Privacy

• Your practice is kept on your own device by default.
• Nothing leaves your device unless you create an account.
• Your private writing syncs only if you turn it on.
• There are no adverts, no analytics and no tracking cookies.
• Your information is never sold.

Everything you do in the app is saved in your browser’s own storage: dhikr counts, reflections, the trigger log, If–Then plans, your pathway, dated notes, family ties, your prayer-time location, and settings such as theme and text size.

Without an account, none of this is sent to us. Clearing your browser’s site data deletes it permanently, so we cannot recover it for you.

Accounts are provided by Supabase, our database and sign-in provider, with data stored in Europe. We keep your email address and a securely hashed password. We never see your password itself.

If you continue with Google, Google shares your name, email address and profile picture with the sign-in provider. The app uses your email address to identify your account. We receive nothing else from your Google account.

Automatically, while you are signed in:

• your profile: display name, time zone, focuses, pace, and the struggles you chose
• bookmarks and follow-later items
• progress and settings: today’s focus and completions, learned cards, your chosen guide, your practice rhythm, nafs stage and protection techniques
• one summary of counts per day, with no journal text in it

Only if you switch it on under Account → Privacy & sync:

• evening reflections
• the trigger log
• If–Then defence plans
• pathway accounts
• dated notes

Back up is different. When you press it, a copy of everything the app has stored in this browser is saved to your account, including private writing, whatever your sync settings. It exists so you can restore your practice on a new device. Only press it if you are happy for all of it to be stored.

Access rules in the database let each account read and change only its own data. Other users cannot see anything of yours.

Your data is encrypted in transit and at rest by our providers, but it is not end-to-end encrypted. The person who runs this site could technically access the database. We only do so when needed to keep the service running or when you ask for help.

• Cloudflare hosts the site. Like any web host, it handles your IP address and standard request details in order to deliver pages.
• Supabase stores accounts and synced data, as described above.
• Google is involved only if you choose to continue with Google.
• Aladhan (api.aladhan.com) calculates prayer times for places outside the built-in UK and Switzerland timetables. In that case the city you enter, or your approximate coordinates if you use your location, is sent to it. Your location is otherwise stored only on your device.
• Links to sources such as al-islam.org, and the Add to calendar button, take you to other sites that have their own privacy policies.

• Use the app without an account. Nothing is sent to us.
• Turn private-writing sync on or off at any time under Account → Privacy & sync.
• Sign out, or clear your browser’s site data to remove everything from a device.
• Ask for a copy of your data, or for your account and everything in it to be deleted, by emailing navid.bkk@gmail.com. Self-service account deletion is not available yet.

Accounts are not intended for children under 13. If you are under 13, please use the app without an account.

If this policy changes, the date below will change with it. For any question about your data, email navid.bkk@gmail.com.

Last updated 11 September 2026.