Privacy Policy

1Quick summary

2Information we collect

2.1 Account information

• Email address — your sign-in identifier and for account recovery.
• Display name — to personalise the app.
• If you sign in with Apple or Google, we receive a basic identifier and (if you allow it) your name and email.

2.2 Content you create in the app

Stored on your device, and synced to our cloud only for hybrid (multi-device / family) features:

• Prayer logs, habit and sunnah streaks, dhikr counts and sessions
• Quran bookmarks, reflections and memorisation progress
• Sacred Journey / travel plans, Ilm Quest and Knowledge Check progress
• Journals, reflections and reminders you write
• Friends & Family entries you set up — the people in your household and the details you choose to add about them

Qafilah Kids entries are the exception, and they are not in the list above. A child's profile, progress, rewards, journal, goals, prayer log and any parent-recorded audio stay on the device. They are not synced to our cloud, not included in cloud backup, and not readable by any AI feature in the app.

2.3 Device & technical information

• An anonymous device identifier used to deliver push notifications
• App preferences (theme, language, locale) and time zone (for accurate prayer times)
• Crash reports and performance diagnostics, such as your device model, app version, what the app was doing when a problem occurred, and how long first-time setup took. These are sent from every install and are not linked to your account: identifiers such as your email address and account ID are removed before sending.

2.4 Location (only with your permission)

Used to calculate prayer times and determine Qibla direction. We request only "While Using the App" access. The calculations run on your device, and your coordinates and place label (for example "London, UK") are kept on your device — they are not saved to your account or sent to our servers. To show the name of your place, your phone's own map service (Apple on iPhone, Google on Android) is asked for it using your coordinates. We do not share your location with advertisers. If you decline, or prefer to set your location manually, you can search for a city instead — the search text goes to your phone's map service or, if that is not available, to OpenStreetMap's Nominatim service. If you plan a Hajj or ʿUmrah trip in the app and then ask Deen Assist a question, the city you are in for that trip (Makkah or Madinah only) is sent with your question so the answer fits where you are.

2.5 Subscription & purchase information

If you buy a subscription, Apple or Google processes the payment and we receive your subscription status and a purchase identifier (via our subscription provider) to unlock features. See Section 7.

2.6 Photos, audio & other optional inputs

• Photos — only a profile photo you choose to add. It is uploaded to our cloud storage and shown on your profile; anyone who has its link can open it.
• Microphone / audio — in two places, and only when you use them:
  • Qafilah Kids: a parent can record a short voice clip. It is stored on the device only and is not uploaded to us.
  • Deen Assist: if you ask by speaking, your phone's speech service (Apple or Google) turns your voice into text — on your phone when it can, otherwise on their servers. We receive only the text, which is then handled like a typed question (see Section 4).
• Face ID / fingerprint — used to unlock Sister Sanctuary and to let a grown-up reset the Qafilah Kids PIN. Your phone checks it; Qafilah only learns whether it matched and never receives your face or fingerprint data.

2.7 What we do NOT collect

• Your contacts, calendar, or files
• Your browsing history outside the app
• Your religion as a stored profile attribute (even though the app is Islamic)
• Any data used to track you across other apps or websites for advertising

3How we use your information

• To run the app — sign you in, show prayer times and Qibla, save your activity, send reminders you opt into, and sync hybrid features across your devices.
• To manage subscriptions — unlock and maintain paid features you purchase.
• To answer you — respond to support requests you send us.
• To improve the app — using anonymous, aggregated usage and crash diagnostics that are not linked to your account.

4AI features (Noor)

Some features — such as our companion Noor and other AI-assisted help — use artificial intelligence to generate responses. When you use these features:

• The text you submit is sent to a third-party AI provider (currently OpenAI) to generate a reply, over an encrypted connection. If you ask by speaking, your phone's speech service turns your voice into text first; only the text is sent to the AI provider.
• We instruct our providers not to use your inputs to train their models, and we do not use them to train models either.
• AI responses are generated by software and may be incomplete or imperfect. They are for general guidance only and are not a fatwa or a substitute for a qualified scholar. See our Terms.
• The Deen Buddy inside Qafilah Kids is not generative AI — it is a fixed set of scholar-reviewed answers, and a child's questions are not sent to any AI provider.

5Children's privacy & Qafilah Kids

Qafilah includes Qafilah Kids, an experience for children and teenagers, organised into four age bands: Sprout (2–6), Cubs (7–10), Compass (11–14) and Voyage (15–18). It is designed to be set up and managed by a parent or guardian, and we take children's privacy seriously. Before a child profile can be created, a signed-in adult must agree on a separate consent screen, and that agreement is recorded together with the version of the text they saw. That record is kept on the device, not on our servers, and withdrawing it deletes the child's data.

• We do not knowingly collect personal information from children online. A child's activity (progress, rewards, avatar) is stored on the device under the parent's control.
• Child avatars are chosen from a preset library — children do not upload their own photos.
• The Deen Buddy is a fixed, scholar-reviewed question-and-answer set — no free-text AI, and nothing a child taps is sent to an AI provider.
• Any parent-recorded audio and family "moments" are created at the parent's initiative, protected behind a parent PIN where applicable, and stored on the device.
• We do not show behavioural or targeted advertising to children, and we do not build advertising profiles of children.

Friends & Family is different, and we say so here because the two share a consent screen. When you add someone to your household — including a child — what you type about them is sent to our cloud, so your household matches across your devices. That can include their first name, your relationship to them, their gender, an age band, free-text notes, and for a teenager or an adult an email address and a phone number. It does not stay on the device alone. If you would rather nothing about a family member left your phone, do not add them to Friends & Family.

Teenagers (13–17). A teenager added to a household is currently handled the same way as an adult: the details above are saved, and they are invited to link their own Qafilah account. Several countries treat everyone under 18 as a child for these purposes, and we are changing this. Until we do, please add a teenager only with their knowledge.

Diagnostics. Crash and performance reports are processed on our behalf by Sentry. They carry no child data and are not linked to your account.

If you are a parent or guardian and believe a child has provided us personal information, or you want to review or delete it, please contact us and we will act promptly.

6Sister Sanctuary & sensitive data

Sister Sanctuary is a private space for women that may include optional menstrual-cycle awareness to adjust worship guidance (for example, prayer and fasting reminders).

Because this data is not collected or transmitted by us, it is not part of any cloud sync or backup we operate. You can delete it at any time within the app, and it is removed if you delete the app from your device.

US state consumer-health-data laws. Because this information never reaches us, we do not “collect” it within the meaning of the Washington My Health My Data Act, Nevada SB 370 or comparable laws. The disclosure those laws require is published separately, as they require: Consumer Health Data Privacy Policy.

EU / UK. Health data is a special category under GDPR and UK GDPR Article 9. Those obligations attach to a controller that processes the data; we process none of it, because it stays on your device and we never receive it. Storing it there is covered by the “strictly necessary for the service the subscriber has explicitly requested” basis in Article 5(3) of the ePrivacy Directive — the section is off until you turn it on, and its only purpose is the feature you turned on.

7Subscriptions & payments

Qafilah offers optional paid subscriptions (for example, Plus, Kids, and Family). Core worship features are always free.

• All payments are processed by the Apple App Store or Google Play under their own terms and privacy policies. We never receive or store your card or bank details.
• We use a subscription-management provider (RevenueCat) to confirm your purchase and unlock features. It receives a purchase token and an app user identifier — not your payment details.
• Manage, cancel, or view your subscription in your Apple or Google account settings. See the billing terms in our Terms of Service.

8Advertising

Qafilah offers an ad-supported free tier. Where ads are shown:

• They are shown only to signed-in adult users on the free tier, and served by a third-party ad network (currently Google AdMob), which may receive a device advertising identifier and ad-context information.
• We do not show ads to children, and we do not show ads inside sensitive surfaces such as Sister Sanctuary.
• We do not track you across other apps or websites for advertising, and we do not show Apple's App Tracking Transparency prompt because we do not track in that sense.
• Paid subscribers do not see ads.

9How we share information

We do not sell your personal information. We share information only with service providers who process it on our behalf, and only as needed:

• Supabase — secure cloud hosting for account info and hybrid-feature data.
• RevenueCat — subscription status and entitlements (no payment details).
• OpenAI (and any future AI providers we name here) — processes text you send to AI features.
• Sentry — crash reports and app diagnostics, which are not linked to your account.
• Google AdMob — if ads are shown to you (free tier only).
• Apple and Google (map and speech services on your phone) — to show your place name from your coordinates, to look up a city you search for, and to turn a spoken Deen Assist question into text. These are services of your phone's operating system.
• OpenStreetMap (Nominatim) — only if your phone's map service cannot look up a city you search for; the search text is sent to their public service.
• Expo / push services (Apple & Google) — to deliver notifications you opt into.
• Every.org — if you choose to make a charitable donation, you complete it on their site under their terms.
• News publishers — when you open in-app news feeds, the publisher can see your device's IP address, as with any web request.

We may also disclose information if required by law (and will challenge overbroad requests), and we may share aggregated, non-identifying statistics.

10Storage, retention & security

• On your device: most of your activity lives in a local database and never leaves the device unless a hybrid feature needs it.
• In our cloud: account info and hybrid-feature data are stored with Supabase. Data in transit is encrypted with HTTPS/TLS, and data at rest is encrypted (AES-256).
• Retention: we keep your account and synced data while your account is active. If you delete your account, we delete it and associated cloud data (see Section 12). Local data is removed when you delete the app.

No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

11Your rights & choices

• Access & portability — you can view your data in the app; contact us to request a copy.
• Correction — edit your profile and activity directly in the app.
• Deletion — delete individual items anytime, or your whole account (see Section 12).
• Notifications & location — turn these on or off anytime in your device settings or in the app.

If you are in the EEA or UK (GDPR): you have rights to access, correct, delete, restrict, port, and object to processing of your personal data, and to withdraw consent. Our lawful bases are performance of our contract with you, your consent, and our legitimate interests in operating and improving the app.

If you are in California (CCPA/CPRA): you have rights to know, access, correct, delete, and to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined. We do not discriminate against you for exercising your rights.

To exercise any right, contact us. We aim to respond within 30 days.

12Account & data deletion

You can request deletion of your account and associated personal data at any time:

• In the app — open your Profile and choose Delete account. This deletes immediately; you do not need to wait for us.
• By email — write to contact@getqafilah.com from your account email, and we will process your request within 30 days.

Deleting your account removes your account information and cloud-synced data. Data stored only on your device is removed when you delete the app. Some records may be retained where required by law (for example, tax or fraud-prevention records held by the app stores).

13International users & data transfers

Qafilah is operated from the United States, and your information may be processed in the U.S. and other countries where our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers. By using the app, you understand your information may be processed in these locations.

14Do Not Track / Global Privacy Control

Because we do not track you across other websites or apps, there is no cross-site tracking to disable. Our website honours a Global Privacy Control (GPC) signal where applicable.

15Changes to this policy

We may update this policy as the app evolves. When we make material changes we will update the "Last updated" date, and for significant changes we will show an in-app notice and, where required, ask for renewed consent before continuing to use affected features.

16Contact us

For any privacy question or request:

• Email: contact@getqafilah.com
• Company: Qafilah Inc., Delaware, USA

We aim to respond to privacy requests within 30 days.