Privacy

LAYN keeps no password and no e-mail for your account. Here is what it does keep, why, who receives it, and how to take it all back or erase it.

Version of 20 October 2026

Draft for the founder to review

Who is responsible

The data controller is {{EDITEUR}}. For any question about your data: contact@layn.app, or the Contact page.

LAYN is hosted by Hetzner Online GmbH, in Germany (European Union), which acts as a processor. The database backups are on the same server and kept {{RETENTION_SAUVEGARDES}}.

What LAYN keeps

  • Your account: a passkey (its public part only; your face or fingerprint never leaves your device) or the link to your Google or Apple identity, without an e-mail. Your first name, if you give one.
  • Your conversations, titled from your first message.
  • Your progress: memorisation, sessions and assessments.
  • Your preferences: language, time zone, country, how you read and revise the Quran.
  • What LAYN remembers about you: you see it in your profile, and you correct it or have it forgotten.
  • Your signed-in devices, with their browser and system, so you can close them.
  • What you write to LAYN from the Contact page, kept for the team only, with the address or number you choose to leave there so that we can answer.
  • An audience count of the public pages, without a cookie: our own servers count the visits (page, country, device, where you came from), with no third party and no advertising, as aggregated data kept 13 months at most. Your “do not track” is respected; what you say or read in LAYN is never part of it.

Why, and on what basis

  • Giving you the service you ask for (conversations, progress, account): performance of the contract (GDPR, art. 6.1.b).
  • The options you turn on (place, reminders, calendar, sharing): your consent (art. 6.1.a), which you withdraw whenever you like.
  • Keeping the service safe (daily ceilings, limits against mass creation of guest accounts and abuse): legitimate interest (art. 6.1.f).

What you write can reveal your faith, which is sensitive data (art. 9). LAYN processes it only with your explicit agreement: writing to LAYN is that agreement, as the line under the writing field says before your first send, and LAYN records it with its date before your message leaves. You withdraw it by erasing your conversations or your account, or by writing to contact@layn.app.

What you decide

Your approximate place (latitude and longitude to two decimals, about 1 km), reminders, sessions in your calendar and sharing your progress stay off until you allow them. You withdraw them whenever you like, and each choice is recorded, with its date.

Three other profile settings (keeping your recitations, voice dictation, improving LAYN anonymously) are recorded the same way, but no function of LAYN uses them yet.

Who receives what

  • DeepSeek provides the model that writes the answers and names the conversations. It receives the text of the conversation and what LAYN’s tools add to it to answer (your progress, for example), on servers in China. No adequacy decision of the European Commission covers this transfer: do not write what you do not want to entrust to it.
  • Quran Foundation provides texts of the Quran, which LAYN’s server downloads for its own library. None of those requests carries any data about you.
  • Google or Apple, in the United States (Data Privacy Framework), only if you choose to sign in with them.
  • When you look for a mosque or a halal business near you, your position at that moment goes, for that search only, to Google Places or to OpenStreetMap’s public servers (Overpass). LAYN does not record it.
  • The barcode you scan goes to Open Food Facts. The scanner’s text reader downloads its language models from the public jsDelivr network, which sees your IP address; the photo stays on your device.
  • Reminders travel through your browser’s notification service (Google’s, Apple’s or Mozilla’s), which carries the encrypted message.
  • The calendar: LAYN does not read yours. It publishes a secret, revocable address that your calendar application (Google, Apple, Outlook) reads to show your sessions.
  • Your progress, only if you share it, with the friends, the halaqa or the public link you choose. You withdraw that sharing at any time, and it stops at once.

Your voice

When you recite, your microphone sends the sound, live, to LAYN’s recitation engine, on its server: it follows your words, then checks the recitation once it is over. That engine today keeps each session’s recording on its server, without linking it to your account or setting a duration, whatever your “Keep my recitations” setting says.

Without an account

LAYN answers from your first message, asking nothing first. It then creates a guest account: no key, no external identity, no e-mail and no name. Your device’s random identifier is kept only as a hash.

A guest unused for 30 days is erased, like any person. If you sign in before then, the account keeps everything, and nothing moves.

How long

Your conversations, progress and preferencesUntil you erase them, or erase your account.
A guest accountErased after 30 days without use.
A signed-in device30 days without use, 180 days at most.
The export fileAvailable for 7 days.
Your message to ContactKept for the team; erased with your account if you were signed in.
The security logA fingerprint only, which does not let anyone find you.
A recitation’s recordingOn the engine’s server, with no duration set today.
The database backups{{RETENTION_SAUVEGARDES}}

Taking it back or erasing it

  • Export, in your profile (“Your data”): after a single-use confirmation (valid for 10 minutes), LAYN prepares a copy of everything it keeps about you, except secrets (tokens). It stays available for 7 days.
  • Erasure, in your profile, which first offers you that file: after the same confirmation, your account and everything attached to it is deleted, along with pseudonymised usage measures, retry keys and pending events. The security log keeps only a fingerprint of it.
  • You can also delete a conversation, have what LAYN remembers about you forgotten, and close one device or all of them.

Without installing an application: open LAYN in your browser, sign in as usual, then Profile and “Your data”. If you can no longer sign in, write to contact@layn.app: LAYN does not keep your e-mail, so it can act only if it can make sure the account is yours.

Your rights

You have the right to access your data, correct it, erase it, limit its processing, object to it, take it with you (the export file) and withdraw your consent. You exercise them in LAYN, or by writing to contact@layn.app; the answer comes within a month.

You can also lodge a complaint with the CNIL (cnil.fr).

What LAYN decides for you

LAYN’s engine adapts the exercises to your progress. No decision has a legal effect on you. Ask LAYN why it suggested an exercise: it explains its decision.

Children, and advertising

An account is reserved for people aged 15 or over. Younger people use LAYN through a profile managed by a parent, which does not exist yet.

LAYN shows no advertising, does not follow you from site to site, resells nothing and uses no third-party analytics tool.

On your device

One cookie, layn_refresh (HttpOnly, Secure, SameSite=Lax), keeps you signed in: it expires after 30 days without use, and after 180 days at the latest. During a sign-in with Google or Apple, a second cookie, layn_oidc, lives for 5 minutes.

The screens’ language and each conversation’s open panels are also remembered on your device.

Security

Sign-in tokens are kept only as a fingerprint, the cookie is limited to HTTPS, your passkey never leaves your device, and each account reaches only its own data.

Changes

This text is dated at the top of the page. When it changes, the date changes, and that version is the one that counts.

A question

Write to us at contact@layn.app, or from the Contact page.

Terms of use