Privacy
LAYN keeps no passwords, shows no ads and sells no data. This policy explains what LAYN collects, why, who we share it with, how long we keep it, and how you can get it all back or delete it.
Privacy
Who we are
LAYN is published by Layn Apps, the controller of your personal data. For any question about your data or this policy, write to contact@layn.app or use the Contact page.
LAYN is hosted by Hetzner Online GmbH, on a server in Falkenstein, Germany (European Union). Hetzner acts as our processor: it hosts the data on behalf of Layn Apps.
This policy applies to LAYN on the web and in its apps. It supplements our Terms of use.
Data we collect
- Your account: the public part of your passkey (your face and fingerprint never leave your device); or the identifier Google or Apple shares with LAYN when you sign in with them, without your name or email; or your email address, if you sign in with a code sent to it. Your first name, if you provide one.
- Your conversations with LAYN, with a title based on your first message.
- Your progress: learning, Quran memorisation (hifz), sessions and assessments.
- Your preferences and reminders: language, time zone, country, how you read and review the Quran, how prayer times are calculated, scheduled reminders.
- Your location, if you provide it for prayer times: latitude and longitude rounded to two decimal places (about 1 km), with the city name.
- What LAYN remembers about you from your conversations: you can view it in your profile, correct it, or have it forgotten.
- Your consents: each grant and each withdrawal, with its date and the version of the text it applies to.
- Your signed-in devices, with their browser and operating system, so you can sign them out.
- Your subscription, if you have one: the plan, its status, price, billing period and dates, and the references of your customer account and subscription at Stripe. Your card, billing address and invoices stay with Stripe: LAYN does not store them.
- Messages you send through the Contact page, along with any email address or phone number you choose to leave so we can reply.
- Technical data: a fingerprint of your IP address (never the address itself) to prevent abuse, the server’s operational logs, and cookieless, aggregated analytics for our public pages (page, country, device, referrer), which never include what you say or read in LAYN.
Your faith: sensitive data
What you write to LAYN may reveal your religious beliefs, which are sensitive data under the GDPR (Art. 9). LAYN processes this data only with your explicit consent: by messaging LAYN, you give that consent, as the notice at the bottom of the screen states before your first message. LAYN records your consent, with its date and the version of this policy, before your message is sent.
You can withdraw your consent by deleting your conversations or your account, or by writing to contact@layn.app. LAYN never uses your faith to target or profile you.
How we use your data, and our legal bases
| Providing the service you request: answering you, keeping your conversations and progress, managing your account | Performance of a contract (GDPR, Art. 6(1)(b)); for anything relating to your faith, your explicit consent (Art. 9(2)(a)). |
|---|---|
| Features you turn on: location, reminders, calendar, sharing your progress | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Your subscription: payment, renewal, cancellation, invoices | Performance of a contract (Art. 6(1)(b)) and our legal obligation to keep invoices (Art. 6(1)(c)). |
| Keeping LAYN secure: daily limits, protection against mass account creation and abuse, the security log | Our legitimate interest in protecting the service and its users (Art. 6(1)(f)). |
| Cookieless analytics for our public pages | Our legitimate interest (Art. 6(1)(f)); your browser’s Do Not Track setting is honoured. |
| Responding to you and handling your data requests | Our legitimate interest (Art. 6(1)(f)); for requests to exercise your rights, our legal obligation (Art. 6(1)(c)). |
Your choices
Location, reminders, calendar sessions and progress sharing stay off until you turn them on. You can turn them off at any time, and each choice is recorded with its date.
Two other profile settings (keeping your recitations, voice dictation) are recorded the same way, but no LAYN feature uses them yet. “Help improve LAYN” stays off unless you accept it: if you do, the conversations you write afterwards may be used to improve LAYN and train its models, on LAYN’s server in Germany; they are never sold. You can withdraw your consent at any time in your profile: it applies from then on, and a model already trained is not untrained. Without this consent, Layn Apps does not train any AI model on your conversations.
Who we share your data with
- Hetzner Online GmbH (Germany) hosts LAYN’s server and its backups.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) provides the AI model that writes LAYN’s answers and titles your conversations. It receives the text of the conversation, LAYN’s instructions and the information LAYN’s tools add to answer you (for example your progress, your city for a prayer time, or the first name of a friend in your halaqa). It does not receive your email, your sign-in credentials or your IP address: requests to DeepSeek come from LAYN’s server.
- Stripe (Stripe Payments Europe, Ltd., Ireland) processes subscription payments on its own checkout page: it receives your email, card and billing address, calculates VAT and issues invoices, under its own privacy policy. LAYN receives only your subscription status from Stripe.
- Google or Apple, only if you choose to sign in with them: they confirm your identity without sharing your name or email with LAYN.
- OVH (France) sends the email containing your sign-in code, if you sign in with email.
- The Quran Foundation provides the Quran texts, which LAYN’s server downloads into its own database without sending any data about you. When you listen to a reciter, your browser streams the audio from its servers, which can see your IP address.
- When you search for a nearby mosque or halal shop, your current location is sent, for that search only, to Google Places or to OpenStreetMap’s public Overpass servers (in Germany, then in Austria if those do not respond). LAYN does not store it: only a rounded area is kept in memory for a few hours, with no link to you.
- Barcodes you scan are sent to Open Food Facts. The scanner’s text recognition downloads its language models from the public jsDelivr network, which can see your IP address; the photo stays on your device.
- Reminders are delivered through your browser’s push service (Google’s, Apple’s or Mozilla’s), which carries an encrypted message. For the calendar, LAYN never reads yours: it publishes a secret, revocable feed address that your calendar app checks to show your sessions.
- Your progress, only if you share it, with the friends, halaqa or public link you choose. You can stop sharing at any time, effective immediately.
- Technical alerts from the server reach our team through ntfy.sh, with no data about you. We disclose data to authorities only when the law requires it, in response to a valid request.
LAYN does not sell your data, show ads, track you across sites or use third-party analytics.
International transfers
- DeepSeek processes and stores the data it receives in the People’s Republic of China. No European Commission adequacy decision covers China, and no standard contractual clauses govern this transfer. It therefore relies on Article 49 of the GDPR: it is necessary to provide the service you request (Art. 49(1)(b)), and you explicitly consent to it by sending your first message after being informed (Art. 49(1)(a)). Without these safeguards, your data is less protected there than in Europe, and local authorities may be able to access it. DeepSeek’s terms set no retention period and do not rule out using the data to improve its models. Please do not share anything you would not want to entrust to it.
- Google, Apple and Stripe may process some data in the United States under the EU–US Data Privacy Framework or standard contractual clauses.
Everything LAYN stores itself (your account, conversations, progress and backups) stays in the European Union.
Your voice
When you recite, your microphone streams the audio live to LAYN’s recitation engine, on its own server: it follows your words, then checks the recitation once you finish. The recording is kept on that server without being linked to your account, and is deleted within 48 hours. No third-party service has access to it.
Using LAYN without an account
LAYN answers your very first message without asking you for anything. To do so, it creates a guest account, with no key, no external identity, no email and no name. Your device’s random identifier is stored only in hashed form.
A guest account unused for 30 days is deleted, along with everything in it. If you sign in before then, what you did as a guest (conversations, progress, reminders, preferences, consents) moves into your account, new or existing, and the guest account is deleted.
How long we keep your data
| Your account, conversations, progress, preferences and consents | Until you delete them, or delete your account. |
|---|---|
| A guest account | Deleted after 30 days without use. |
| A signed-in device | 30 days without use, 180 days at most. |
| The email sign-in code | 10 minutes, hashed; the address it was sent to, one hour at most, to limit sending. |
| The fingerprint of your IP address | 2 days at most. |
| Your subscription | Its status, for as long as your account exists; invoices, at Stripe, for 10 years, as accounting law requires. |
| The export file | Available for 7 days. |
| Your Contact messages | Kept for our team, with no fixed period yet; deleted with your account if you were signed in, or on request. |
| A recitation recording | 48 hours at most. |
| The security log | A fingerprint only, which cannot identify you. |
| Server logs | 30 days at most. |
| Analytics | Aggregated, 13 months at most. |
| Database backups | Encrypted, every night: 14 days on the server; an off-server copy, at Hetzner in the European Union, keeps at most 14 daily, 8 weekly and 12 monthly backups. Data you delete disappears from them as they rotate out. |
Exporting or deleting your data
- Export, in your profile (“Your data”): after a single-use confirmation (valid for 10 minutes), LAYN prepares a copy of everything it stores about you, except secrets (tokens), in a machine-readable file. It stays available for 7 days.
- Deletion, in your profile, which first offers you that file: after the same confirmation, your account and everything linked to it are deleted, along with pseudonymised usage metrics, retry keys and events not yet sent. The security log keeps only a fingerprint. Deleting your account also cancels your Stripe subscription, immediately.
- You can also delete a single conversation, have LAYN forget what it remembers about you, or sign out one device or all of them.
No app needed: open LAYN in your browser, sign in as usual, then go to Profile, “Your data”. If you can no longer sign in, write to contact@layn.app. Unless you signed in with email, LAYN does not know your address, and can act only once it has confirmed the account is yours.
Your rights
You have the right to access your data, correct it, delete it, restrict its processing, object to processing based on legitimate interest, take it with you (the export file), withdraw your consent at any time, and give instructions about what happens to it after your death.
You can exercise these rights in LAYN, or by writing to contact@layn.app; we respond within one month. To protect your account, we may ask you to verify that it is yours.
You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the data protection authority in your country.
Automated decisions
LAYN’s engine adapts exercises to your progress. None of its decisions has any legal effect on you. You can ask LAYN why it suggested an exercise, and it will explain.
Children
Accounts are for people aged 15 or over. Younger users will be able to use LAYN through a profile managed by a parent, which is not available yet. If you believe a child under 15 has given us data, write to contact@layn.app and we will delete it.
Security
Connections are encrypted with HTTPS, sign-in tokens are stored only as fingerprints, your passkey never leaves your device, each account can reach only its own data, and backups are encrypted. If a breach of your data poses a risk, Layn Apps will notify the CNIL, and will notify you if the risk is high.
Within LAYN’s team, only authorised people, signed in with a passkey, can see an account’s data (plan, daily usage, email if known) to help you or manage your subscription; never the content of your conversations. Every view and action they take is logged.
Changes to this policy
This policy is dated and versioned at the top of the page. If we make a material change, LAYN lets you know: the notice linking to these texts reappears at the bottom of the screen, and continuing to message LAYN means you accept the new version.
Contact us
Write to us at contact@layn.app, or use the Contact page.