Deendar — prayer times, Quran and hadith for daily practice
A complete Islamic companion for daily practice — the Quran, hadith, duas, prayer times and Qibla direction in one free app with no ads, no subscription and nothing locked. Prayer times are calculated for the user's exact location anywhere in the world across 23 calculation methods, with Asr set to the Hanafi or Standard method, and a manual city search for anyone who would rather not share their location at all; the week ahead is stored on the device, so adhan reminders still arrive with no signal. It carries all 114 surahs and 6,236 verses with Bengali and English translation, three Arabic scripts and verse-by-verse recitation; 16,453 hadiths across 29 collections including Sahih al-Bukhari and Sahih Muslim, browsable by chapter and fully searchable; everyday duas with transliteration and meaning; a live Qibla compass; sehri and iftar times for Ramadan; and a deeds tracker for the daily acts a user wants to keep up. Every screen is available in both Bengali and English. The app is built in Flutter with Riverpod and go_router over a Next.js and Supabase backend on Vercel, with Texion Auth for optional sign-in and Firebase for messaging and crash reporting — and everything in it is readable without an account at all. The project also covers the product's web surface: a single-page marketing site built from the app's own dot-pattern motif and two-tone wordmark, alongside the privacy policy and the account deletion flow Google Play requires, all shipping from the same Next.js deployment as the API.
A tour of the build.
Swipe or click through the screens.
One codebase has to ship as two different products, and only one of them may go near Google Play.
One codebase has to ship as two different products, and only one of them may go near Google Play. The Bangladesh build sells bundles through carrier billing, which violates Play's Payments policy outright — an enforcement action against it would take the global listing down with it — so the two flavors have to diverge in distribution, sign-in, paywall and Android permissions while staying a single repo. Underneath that sat a build system that could not be trusted: flutter clean silently failed to delete the build directory on this checkout, so Gradle considered its outputs current and repackaged the previous Dart snapshot while reporting success. A release was signed and uploaded carrying code that did not match the commit it claimed to be, and the two differing snapshots were byte-for-byte the same size. And a Play submission is more than a binary — it needs a Data Safety declaration that matches the privacy policy exactly, a deletion route a user can complete on the web without installing the app, and honest content counts, because a discrepancy between any two of them is itself a rejection reason.
What we did
The flavor is selected twice, once by Gradle and once by a dart-define, and the app throws on startup when the define is missing, so a mismatched build fails immediately instead of shipping a Play-signed bundle that behaves like the Bangladesh one. The global manifest is the Play-safe baseline, and a verification script parses the merged manifest rather than grepping it — grep matches the explanatory comments inside those files and reports permissions as present when they are only being discussed — to assert that no Play-restricted permission survives into the global build while Bangladesh keeps everything it shipped with. Release builds are now verified by extracting the compiled snapshot from the bundle and searching it for a string added just before the build, with the trap written into the runbook that a single non-ASCII character turns the whole literal UTF-16 and makes a plain search report a fresh build as stale. Sign-in moved to Texion Auth through the system browser, which removed the SHA-1 fingerprint registration and with it the classic trap where Google sign-in works under a debug run and fails for every real user once Play re-signs the app; the backend checks that a token's audience equals its own client id, because Texion Auth is multi-tenant and without that check a token issued for any other application would be accepted.
What changed after
Live at deendar.texion.tech, carrying the marketing page, the privacy policy and the account deletion flow, with the global build in internal testing on Play ahead of the public release. The app is free with no ads and no paywall, everything is readable without an account, and sign-in exists only so favourites and the deeds tracker follow a user between devices. The Data Safety answers were derived from what the code actually does rather than from a template — including declaring precise location, because the app asks for roughly 100-metre accuracy and holds the fine-location permission, and answering "approximate only" while holding it is a mismatch Play checks for. The store copy was written against verified row counts for the same reason: the dua collection is deliberately mentioned without a number, because claiming more than ships is both dishonest and a support-ticket generator.