Privacy Policy

Effective Date: 24 April 2026 Last Updated: 24 April 2026 Controller: Burak Seyman, sole proprietor trading as “Ari Studio” (“we”, “us”, “our”), Mustafa Kemal Mah. Dumlupınar Bulv. 280G/1260, Çankaya, Ankara, Türkiye. Tax ID (VKN): 7670752540. Operated as an individual enterprise (şahıs şirketi) under Turkish law. Contact: privacy@kahfapp.com

This Privacy Policy explains how Burak Seyman, operating as Ari Studio (the “Controller”), collects, uses, discloses, and safeguards information when you use the Kahf mobile application (“Kahf”, “the App”). By using Kahf, you agree to the processing of information in accordance with this policy, and, where required, you confirm your explicit consent on the in-app consent screens.

1. Who We Are and Where Kahf Is Offered

Kahf is an Islamic sleep stories iOS application published by Burak Seyman (a Turkish individual acting as sole proprietor / şahıs şirketi), trading under the unregistered commercial name “Ari Studio”. “Ari Studio” is a trade name; Burak Seyman is the sole legal person responsible under this Policy. The App plays original AI-generated and human-curated audio content — narrated sleep stories — designed to help you rest.

Service availability. Kahf is offered in the territories where the App is listed on the Apple App Store. Kahf is not offered for sale or use in the Republic of Turkey, and the App is excluded from the Turkish App Store storefront. We do not knowingly collect, store, or process personal data of individuals residing in Turkey. If you believe your data has nonetheless reached us from Turkey, contact privacy@kahfapp.com and we will delete it without undue delay.

Ari Studio acts as the data controller under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), in respect of the data subjects to whom the App is offered.

2. Summary (TL;DR)

• We store your account (email or Apple relay identifier) and your in-app preferences.
• We record which sleep stories you play and how long you listen, so your library reflects your usage.
• We use analytics and attribution tools (Mixpanel, Airbridge, Adapty) to understand how you use Kahf and which channels help people find us.
• We do not sell or share your personal data for cross-context behavioral advertising.
• Your selected sleep story themes may reveal your religious interests. Under GDPR Article 9 this is special category data, and we only process it with your explicit, separate, opt-in consent.
• Our primary database is hosted in Frankfurt, Germany (Supabase EU region).
• You can delete your account and all associated data in-app at any time (Settings → Privacy → Delete Account).
• We do not make decisions about you by automated means with legal effect.

3. Data We Collect

3.1 Data You Provide

• Account information: email address (if you sign in with email) or Apple relay email (if you use Sign in with Apple). If you sign in with Apple using the “Hide My Email” option, we only receive a privacy-preserving relay address and cannot identify you by real email.
• Onboarding preferences: wake time, sleep quality self-rating, narrator preference, story theme preference.
• Consent records: which consents you have granted or withdrawn, and when (timestamped with the version of the consent text shown).
• Customer support correspondence: messages you send to privacy@kahfapp.com, support@kahfapp.com, or other Ari Studio addresses.

3.2 Data Collected Automatically

• Usage data: sessions played, listening duration, sleep timer choices, paywall interactions, onboarding step completion, in-app screen views.
• Device data: device model, iOS version, app version, language, time zone, installation identifier (IDFV), and network information (IP address, truncated where possible).
• Attribution data: only if you grant App Tracking Transparency (ATT) consent, we share a device identifier with Airbridge to attribute your install to the marketing campaign that brought you to Kahf. If you decline, we fall back to privacy-preserving SKAdNetwork.
• Crash and performance diagnostics: aggregated via Apple MetricKit (device-grouped, non-personal).
• Subscription events: purchase, renewal, trial start/end, cancellation, refund — received via the Adapty SDK and Apple App Store Server Notifications.

3.3 Data We Do Not Collect

• We do not read your contacts, location, microphone, photos, or health data.
• We do not scan your other applications.
• We do not collect biometric identifiers.
• We do not use website cookies or third-party advertising trackers inside the App (the App is not a website).
• We do not collect precise geolocation.

4. Why We Process Your Data (GDPR / UK GDPR Legal Bases)

We perform balancing tests for every legitimate-interest basis and document them internally.

5. Religious Data — GDPR Article 9

When you choose which themes of Islamic sleep stories you prefer (e.g., Prophet stories, descriptions of Paradise, Quranic meditations), you may reveal information about your religious beliefs. Under GDPR Article 9 and UK GDPR this is special category personal data.

By ticking the dedicated consent box titled “I explicitly consent to the processing of my religious-preference data” during onboarding, you acknowledge that: (a) the data revealed is special-category personal data under Article 9(1) GDPR / UK GDPR; (b) processing is based solely on your explicit consent under Article 9(2)(a); (c) your consent is freely given, specific, informed, and unambiguous; and (d) you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Declining this consent does not restrict access to the App.

• We process this only after you give explicit, separate, opt-in consent on a dedicated onboarding screen. Consent to sensitive data processing is never bundled with other consents, and the consent text version displayed at the time of your consent is logged with a version hash.
• If you decline, the App still functions with generic, non-themed content.
• You can withdraw consent at any time in Settings → Privacy → Religious Data. Withdrawal does not affect the lawfulness of processing before withdrawal, stops future processing of theme selections, and purges theme-keyed analytics on a best-effort basis within 30 days.
• We never sell, share, or use this data for advertising, profiling, or cross-context targeting.
• Religious preference data is not transferred to processors beyond those strictly necessary to deliver the App (see §6).

6. Who We Share Data With (Processors)

We do not sell your personal data. We do not share it for cross-context behavioral advertising. We engage the following processors, each under a Data Processing Agreement (DPA):

Each processor is contractually bound to process personal data only on our documented instructions, apply appropriate technical and organisational security measures, assist us with data-subject rights, and notify us of any personal data breach without undue delay.

7. International Data Transfers

Our primary database is hosted in Frankfurt, Germany. User personal data collected from EEA, UK, and other users is stored and processed in the EU by default.

Some processors may transfer limited data outside the EEA / UK. Such transfers are protected by one or more of the following safeguards:

• Transfers to Japan (Airbridge). Attribution data is processed by Airbridge (AB180, Inc., Republic of Korea) via servers located in Japan. Transfers of personal data from the EEA / UK to Japan are safeguarded under the EU–Japan Mutual Adequacy Decision (European Commission Implementing Decision (EU) 2019/419 of 23 January 2019) and the equivalent UK adequacy regulations for Japan, which provide an equivalent level of protection to GDPR / UK GDPR. No additional transfer mechanism is required.
• Transfers to the United States (where applicable to Adapty, Mixpanel operational metadata, Apple, ElevenLabs): the EU–US Data Privacy Framework (where the processor is self-certified) and/or Standard Contractual Clauses (SCCs) issued by the European Commission, with a Transfer Impact Assessment.
• Transfers to third countries generally: SCCs with the UK Addendum for UK data subjects.

The Controller (Burak Seyman, trading as Ari Studio) is established in Turkey. The Controller’s staff may access the EU-hosted database from Turkey solely for the purpose of operating and supporting the service, under strict access controls. A copy of the safeguards applied to transfers (including adequacy confirmations and SCCs) can be requested at privacy@kahfapp.com.

8. How Long We Keep Data

Upon account deletion we hard-delete user-scoped data from Supabase, trigger deletion in Mixpanel (deletion API), Airbridge (gdprForgetMe), and Adapty (profile delete) within 30 days. Aggregated, irreversibly de-identified analytics may be retained indefinitely. Records we are legally required to keep (billing, tax) remain in our system for the statutory period and are access-restricted.

9. Your Rights

Under GDPR, UK GDPR, and CCPA/CPRA you have the right to:

• Access the data we hold about you (GDPR Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data — “right to be forgotten” (Art. 17).
• Restrict processing (Art. 18).
• Data portability in a structured, commonly used, machine-readable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time without affecting past lawful processing (Art. 7(3)).
• Not be subject to automated decision-making that produces legal effects (Art. 22) — see §13.
• Lodge a complaint with a supervisory authority: your local DPA in the EEA, the Information Commissioner’s Office (ICO) in the UK, or the California Attorney General in the US.

You can exercise most of these rights in-app under Settings → Privacy. For anything else, email privacy@kahfapp.com and we will respond within 30 days (GDPR) or 45 days (CCPA, extendable to 90).

California residents (CCPA/CPRA) — goodwill disclosure: Although at our current scale Kahf is not a “covered business” under the CCPA/CPRA applicability thresholds, as a matter of good practice: we do not sell your personal information and we do not share it for cross-context behavioral advertising. You can confirm this and exercise the right to limit the use of sensitive personal information (religious beliefs) by emailing privacy@kahfapp.com or through in-app controls where available under Settings → Privacy. We honor Global Privacy Control (GPC) browser/device signals as a valid opt-out.

EEA / UK users — Direct Contact: While we work toward formal appointment of representatives under GDPR Article 27 and UK GDPR Article 27, EEA and UK data subjects may contact us directly at salam@kahfapp.com in any official EU language on any matter related to our processing of your personal data, including all rights described in Section 8 (Access, Rectification, Erasure, Restriction, Portability, Objection, Withdraw Consent, Lodge a Complaint). We commit to responding within the statutory 30-day window. We will update this Section with the appointed representative contact details when those appointments are made.

10. Children

Kahf is not directed at children. Kahf is targeted at adults aged 13 and older (16 and older in the EEA and UK where national law sets the digital-consent age at 16). A self-declared age attestation is enforced at onboarding. Kahf does not include interactive features, in-app chat, user-generated content, advertising, or any feature designed to engage children — reducing the risk of inadvertent child data collection. We do not knowingly collect personal data from children under the applicable minimum age. If you believe a child has provided us data, contact privacy@kahfapp.com and we will delete it without undue delay. A dedicated child-oriented product (Najm) is planned as a separate app with full COPPA and age-appropriate-design compliance.

11. Security

We apply technical and organisational measures appropriate to the risk, including:

• Transport encryption: TLS 1.2+ for all network traffic.
• At-rest encryption: Supabase-managed AES-256 at the storage layer.
• Access control: Supabase Row-Level Security policies scoping every user record to its owner.
• Credential storage: iOS Keychain for authentication tokens on device.
• Webhook integrity: HMAC-SHA256 signature verification for Adapty and Apple ASN payloads.
• Least-privilege service accounts: scoped API keys with rotation procedures.
• Access logging and audit trails on sensitive operations.

No system is 100% secure. In case of a personal data breach likely to result in a risk to the rights and freedoms of affected individuals, we will notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it (GDPR Art. 33), and affected users as required by law.

12. Cookies and Local Storage

The App does not use website cookies. The App stores limited data locally on your device for functionality: iOS Keychain items (authentication tokens), UserDefaults (preferences), and cache (audio file cache for offline playback). You may clear this data in iOS Settings → General → iPhone Storage → Kahf → Offload/Delete App.

13. Automated Decision-Making and Profiling

We do not use your data to make decisions about you by purely automated means that produce legal effects or similarly significant effects (GDPR Art. 22). Our recommendations (e.g., suggested stories based on your preferences) are content suggestions, are reversible, and do not restrict access or pricing.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be announced in-app and by email (if you have a verified email on file) at least 30 days before taking effect. Non-material changes (typographical corrections, clarifications, processor list updates without change in category of data) take effect upon publication. The “Last Updated” date reflects the latest revision. Continued use of Kahf after the effective date of changes constitutes acceptance of the revised policy.

15. Contact

• Terms of Service: https://kahfapp.com/terms
• Privacy questions & data subject requests: privacy@kahfapp.com
• Legal notices: legal@kahfapp.com
• Security reports: security@kahfapp.com
• Point of contact for authorities (DSA Art. 11 / GDPR Art. 27 liaison): legal@kahfapp.com
• Postal address: Burak Seyman (Ari Studio), Mustafa Kemal Mah. Dumlupınar Bulv. 280G/1260, Çankaya, Ankara, Türkiye

If you are unhappy with our response, you may lodge a complaint with your local data protection authority.