DhikrCirclePrivacy policy
Last updated: 4 November 2026
DhikrCircle (Turkish name: ZikirHalkası) helps you count your own dhikr and, if you like, reach a shared goal with others. It is developed by Roof Stacks. This policy explains what we process and why, who we share it with, how long we keep it and what your rights are.
In short
- You can use the app without an account. Your personal counters, goals, your own dhikr and your reminder time stay on your phone; they are not sent to us.
- An account is optional and only needed for shared rooms. You create it by signing in with Apple or Google; we keep no passwords.
- The app has no ads and uses no analytics, measurement or tracking tools. Your dhikr and rooms are never used for advertising and never sold.
- You can delete your account any time in Settings › Account › Delete account.
Controller
The controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) is Roof Stacks Yazılım Anonim Şirketi (Roof Stacks Software Inc.) (trade registry MERSİS: 0735157008200001, address: Atatürk Mahallesi, Ataşehir Bulvarı, Muhtar Hasan Sokak, Avrupa Office Ataşehir No:1, Kat: 29, 34758 Ataşehir/İstanbul, Türkiye). Contact: apps@roofstacks.com.
What we process
Stays on your phone only
Personal counters and goals, the dhikr you choose or add, the daily reminder and its time, theme and vibration preferences. These are not sent to our servers and are removed when you delete the app. The daily reminder is a local notification on your phone.
If you create an account
- Account data: account ID, sign-in method (Apple or Google) and the email address that service shares. With Apple's "Hide My Email" we receive Apple's relay address.
- Display name: the name you enter, shown to other members of your rooms.
If you use rooms
- Room data: room name, the room's dhikr, target count, memberships and roles (owner/member), join and leave times, ownership transfers.
- Contributions: the counts you add to a room and when.
- Invite codes: valid for 15 minutes. We keep an attempt counter to prevent code guessing; no IP address is stored.
Notifications
If you turn on room notifications, we process your device's push token, its platform (iOS/Android) and your notification preference. Notifications are only about your rooms: when someone joins your room, when a room reaches its goal, or when a room's ownership passes to you. The text is fixed and carries only an internal room number; it never contains a room name, dhikr or a person's name. We send no promotional notifications.
Technical logs
For security, our providers' servers briefly keep access logs such as IP address and request time.
What we do not process
Location, contacts, photos, microphone, health or payment data, advertising ID, usage analytics and crash reports.
Dhikr and belief
Your room contributions may reveal religious practice and may be special category data under KVKK Art. 6 and GDPR Art. 9. We process this only to run the rooms you take part in, and show it only to members of the same room. We never use it for profiling, advertising or any other purpose, and never share it. Your personal counters never reach our servers.
Why we process it
| Purpose | Legal basis |
|---|---|
| Account creation, sign-in and account management | Contract (KVKK 5/2-c, GDPR 6(1)(b)) |
| Running shared rooms: rooms, invites, counts, totals, ownership transfer | Contract; for belief-related data, KVKK Art. 6 and GDPR Art. 9 |
| Room notifications | Contract |
| Security and abuse prevention | Legitimate interest (KVKK 5/2-f, GDPR 6(1)(f)) |
| Account deletion, support and data requests | Contract, legal obligation |
| Legal obligations and disputes | Legal obligation, establishment of rights |
Who we share it with
We share data only with providers that run the service on our behalf. We do not share or sell it for advertising or marketing.
- Other members of your rooms: your display name and contributions.
- Google (Firebase Authentication, Google Sign-In): accounts and sign-in. Servers in the USA and other countries.
- Apple (Sign in with Apple): sign-in; Apple access is revoked when you delete your account.
- Supabase Inc.: database and server functions (rooms, contributions, display name, notification registration). Servers: European Union (Frankfurt, Germany).
- Apple (APNs) and Google (Firebase Cloud Messaging): delivering iOS and Android room notifications.
- Authorities: only where they are legally entitled.
These providers' servers are outside Türkiye. Transfers from Türkiye rely on safeguards under KVKK Art. 9, such as standard contracts announced by the Turkish Personal Data Protection Board. Transfers from the EEA/UK rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.
How long we keep it
- Account data and display name: until you delete your account.
- Push token: until you turn notifications off or delete your account.
- Room and contribution records: while the room exists. If you delete your account, your counts stay in the room total without your name.
- Invite codes: valid for 15 minutes; attempt counters are removed shortly after.
- Support and deletion correspondence: up to 1 year after the request is closed.
- Backups: deleted data leaves server backups within 30 days.
Deleting your account
In the app: Settings › Account › Delete account. If you can't open the app, follow the steps on the account deletion page, which also explains what is deleted and what remains.
Your rights
Under KVKK Art. 11 you may ask whether your data is processed, request information about it, learn its purpose, know who it is shared with, ask for correction or deletion and for recipients to be told, object to a result against you from solely automated analysis, and claim compensation for unlawful processing. If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, may withdraw consent at any time, and may complain to your supervisory authority.
To make a request, email apps@roofstacks.com from the address registered in the app. We reply free of charge within 30 days.
Security
Data is encrypted in transit, protected in the database by row-level access rules and visible only to people in the same room. Within our team, only authorised people access data, and only when needed.
Age
DhikrCircle is published for people aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18; if we find out, we delete it.
Changes
If we update this policy we change the date above and announce important changes in the app. If we add new processing such as ads or analytics, we will ask for your consent first where required.