Privacy policy
What we collect
When you send the contact form, we store what you enter: your name and email, your phone number and company if you add them, the service, budget and timeline you choose, and your message. We also note the language of the page, the page of ours you came from, any campaign parameters in the link that brought you (such as utm_source), and the host name of the site that referred you (for example linkedin.com, never the full address). To stop abuse, we store your IP address only as an HMAC hash made with a secret key. The address itself is never saved with your enquiry.
Links to app stores
When you follow a link from our site to one of our own apps in an app store, or to its website, we add one to a daily count for that app, store and campaign. The count uses no cookies and stores no IP address or anything else about you.
How we use it
We use your details only to reply to your enquiry, the campaign details only to learn which of our pages and posts bring enquiries, and the hashed IP only to block spam and abuse. We never sell your data or share it for marketing. The site sets no tracking cookies: the only cookie we set remembers whether you chose the light or dark theme. Our hosting and CDN provider, Cloudflare, processes technical request data such as IP addresses to deliver and protect the site. The site uses Cloudflare Web Analytics, which Cloudflare states does not use cookies, to count page views in aggregate.
How long we keep it
We keep your enquiry for as long as we need it to handle your request and any project that follows. You can ask us to delete it at any time.
Your rights
You can ask to see the data we hold about you, to correct it, or to have it deleted. We may ask you to confirm the request from the same email address, and we will tell you once it is done.
Step-by-step deletion pages for our apps with accounts:
- Delete your Dates & Tasks account and data
- Delete your Smart Spend account and data
- Delete your Busy Bay account and data
- Delete your Torqle account and data
- Delete your Rakkeb account and data
- Delete your Tiko Bot account and data
- Delete your Puzzly account and data
- Delete your Crystal Crush account and data
- Delete your Shilla account and data
- Delete your Nizamna account and data
Usage statistics in our apps
Our apps (the Quran apps, Muslim Life, Hadith Books, Dates & Tasks, Smart Spend, Crystal Crush, Busy Bay, Torqle, Rakkeb, Shilla and Nizamna, and our children's games as described below) send us usage statistics that do not identify you so we can find what is confusing, slow or broken and fix it. They record which screens are opened and for how long, which buttons are tapped and where on the screen (as a position relative to the screen size), how far lists are scrolled, which steps of a task such as the first setup are completed, and the app version, device type and size, operating system version, language and network type (Wi-Fi or mobile data). The apps never send what you type or store: no task or note text, no amounts or budgets, no names, email addresses, phone numbers or passwords, no search words, no Qur'an notes, no messages, no business records and no health information, and they never take pictures of your screen or record a replay of your session. Each app except the children's games counts returning use with a random number created on your device, different in every app; it is not linked to your account, your advertising ID or any other app. Smart Spend sends these statistics without tap positions and without the link or campaign that brought you, with times rounded to 5 minutes. The statistics go to our own server at athryza.com; we keep the country a request came from (not for the children's games) but never the IP address. Detailed records are deleted after 90 days at most (14 days for Smart Spend, 7 days for the children's games); to count how many people come back within 30 days, a scrambled form of the random number and the day it first appeared are kept for 35 days. After that, only daily totals, which identify no one, are kept. We can switch the statistics off for any app remotely, and deleting an app deletes its random number.
ATHRYZA Ads in our apps
Our apps (except Nizamna) can show ATHRYZA Ads: our own clearly labelled ads for our other apps and for sponsors we deal with directly. They are contextual: an ad is chosen only from the app, the screen, the language, the app version, the platform and, outside our children's games, the country (taken from the network, never from GPS). No advertising ID, install ID, account, contact or anything you type is used, and we never build a profile of you across apps. Each ad request carries a random number that is new every time the app is opened, so we can cap how often you see an ad in that session; the app may keep daily counts on the device for the same purpose, unless you refused consent where the law asks for it. We record whether an ad was shown, seen, tapped, closed, skipped or reported and, for videos, how much was watched, so we can count delivery honestly, bill sponsors and stop fraud. These records are deleted after 90 days (the request records after 35); only daily totals are kept. Every ad has a ⓘ button that explains why it was shown and lets you report it. Where an app also uses Google AdMob, AdMob is used when we have no ad of our own for that place, as that app's section and Google's privacy policy describe. In our children's games (Brain Land and Tiko Bot) ATHRYZA shows only family-safe ads that a person at ATHRYZA has reviewed, never full-screen and never during play; on iOS our cards promote only our own apps, and any link in them asks a grown-up first. Brain Land also shows child-directed Google AdMob ads on Android and iOS, and Tiko Bot on Android only: a banner in the same place when we have no card, and now and then a short ad between levels or missions — never at launch and never during play. Those requests are marked as directed to children and limited to ads rated for general audiences, so they are not personalised; the games do not use the advertising ID and do not ask for permission to track. On iOS, Tiko Bot contains no third-party ad code: they show only ATHRYZA cards for our own apps, or nothing, and no ad between levels.
Our Quran apps (the Juz and Surah apps)
This section covers every one of our offline Quran apps for a single Juz or Surah. They share one code base and handle data in exactly the same way. They have no accounts, no purchases and no uploads, and the Quran text and recitations are built into the app, so reading and listening work offline. What you save in the app, such as your settings, stays on your device, and deleting the app erases it. The Qibla compass is calculated on your device: the app asks for location permission only when you open the Qibla screen, and your location is never sent to us or to anyone else.
The apps use these Google services: Firebase Analytics, to count which features are used and how ads perform, with a fixed list of events that is not linked to any account; Firebase Crashlytics, which sends a crash report with technical details of the device and app when the app fails; Firebase Cloud Messaging, so we can send an occasional notification, which may open a link; and Firebase Remote Config, which adjusts how often ads appear. The apps show ads from Google AdMob, limited to ads rated for general audiences (PG). Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised. On iPhone the app asks whether you allow tracking, and AdMob uses the advertising identifier only if you do. To show and measure ads and prevent fraud, Google receives data such as your IP address (from which it estimates an approximate location), device identifiers and how ads were viewed or tapped, as Google's privacy policy describes. The apps also send ATHRYZA usage statistics and can show ATHRYZA Ads, as described above. The records we hold are deleted automatically within 90 days, so there is no account to delete.
Hadith Books
Hadith Books has no accounts and no purchases. The hadith collections are downloaded over an encrypted connection from GitHub, where we host them; GitHub receives your IP address as with any download, and the app sends nothing about you with the request. What you save in the app stays on your device. The Qibla compass is calculated on your device, and your location is never sent to us or to anyone else. The contact button opens your own email app.
The app uses Firebase Analytics with Google's automatic measurement only (app opens, screens and sessions, not linked to any account), Firebase Crashlytics for crash reports, and Firebase Cloud Messaging for occasional notifications, which may open a link. It shows ads from Google AdMob. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised; on iPhone the app asks whether you allow tracking, and AdMob uses the advertising identifier only if you do. To show and measure ads and prevent fraud, Google receives data such as your IP address (from which it estimates an approximate location), device identifiers and how ads were viewed or tapped. The app also sends ATHRYZA usage statistics and can show ATHRYZA Ads, as described above. The records we hold are deleted automatically within 90 days, so there is no account to delete.
Muslim Life
Muslim Life has no accounts and no purchases; its Account page keeps your details on your device only. Your settings, downloads and reading progress stay on your device, and deleting the app erases them.
Location is optional and used only for prayer times and the Qibla direction. The app asks for permission only after you tap to use your location. Prayer times and the Qibla direction are then calculated on your device. To show the name of your city, the app passes your approximate position to your phone's built-in place-name service (Google's on Android, Apple's on iPhone), which needs the internet; the position is never sent to us or kept by us. You can turn location access off at any time in your phone's settings.
Recitations, radio stations and some data files are loaded over encrypted connections from the services that host them (such as islamic.network, mp3quran.net and GitHub); those services receive your IP address as with any download. The app uses Firebase Analytics with Google's automatic measurement only (app opens, screens and sessions, not linked to any account), Firebase Crashlytics for crash reports, and Firebase Cloud Messaging for occasional notifications. Muslim Life shows ATHRYZA Ads, as described above. Where we have no ad of our own for a place, it shows one small Google AdMob banner instead, only on the Today, Discover, prayer times and Account screens, never while you read or listen and never full-screen. These AdMob ads are always non-personalised, and where the law requires it Google's consent form (the User Messaging Platform) asks for your choice first. To show and measure ads and to prevent fraud, Google receives data such as your IP address, app or device identifiers and how ads are viewed or tapped, as Google's privacy policy describes. The app does not use the advertising ID (on Android it has no access to it) and does not ask for permission to track. It also sends ATHRYZA usage statistics, as described above. The records we hold are deleted automatically within 90 days.
Dates & Tasks (formerly Taskaty)
Dates & Tasks works without an account, and your tasks, lists and settings are stored on your device. If you choose to sign in with Google or Apple, through Google Firebase Authentication, we receive your name, email address and an account ID, and your tasks and lists are synced to Google Cloud Firestore so they appear on your other devices. Synced data is kept until you delete it or your account. Adding a task to your calendar writes it on your device only.
The AI assistant is optional. When you use it, what you ask, together with the task titles, list names and today's tasks it needs to answer, is sent to Google's Gemini models on Vertex AI through Firebase AI Logic, which return the answer. Without Pro, you get a few free AI uses once; they are counted on your device. If you speak to the assistant, your phone's own speech recognition turns your voice into text and only that text is sent; the app never uploads audio.
You can buy Dates & Tasks Pro, a subscription, or Remove Ads, a one-time purchase, through Google Play or the App Store; card details are handled only by Google or Apple. To unlock and restore what you bought, the app sends the store's purchase token or transaction, with your account ID, to ATHRYZA's server (our App Platform), which checks it with Google or Apple and stores your account ID, the store, the product, its status and dates, and the store's transaction ID or purchase token, not your name or email address. Purchases used to be managed for us by RevenueCat (RevenueCat, Inc.). Versions of the app before 1.5.0 still check purchase status with RevenueCat so that existing subscribers keep Pro; RevenueCat then receives your store purchase history and a random app user ID, not your name or email address, and no longer handles new purchases. Version 1.5.0 and later do not use RevenueCat. The app also uses Firebase Analytics (a fixed list of events, not linked to your account), Firebase Crashlytics (crash reports), Firebase Cloud Messaging (notifications), Firebase Remote Config (feature settings) and Firebase App Check (to block requests that do not come from the real app). It shows ads from Google AdMob. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised; on iPhone the app asks whether you allow tracking after you add your first task, and AdMob uses the advertising identifier only if you do. To show and measure ads and prevent fraud, Google receives data such as your IP address, device identifiers and how ads were viewed or tapped. Dates & Tasks also sends ATHRYZA usage statistics and can show ATHRYZA Ads, as described above. You can delete your account and synced data in the app or by email:
Smart Spend
Smart Spend works without an account, and your expenses, budgets and settings are stored on your device. If you choose to sign in with Google or Apple, through Google Firebase Authentication, we receive your name, email address and an account ID, and your expenses, categories, invoices and budgets are synced to Google Cloud Firestore. If you create or join a shared household, its name, your display name and the entries you add to it are shared with its members. If you turn on household alerts, your phone's notification token is stored with your account so that changes by other members can notify you. Synced data is kept until you delete it or your account.
Smart Spend offers two in-app purchases: Remove Ads, a one-time purchase, and AI Plus, a monthly or yearly subscription. You need to be signed in to buy. Payment is handled by Apple or Google, and we never see your card details. To unlock and restore what you bought, the app sends the store's purchase token or transaction, with your account ID, to ATHRYZA's server (our App Platform), which checks it with Apple or Google. We store your account ID, the store, the product, its status and dates, and the store's transaction ID or purchase token, never your name, email address or card.
The AI features are optional. They work only after you agree on the screen that explains them, and you can turn them off in Settings at any time. When you use one, the app sends only what that feature needs: for summaries, budgets and questions, totals calculated on your device for the period (income, expenses, totals per category, your top merchant names with their totals, the number of transactions and the currency), plus the question you type; for a category suggestion, the merchant or title you typed, the amount and your category names. Your list of transactions, notes, receipt photos, notification text, name and email address are never sent. This goes straight from the app to Google's Gemini model on Vertex AI, through Google Firebase AI Logic; Google processes it for us and does not use it to train its models. ATHRYZA's server never receives your AI requests or the answers. The only thing kept is a count of your AI requests, stored with your account in Google Cloud Firestore to apply your allowance: 3 free requests, once per account, or 150 a month with AI Plus. The count contains nothing you wrote, and it is kept after you delete your account so that the free requests cannot be claimed again. Firebase App Check confirms that requests come from the genuine Smart Spend app.
Receipt scanning reads the text of a receipt photo on your device, with Google ML Kit on Android and Apple Vision on iPhone; the photo is not uploaded. You can also paste the text of a bank message or payment confirmation into the app. On iPhone, you can share a payment confirmation, as text or a screenshot, from another app with Add to Smart Spend in the share sheet, or send one with the Add payment from text action in the Shortcuts app. Pasted and shared items are kept and read on your device, codes and card numbers are removed, and each payment waits in Review until you add it. Nothing is sent to us. If you switch off Accept shared receipts and Shortcuts, shared items are deleted without being read.
The payment notification reader is an optional Android feature. Only after you switch it on, choose which banking or wallet apps it may read and give it notification access in Android settings does it read the title and text of new notifications from those apps, and from no others. It keeps them on your device and turns them into draft expenses for you to review. Notification text is never sent to us or to anyone else; only the expenses you save are synced, and only while you are signed in. You can switch the reader off in the app, or remove its notification access in Android settings, at any time.
The app uses Firebase Analytics, Firebase Crashlytics (crash reports), Firebase Performance Monitoring (app speed), Firebase Cloud Messaging (notifications) and Firebase Remote Config (feature settings, such as switching the AI features on or off). It shows ads from Google AdMob. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised; on iPhone, AdMob uses the advertising identifier only if you allow tracking when iOS asks. To show and measure ads and prevent fraud, Google receives data such as your IP address, device identifiers and how ads were viewed or tapped. Smart Spend sends ATHRYZA usage statistics with the extra protections described above and can show ATHRYZA Ads. You can delete your account and its cloud data in the app or by email:
Crystal Crush
Crystal Crush is a match-3 jewel game for a general audience (rated 4+). It is not a children's app.
When the game starts it signs the device in anonymously with Google Firebase Authentication, which gives it a random anonymous account ID. You can also, if you want, sign in with Apple or Google; if you do, Firebase Authentication stores your user ID and the email address that provider shares. Nobody has to do this to play. Your game progress is saved in Google Cloud Firestore under your account ID, so it can follow you to a new phone.
The weekly leaderboard runs on our own servers at athryza.com. For it we store your display name, your country, your level scores and the move log we use to verify a score.
The game shows ads from Google AdMob. On iPhone, ads are personalised only after you allow tracking in the App Tracking Transparency prompt, and then Google uses your device's advertising ID. To show and measure ads and prevent fraud, Google receives technical data such as your IP address, device and app details and how an ad was viewed or tapped, as its own privacy policy describes.
Push notifications use Firebase Cloud Messaging and are asked for in the game first; if you agree, an FCM token is stored for them.
The game also sends anonymous app telemetry (ATHRYZA usage statistics) to our own platform: gameplay events, the app version, the device model and crash or error context. It reads its settings from Firebase Remote Config.
To delete your account and the data linked to it, open Settings, then Account, then Delete account in the game, or use the deletion page below. You can also ask us at [email protected].
Busy Bay (our 3D car jam puzzle game)
Busy Bay is a 3D puzzle game. You can play it without an account: the game signs you in anonymously in the background with Google Firebase Authentication, which gives your device an anonymous account ID. If you choose to sign in with Google or Apple, we receive the name and email address that provider shares with us, and your progress follows you to a new phone. We store your game progress and settings (levels reached, scores, boosters and preferences) in Google Cloud Firestore so they can be restored, and we keep a copy on your device so the game works offline.
The leaderboards are run on our own servers. For them we store your display name, your country (taken from the network, never from GPS) and your scores and level results, and other players can see your display name, country and score. If you allow notifications, Google Firebase Cloud Messaging gives your phone a notification token, which is stored so we can send them; you can turn notifications off in the game or in your phone's settings.
The game sends ATHRYZA usage statistics, as described above: which screens are opened, how levels are played and the app version, device type, operating system version and language. They carry a random number created on your device and never your advertising ID or precise location, and never your name or email address. Busy Bay shows ATHRYZA Ads and ads from Google AdMob. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised; on iPhone the game asks whether you allow tracking, and AdMob uses the advertising identifier only if you do. To show and measure ads and prevent fraud, Google receives data such as your IP address (from which it estimates an approximate location), device identifiers and how ads were viewed or tapped.
Busy Bay is not directed at children under 13. Your account data and game progress are kept until you delete them. To delete your account and the data linked to it, or to ask what we hold about you, email [email protected] from the address you signed in with, or tell us your anonymous account ID if you did not sign in; we will confirm once it is done. Uninstalling the game removes only the copy on your device.
Torqle (our 3D screw sort puzzle game)
Torqle is a 3D screw sort puzzle game. You can play it without an account: the game signs you in anonymously in the background with Google Firebase Authentication, which gives your device an anonymous account ID. If you choose to sign in with Google or Apple, we receive the name and email address that provider shares with us, and your progress follows you to a new phone. We store your game progress and settings (levels reached, scores, boosters and preferences) in Google Cloud Firestore so they can be restored, and we keep a copy on your device so the game works offline.
The leaderboards are run on our own servers at athryza.com. For them we store your player name, your country (taken from the network, never from GPS) and your scores and level results, and other players can see your player name, country and score.
The game sends ATHRYZA usage statistics and crash reports to our own server at athryza.com, as described above: which screens are opened, how levels are played, errors and crashes, and the app version, device type, operating system version and language. They carry a random number created on your device and never your advertising ID or precise location, and never your name or email address. Torqle shows ads from Google AdMob. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised; on iPhone the game asks whether you allow tracking, and AdMob uses the advertising identifier only if you do. To show and measure ads and prevent fraud, Google receives data such as your IP address (from which it estimates an approximate location), device identifiers, your advertising ID where you allow it, and how ads were viewed or tapped.
Torqle is not directed at children under 13. Your account data and game progress are kept until you delete them. To delete your account and the data linked to it, use Settings, then Account, then Delete account in the game, or use the deletion page below; or to ask what we hold about you, email [email protected] from the address you signed in with, or tell us your anonymous account ID if you did not sign in; we will confirm once it is done. Uninstalling the game removes only the copy on your device.
Shilla (formerly BoardVerse, our online table games)
Shilla (formerly BoardVerse; same app, same accounts, rebuilt in 3D) is our app for playing 16 board and card games at a 3D table online with other people, so it needs an account. The app creates a guest account for you automatically, and you can sign in with Google or Apple. We store your username, your email address (for accounts that are not guests), the avatar photo and bio you add, your language, and your game records: match results and history, statistics, rating, friends, achievements and notifications. To allow one guest account per device, we store a scrambled (salted hash) form of the device's identifier, never the identifier itself. A guest account that is not used for 30 days is deleted automatically, after reminders 7 days and 1 day before. Sign-in is handled by Google Firebase Authentication, and your game progress and settings are also saved in Google Cloud Firestore under your account ID so they follow you to a new phone; everything else is stored on our own servers, in a database on a server we rent from OVHcloud in Beauharnois, Canada, and every connection to them is encrypted.
Games are played in real time, so your moves and what happens in a room pass through our servers and are shown to the other players. In-game chat is free text that the players in the room can read; every message is filtered automatically before it is stored or delivered, and chat from a finished game is deleted after 90 days. We also count chat messages in bulk, by topic, with no usernames or account IDs attached, to find what players most often struggle with; we never read individual conversations for that purpose. You can report or block another player; reports are kept for 12 months after they are resolved. If you contact support, report a bug or send a suggestion, we keep what you wrote with your app version, platform, operating system version and device model, for 12 months after the conversation is closed. When the app hits an error it sends a report to our own servers: the error and where in the code it happened, the app version, platform, operating system version and device model (the model only, such as iPhone 14, never the name you gave your device), and your account ID if you are signed in. Error reports are deleted after 30 days. Your phone's notification token is stored so we can tell you when it is your turn or a friend request arrives; you can turn notifications off in the app's settings or your phone's settings.
A room can have live voice chat between the players seated in it. Your microphone is off until you turn it on, and the app asks your phone for microphone permission only the first time you do; the app uses the microphone only while you are in a room with voice on. If you refuse, the game works exactly the same without it. Voice is relayed in real time by our own LiveKit server, hosted on the same server in Canada, and it is never recorded and never stored: we keep no audio and no transcript. You can mute your microphone or the speaker, mute one player on your device, or block a player so you no longer hear them. If you report a player for voice abuse, we keep who reported, who was reported, the room and the time, with no audio, for 12 months after the report is resolved; a player reported by several different people may be reviewed and removed.
Firebase Cloud Messaging delivers notifications. Shilla shows ads from Google AdMob, only between matches and never on the table. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised, and you can change it later under Privacy choices in the app's settings; on iPhone, AdMob uses the advertising identifier only if you allow tracking. To show and measure ads and prevent fraud, Google receives data such as your IP address, device identifiers and how ads were viewed or tapped. Shilla also sends ATHRYZA usage statistics and can show ATHRYZA Ads, as described above. There are no in-app purchases, and points, ranks and achievements have no cash value.
Your account data is kept until you delete your account. Match results and leaderboard positions are kept as the record of the game, finished game rooms for 12 months, answered friend requests for 90 days, and database backups for about 30 days. Shilla is not directed at children under 13, and you must be 13 or older to play; if you believe a child has made an account, tell us and we will delete it. You can delete your account in the app at any time or ask us by email; the page below sets out what is deleted and what is kept:
Puzzly (formerly Brain Land, our puzzle game for children)
Puzzly (formerly Brain Land) is a jigsaw and puzzle game for children, aimed at ages 4 to 8. It never asks for a name, an email address or any other personal information. When the game starts it signs the device in anonymously with Google Firebase Authentication, which gives it a random anonymous account ID. We use that ID to save progress in the cloud and to run the weekly leaderboard.
A grown-up can, if they want, link a Google or Apple sign-in. This is only possible behind the grown-up check in Settings. If they do, Firebase Authentication stores the email address that provider shares, so progress follows the child to a new phone. Nobody has to do this to play.
Progress, stars, stickers and settings are saved in Google Cloud Firestore under the anonymous account ID, and a copy is kept on the device so the game works offline. Nothing a child creates or types is sent.
The weekly leaderboard runs on our own servers at athryza.com. For it we store a nickname the game generates for the child (the child never types one), the country the request came from (taken from the network, never from GPS) and the scores. Other players see only the generated nickname, the country and the score.
While it is open, the game sends us anonymous play statistics: which screens and puzzles were opened, whether a puzzle was solved and whether a hint was used, where on the screen taps landed (as positions, never pictures), the app version, device size, operating system version, language and network type. These statistics carry no install ID and no lasting identifier, only a random session number that is new every time the game is opened, so we cannot follow a child from one play session to the next or over time. Their times are rounded to the hour, the detailed records are deleted after 7 days, and nothing is recorded in the grown-ups area.
The game shows small, clearly labelled ads suitable for children, never at launch and never during play. ATHRYZA cards (see ATHRYZA Ads above) are contextual only. On iOS the game shows only ATHRYZA cards for our own apps, or nothing, and has no third-party advertising SDK. On Android it can also show Google AdMob ads, which are marked as directed to children, limited to ads rated for general audiences and non-personalised. To show ads, count them and prevent fraud, Google receives technical data such as the IP address, device and app details and how an ad was viewed or tapped, as its own privacy policy describes. The game does not use the advertising ID, does not track children across apps or websites and does not ask for permission to track. It asks for no permissions such as camera, microphone, location or contacts. Settings, every link out of the game and every link in an ATHRYZA card sit behind a grown-up check; on Android, a tap on a Google ad is handled by Google.
Push notifications are sent only if a grown-up turns them on in Settings, and then only a notification token is stored for them.
To delete the account and the data linked to it, a grown-up opens Settings, then Account, then Delete account in the game, or uses the deletion page below. Either way the anonymous account, the cloud save and the leaderboard entries are removed. You can also ask us at [email protected]. Deleting the game from the phone removes only the copy on the device.
Tiko Bot (our programming game for children)
Tiko Bot is a 3D coding game for children. It never asks for a name, an email address or any other personal information. When the game starts it signs the device in anonymously with Google Firebase Authentication (Firebase project athryza-tikobot), which gives it a random anonymous account ID. We use that ID to save progress in the cloud and to run the weekly leaderboard.
A grown-up can, if they want, link a Google or Apple sign-in. This is only possible behind the grown-up check in Settings. If they do, Firebase Authentication stores the email address that provider shares, so progress follows the child to a new phone. Nobody has to do this to play.
Progress, stars, coins, looks and settings are saved in Google Cloud Firestore under the anonymous account ID, and a copy is kept on the device so the game works offline. The programs a child builds are not sent.
The weekly leaderboard runs on our own servers at athryza.com. For it we store a nickname the game generates for the child (the child never types one), the country the request came from (taken from the network, never from GPS) and the scores. Other players see only the generated nickname, the country and the score.
While it is open, the game sends us anonymous play statistics: which screens and levels were opened, whether a level was solved and whether a hint was used, where on the screen taps landed (as positions, never pictures), the app version, device size, operating system version, language and network type. These statistics carry no install ID and no lasting identifier, only a random session number that is new every time the game is opened, so we cannot follow a child from one play session to the next or over time. Their times are rounded to the hour, the detailed records are deleted after 7 days, and nothing is recorded in the grown-ups area.
The game shows small, clearly labelled ads suitable for children, never at launch and never during play. ATHRYZA cards (see ATHRYZA Ads above) are contextual only. On iOS the game shows only ATHRYZA cards for our own apps, or nothing, and has no third-party advertising SDK. On Android it can also show Google AdMob ads, which are marked as directed to children, limited to ads rated for general audiences and non-personalised. To show ads, count them and prevent fraud, Google receives technical data such as the IP address, device and app details and how an ad was viewed or tapped, as its own privacy policy describes. The game does not use the advertising ID, does not track children across apps or websites and does not ask for permission to track. It asks for no permissions such as camera, microphone, location or contacts. Settings, every link out of the game and every link in an ATHRYZA card sit behind a grown-up check; on Android, a tap on a Google ad is handled by Google.
Push notifications are sent only if a grown-up turns them on in Settings, and then only a notification token is stored for them.
To delete the account and the data linked to it, a grown-up opens Settings, then Account, then Delete account in the game, or uses the deletion page below. Either way the anonymous account, the cloud save and the leaderboard entries are removed. You can also ask us at [email protected]. Deleting the game from the phone removes only the copy on the device.
Rakkeb (our 3D car building and driving game)
Rakkeb is a 3D car building and driving game. You can play it without an account: the game signs you in anonymously in the background with Google Firebase Authentication, which gives your device an anonymous account ID. If you choose to sign in with Google or Apple, we receive the name and email address that provider shares with us, and your progress follows you to a new phone. We store your game progress and settings (levels reached, stars, coins, scores, boosters and preferences) in Google Cloud Firestore so they can be restored, and we keep a copy on your device so the game works offline.
The leaderboards are run on our own servers at athryza.com. For them we store your player name, your country (taken from the network, never from GPS) and your scores and level results, and other players can see your player name, country and score.
The game sends ATHRYZA usage statistics and crash reports to our own server at athryza.com, as described above: which screens are opened, how levels are played, errors and crashes, and the app version, device type, operating system version and language. They carry a random number created on your device and never your advertising ID or precise location, and never your name or email address. Rakkeb shows ads from Google AdMob. Where the law requires it, Google's consent form (the User Messaging Platform) asks for your choice before ads are personalised; on iPhone the game asks whether you allow tracking, and AdMob uses the advertising identifier only if you do. To show and measure ads and prevent fraud, Google receives data such as your IP address (from which it estimates an approximate location), device identifiers, your advertising ID where you allow it, and how ads were viewed or tapped.
Rakkeb is not directed at children under 13. Your account data and game progress are kept until you delete them. To delete your account and the data linked to it, use Settings, then Account, then Delete account in the game, or use the deletion page below; or to ask what we hold about you, email [email protected] from the address you signed in with, or tell us your anonymous account ID if you did not sign in; we will confirm once it is done. Uninstalling the game removes only the copy on your device.
Nizamna (our business management system)
Nizamna is used by businesses to run their work: sales, stock, repairs, bookings and the other records they choose to keep. The business decides what to record about its own customers, staff and suppliers, and it owns that data; we store and process it on the business’s behalf to provide the service. Each business’s records are kept apart from every other business’s in the database itself. Staff sign in with a password, and owners and staff who can change roles, billing or exports must use two-step verification. Our support team cannot see a business’s data unless the business approves a request, for at most 72 hours, and every approval and action is logged. A business can export all its data and close its account; 30 days after closing, its records and stored files are deleted. When a business signs up from a link that carries a campaign tag, we keep that tag (the platform, campaign and post) with the business account to learn which posts work, and we count visits to the Nizamna site and sign-up page per day and per tag only, with no cookies, no personal data, and nothing that follows a visitor to other sites. The one exception is the partner programme: when a visitor arrives through a referral partner’s link, we set one first-party cookie, nz_ref, holding the partner’s public code, so that the sign-up is credited to the partner who shared the link. It lasts 60 days, is set only when a visitor arrives through a partner link, and can be deleted in the browser. The partner programme processes the partner’s name, email, phone and payout details (the payout details are stored sealed); we share no customer personal data with partners. Referrals and wallet credit: if you invite another business, the nz_ref cookie and the sign-up form can also carry a customer referral code, not only a partner code. The business that invited you sees only an anonymous number and a status for each business it invited, never names or contact details, and there is no limit on how many businesses you can invite. To prevent abuse we keep a hashed (not readable) form of the network address used at sign-up, for fraud review. Wallet credit records (grants, uses, expiry) are kept as financial records and contain no personal data beyond the business account they belong to. Payments to us for the subscription are recorded by our team; we do not store card numbers. Voice dictation (optional): a business that has turned on Nizamna’s AI features and agreed to them can let its doctors dictate a clinic visit. The microphone is used only when the doctor taps the microphone button, and only for dictation of up to 120 seconds. The recording is sent over an encrypted connection to our server, which passes it to Google’s Gemini service only to turn the speech into text and to fill in the visit fields. We do not store the recording: it is held in memory just long enough to be transcribed and is then discarded, and Google processes it on our behalf. The text comes back as a draft that the doctor reviews and must confirm, and only the confirmed text is saved. We keep a count of the seconds and requests used, without the content. Dictation is not used for advertising or tracking, and Nizamna works fully without it. Questions and requests: [email protected].
Sharing, legal requests and changes
We never sell personal data. Apart from the service providers named in this policy, which process data for us or as each section describes, we share personal data only when the law requires it, for example in answer to a valid request from a court or public authority, or when it is needed to protect the safety of our users, the public or ATHRYZA, or to investigate fraud or abuse. If ATHRYZA were involved in a merger, acquisition or sale of assets, data could be transferred as part of it, and we would tell you before it became subject to a different policy. Our providers may process data in countries other than yours, including Canada, the European Union and the United States, under their own published terms. We protect data with encrypted connections and limited access, but no way of sending or storing data is completely secure. Apart from our children's games, described above, our apps are not directed at children under 13 and we do not knowingly collect personal data from them; if you believe a child has given us personal data, contact us and we will delete it. Our apps and this site link to other websites and services, whose own privacy policies apply. When we change this policy we update this page and the date at the top; for significant changes we will also tell you in the affected app, or by email where we have your address, before they take effect.
Privacy questions
Send any privacy question or request to the email address or WhatsApp number at the bottom of every page. We reply within one business day.
- Email: [email protected]
- WhatsApp: +20 155 840 0064 (opens in a new tab)