Privacy notice

1. Who is responsible

Maran is owned and operated by Umit Hassan. Tim Hassan handles support and privacy enquiries. We aim to respond within five working days; this is a response target, not a resolution guarantee or a replacement for legal deadlines. For questions, email timurhassan30@gmail.com.

2. Information used by the app

• On-device study information: reading progress, settings, bookmarks, highlights, notes, quiz history and memory practice.
• Account information: email address, display name, account identifier, hashed password credentials, session records and records of accepting the app’s legal documents.
• Synced information: notes, saved passages and study activity uploaded only after explicit cloud-sync consent, together with the recorded consent choice, notice version and time.
• Community features: groups, rankings and community sharing are deferred for launch; the current release does not enable participation.
• Purchase information: store and subscription-status records used to recognise access where purchase features are enabled. Payment-card details are handled by your store.
• Support correspondence: your email address and information you choose to send when requesting help.

Notes, saved passages and study activity can reveal religious beliefs. Do not include private information about other people in notes or comments. Cloud sync asks for separate explicit consent in Account settings; signing in does not opt you in. Successful withdrawal stops sync and removes the active cloud snapshot while leaving your local data available. Pausing sync or signing out alone does not remove an earlier cloud copy. Community sharing is not enabled in the launch release. Backup copies follow the lifecycle below. Support is for technical, account, billing and privacy-rights matters. Please do not send private prayer notes, health details or information about other people. We do not use support messages to infer religious beliefs. If unnecessary sensitive material arrives, we request a redacted description and remove unnecessary content where lawful. We assess any information needed for a rights request or legal dispute separately; sending an email is not treated as explicit consent.

3. Why information is used

Information supports sign-in, account recovery, cloud sync, progress tracking, personalised practice, access to purchased features, support and service security.

We use account information to perform our contract with you, including sign-in, recovery and purchased access. We rely on consent for optional product measurement and optional cloud sync, including explicit consent for synced study information that may reveal religious beliefs. Our legitimate interests are keeping the service secure, diagnosing faults and responding to ordinary support requests, limited to information reasonably needed for those purposes. We also process information where necessary to meet legal obligations, including privacy-rights requests. General account acceptance is not consent to cloud sync.

4. Optional product measurement

Product measurement is off by default and is enabled separately on each device in Me. When enabled, it records screen visits, learning completions and store-checkout outcomes using a random device identifier. The event design excludes names, email addresses, verse text, notes and answers. The identifier makes these pseudonymous records, not anonymous records.

You can disable measurement and request deletion of that device’s earlier measurement records in Me. Measurement events older than 90 days are removed when new events are recorded. This is not a guaranteed deletion deadline if no further events are received. Diagnostic-report cleanup runs at server startup and hourly using a 90-day cutoff. Backups have a separate lifecycle.

5. Study content and AI

Pre-written AI-assisted study content is prepared in advance. Reading that content is different from requesting a new AI-generated explanation.

On-demand explanation generation is disabled in the current production release. Reading a pre-written study does not request a new AI explanation or send your private study notes to OpenAI.

6. Service providers and sharing

Hostinger hosts the account service and primary database in Manchester, UK, with weekly off-server recovery copies in France. Resend delivers password-reset emails and receives the recipient address and recovery-message content. RevenueCat processes account identifiers and subscription information. Apple handles iOS payments. Google provides the Gmail mailbox used for support correspondence. API.Bible supplies Scripture through Maran's server; enabled direct audio sources include publicdomainaudiobibles.com and ebible.org. This support website uses Sites hosting.

These services can process information needed to perform their function. Your device also makes network requests for content. Hosting and content providers may receive connection information such as your IP address.

Resend's sending region is Ireland, but its documentation identifies US processing for account data and email metadata/logs. RevenueCat also describes US processing in its privacy information. A UK primary server does not make all processing UK-only. Resend and RevenueCat publish UK transfer provisions; Hostinger publishes data-processing terms. For relevant UK transfers, the Resend and RevenueCat data-processing terms include standard contractual clauses with UK provisions. Google handles consumer Gmail under its own privacy policy, not a Google Workspace processor agreement, and describes its international safeguards in its transfer framework notice. You can ask us for further information about applicable safeguards and copies where available, with confidential information redacted.

7. Retention and deletion

Local data remains on your device until removed using the app’s controls or device storage controls. Account and synced data are maintained to provide your account services. In-app account deletion removes account records and associated data covered by the deletion implementation.

Deleting an account does not cancel a store subscription. Store providers may retain their own transaction records under their policies.

Daily database backups normally expire after 30 days following a successful new backup, preserving the newest two. Manual database dumps have a separate 30-day cleanup, preserving the newest readable manual recovery archive. These recovery exceptions can retain older copies if newer backups are unavailable; this is not universal deletion within 30 days. Hostinger-managed weekly backups are stored separately in France and older copies are replaced automatically. Their replacement schedule is separate from Maran's daily and manual backup cleanup.

Successful account deletion removes associated active database records. Withdrawal removes the active cloud snapshot, not your account. Existing accounts are not automatically marked as consented. Restoring a backup must not reintroduce erased active data for ordinary use without reapplying the relevant deletion or withdrawal.

Tim Hassan reviews support correspondence monthly and will normally delete resolved messages 12 months after resolution, except for documented disputes or legal obligations. This is a manual procedure; no automated mailbox cleanup is claimed.

8. Your choices and rights

You can use core reading without creating an account, disable optional product measurement, manage reminders, export local data where available, and initiate account deletion in Account settings. Account features such as sync require the relevant account information.

Depending on your circumstances and applicable law, you may have rights to access, correct, erase, restrict or obtain a portable copy of your personal information.

You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.

Send requests to timurhassan30@gmail.com. We may need to verify your identity. You may also complain to the UK Information Commissioner’s Office.

9. Security, children and changes

The account implementation hashes password credentials and session tokens. No internet service can guarantee absolute security. Do not send passwords or recovery codes to support.

Maran's intended launch audience is ages 13 and above; it is not intended for children under 13. Local rules may require additional safeguards for older children. Contact the privacy address if you believe an under-13 child has supplied personal information.

The effective date appears above. We will identify material changes with an updated date and communicate them in the app where appropriate.