Kanz e Aza Privacy Policy

Version: 1.0 · Effective: 14 October 2026

This policy explains what information the Kanz e Aza app and website handle, why, and the choices you have. Kanz e Aza is run by Mir Husain Ali Mohammed in Oman ("we", "us"), who is responsible for your information. Contact: ashrafamily.sub@gmail.com.

The short version

• You can read every lyric without an account, in the app or on the website. In the app, your favourites, history and settings stay on your phone. On the website, lyrics you're still writing stay in your browser.
• We don't show ads, use analytics or tracking tools, or sell or rent your information.
• If you submit a lyric in the app, we store it with an anonymous account ID so we can review it and you can manage it. We never ask app contributors who they are: no name, email or phone number.
• To submit a lyric on the website, you sign in with Google, so we receive your name, email address and profile picture from Google.
• Published lyrics are public. Your account ID, name and email are never published with them.

1. Information that stays on your device

The app keeps these on your phone. We can't see them:

• the lyric catalog, your favourites and recently viewed lyrics;
• lyrics you write or import, and your drafts;
• your settings, such as reading surface, text size and language;
• a random ID the app creates on first launch to mark which lyrics on the phone are yours. The current app doesn't send it to us. Submissions made with older versions of the app may include it, and we'll delete it on request.

Android backup. If Android backup is on, Android may copy your own lyrics, drafts and favourites, including the random ID stored with your lyrics, to your Google account or to a new phone. Nothing else from the app is included. On Android 12 and later, Android makes this cloud backup only when it can encrypt it. Backup follows your Google account's backup settings.

To remove this information, delete it in the app, clear the app's data, or uninstall the app.

On the website, there are no favourites, history or settings. If you sign in to write a lyric, the website keeps your drafts in your browser until you submit or delete them (section 8). We can't see a draft until you submit it.

2. When you submit a lyric

In the app, the first time you submit, after you accept the Contribution Terms, the app signs you in to Firebase Authentication anonymously. This creates a random account ID. It doesn't use your name, email or phone number.

On the website, you sign in with your Google account before you submit. Google shares your name, email address and profile picture with Firebase Authentication, which keeps them with your account ID. The website shows your name or email address to tell you who is signed in. We don't store your name or email address with your submissions.

We then store the following in Google Firebase (Cloud Firestore):

• the lyric's title, text and formatting;
• the details you give: language, categories, subcategory, release year, poet and anjumans, and, for a correction, which published lyric it corrects;
• your account ID, the dates you submitted and last edited it, its review status, and the version of the Contribution Terms you accepted;
• review records: the decision and when it was made, any reason for rejecting it or note from the admin, which admin approved, rejected or last edited it, whether it's marked as verified, and whether it has been published.

If an admin edits your lyric, the edited version replaces the one you sent.

Why we use it: to review and publish the lyric, to show it in My Contributions (My submissions on the website), to let you change or delete it while it waits for review, and to keep a record that you agreed to the Contribution Terms.

We don't ask about your religious beliefs or other sensitive matters. Apart from the poet's name and anjumans, please don't put personal information about yourself or anyone else in a lyric or its details. If you are a poet or reciter named in a lyric, you can ask us to correct or remove your name.

3. Publishing and the public catalog

When an admin approves a lyric, we publish its text and details, including the poet, in the app, on the website and in the public Kanz e Aza Lyrics catalog on GitHub (https://github.com/The-Tech-Boi/Kanz-e-Aza-Lyrics), where anyone may reuse it under CC BY 4.0.

An automated job on GitHub reads approved submissions from Firebase about every six hours to publish them. It can see the whole submission record, including your account ID, but it publishes only the lyric and its details. A second job runs daily to delete expired submissions (section 12).

Published lyrics never include your account ID, name or email. We don't name contributors. If a lyric is later removed, copies already on phones, in earlier versions of the public catalog, or reused by others under the licence may remain.

4. Admin accounts and access requests

We invite admins by email. An admin signs in with their Google account, or in the app with an email address and password, through Firebase Authentication. We store each admin's email address, the name on their Google account, their account ID and when they became an admin, plus each email address we invited and who invited it.

Anyone signed in on the website with Google can ask to become an admin. We store the request with the person's email address, name and account ID, when they asked, and our decision and when we made it.

We record which admin approved, rejected or edited each submission, and who withdrew a lyric from the catalog or restored it.

5. Notifications (optional)

New-lyric notifications in the app are off by default. If you turn them on, the app asks for notification permission and uses Firebase Cloud Messaging (Google) to create a device token and subscribe it to a public "catalog updates" topic. We don't store the token or link it to your submissions.

When you turn notifications off in the app, it unsubscribes the device and deletes the token. If you block notifications in your phone's settings instead, the next time you open the app it turns notifications off, unsubscribes the device and deletes the token.

6. Read Mode

Read Mode in the app keeps the screen on. It needs Do Not Disturb access, and asks you for it when the app doesn't have it. While it's on, it silences calls and notifications (alarms still sound), sets the ringer to silent and turns the media volume to zero. It stays on until you leave it, even if you switch to another app, and then it restores your previous settings. It doesn't read your notifications, calls or contacts.

7. Services that receive technical information

When the app or website goes online, these services receive your IP address and basic technical details, such as device or browser type and app version, as part of normal operation:

• Google Firebase: sign-in, the submission database, notifications and hosting the website (Google Privacy Policy).
• Google sign-in: when you sign in with Google, Google handles the sign-in under its own policy and tells us who you are (sections 2 and 4).
• GitHub: hosts the public catalog, sends catalog updates to the app (it checks each time you open the home screen) and the website, and runs the jobs in section 3 (GitHub Privacy Statement).
• Google (website only): on every visit, signed in or not, the website loads its display engine, some fonts, the Firebase code and Google's sign-in code from Google's servers (gstatic.com and accounts.google.com). The app includes its own fonts.
• Hetzner (backup website only): if you use the website's backup address (backup.kanz-e-aza.com), the server we rent from Hetzner Online in Germany keeps standard server logs (Hetzner Privacy Policy).

These services handle that information under their own privacy policies.

8. Cookies and browser storage

The website doesn't set cookies, and it has no advertising or analytics trackers. It uses your browser's storage only for things it needs to work:

• Signing in: if you sign in, Firebase Authentication keeps you signed in using your browser's storage until you sign out.
• Drafts: a lyric you're writing is saved in your browser as you type, and deleted when you submit it or delete the draft. Drafts stay in the browser after you sign out, so on a shared computer, delete them or clear the site's data.
• Faster loading: the website keeps a copy of its own files, including the built-in lyric catalog, in your browser so it loads faster next time.

Because this storage is needed for what you ask the website to do, we don't ask for consent or show a cookie banner. You can remove all of it by signing out and clearing the site's data in your browser's settings. The Google services in section 7 handle their own requests under Google's privacy policy.

The app doesn't use cookies. It keeps its information on your phone as described in section 1.

9. Who we share information with

We don't sell or rent your information, and we don't share it for advertising. We share it only:

• with the services in section 7, which store or process it for us;
• with everyone, when we publish an approved lyric and its details (section 3);
• with our admins, who see submissions so they can review them;
• when the law requires it, for example to answer a valid order from a court or authority, or when we need to protect the rights or safety of people or of Kanz e Aza;
• with whoever takes over running Kanz e Aza, if that happens. They must keep to this policy.

10. Why we're allowed to use your information

• Submissions, and signing in on the website to submit: we handle them to provide the service you ask for when you accept the Contribution Terms.
• Notifications: we rely on your consent. You can withdraw it at any time by turning notifications off.
• Approved-submission and security records, admin accounts, access requests and review records: we keep them to prove we had permission to publish a lyric, to run the review and to keep the catalog safe.
• Legal requests: we keep or share information when the law requires it.

For users in the EU and UK, these legal bases are contract, consent, legitimate interests and legal obligation, in that order.

11. Where your information is stored

Firebase stores submissions on Google's servers in the United States. The backup website runs on a server in Germany. Google and GitHub may process information in other countries too, including outside Oman and outside the country you live in. These providers protect international transfers with safeguards such as standard contractual clauses. Email us if you want details of these safeguards.

12. How long we keep it

• On your device: until you delete it, clear the app's data or uninstall. An Android backup copy follows your Google backup settings.
• In your browser: drafts until you submit or delete them, or clear the site's data; the sign-in until you sign out; the website's saved files until a new version of the website replaces them or you clear the site's data.
• Pending submissions: until they're reviewed or you delete them. Pending submissions with no activity for 12 months are deleted.
• Rejected submissions: deleted 6 months after rejection, or sooner if you delete them or ask us to.
• Approved submissions: we keep the record, including your account ID and the terms version you accepted, while the lyric is in the catalog and for 2 years after it's removed, as proof that we had permission to publish it. Submissions sent before 14 October 2026 were made before the terms existed and have no terms record.
• Your anonymous app account: deleted when you withdraw a submission and none are left, or when you use "Delete my submissions and account" in My Contributions. If you uninstall the app, clear its data or move to a new phone, the app can't sign in to it again, even if your lyrics come back from a backup. Your submissions stay, and you can ask us to delete them and the account.
• Your website account (Google sign-in): kept until you ask us to delete it.
• Admin access requests: kept until we delete them. A refused request stays, so the same account can't ask again until we reset it.
• Admin accounts and invites: until the person stops being an admin or we cancel the invite. Review records stay with each submission.
• Notification token: deleted when you turn notifications off in the app, or the next time you open the app after blocking notifications in your phone's settings. Otherwise Google expires it after a long period without use.

13. Your choices and rights

• Delete a pending or rejected submission yourself, in My Contributions in the app or My submissions on the website. In the app, "Delete my submissions and account" removes all of them and your anonymous account at once. To delete your website account, or to remove an approved lyric, email us (Contribution Terms, section 8).
• Email ashrafamily.sub@gmail.com to:
  • see, correct or delete information we hold about you, or get a copy of it in a common electronic format;
  • withdraw consent or object to how we use it;
  • ask us to pause using it while we deal with your request.
• Confirming it's you:
  • App contributors are anonymous, so we don't know who you are. If you still have the app, we may ask you to show the submission in My Contributions. If you can't open the app, give us the lyric's title, roughly when you sent it and any detail you remember. If we can't confirm it's yours, we may still delete a pending or rejected submission.
  • For a website account, email us from the address of the Google account you signed in with.
• Approved submissions: we can remove the lyric, but we keep the submission record for the period in section 12, because it shows we had permission to publish.
• We reply within one month. If we can't do what you ask, we'll tell you why.
• We don't make automated decisions about you.
• You can complain to a data protection authority. In Oman this is the Ministry of Transport, Communications and Information Technology. In the EU or UK, it's the authority where you live.

14. Children

Anyone can read lyrics without giving us information. To submit lyrics you must be at least 13, and if you're under 18, a parent or guardian must agree to the Contribution Terms for you. If we learn that someone under 13 submitted a lyric, we delete their submissions and account. If you're a parent or guardian and think your child under 13 has sent us a lyric, please email us.

15. Security

Information travels encrypted (HTTPS). Database rules let only a submission's owner and our admins read it; the published lyric is public, but the submission record isn't. Our publishing and clean-up jobs also read submissions, using a protected server key. Only a few people have admin access, and admins must sign in.

No system is perfectly secure. If a breach puts your information at risk, we'll tell the authorities as the law requires. Because we don't have contact details for anonymous contributors, we'll also post a notice in the app and on the website.

16. Other websites

The app and website link to other websites, such as the public catalog on GitHub, the Creative Commons licence and the privacy policies in section 7. Those websites have their own privacy policies, and we aren't responsible for them.

17. Changes to this policy

When we change this policy, we publish a new version with a new effective date. If the change matters for how we use your information, we'll show a notice in the app or on the website, usually with an app update, before it applies.

18. Contact

Mir Husain Ali Mohammed, Oman ashrafamily.sub@gmail.com