA Limited, a private company, Mangilik El Ave 36/1, apt. 10, Yesil district, Astana, Republic of Kazakhstan. Email account@musa.kz, WhatsApp +7 775 222 02 40 (messages only).