Privacy Policy

1Quick summary

2Information we collect

2.1 Account information

• Email address — your sign-in identifier and for account recovery.
• Display name — to personalise the app.
• If you sign in with Apple or Google, we receive a basic identifier and (if you allow it) your name and email.

2.2 Content you create in the app

Stored on your device, and synced to our cloud only for hybrid (multi-device / family) features:

• Prayer logs, habit and sunnah streaks, dhikr counts and sessions
• Quran bookmarks, reflections and memorisation progress
• Sacred Journey / travel plans, Ilm Quest and Knowledge Check progress
• Journals, reflections and reminders you write
• Family and Qafilah Kids entries (profiles, activity, rewards) you set up

2.3 Device & technical information

• An anonymous device identifier used to deliver push notifications
• App preferences (theme, language, locale) and time zone (for accurate prayer times)
• Crash and performance diagnostics — only if you opt in

2.4 Location (only with your permission)

Used to calculate prayer times, determine Qibla direction, and show nearby Islamic events. We request only "While Using the App" access. The calculations run on your device. Your coordinates and a place label (for example "New York, USA") are saved with your account so your prayer settings and Qibla history are available on your other devices. We do not share your location with advertisers. If you decline, or if you prefer to set your location manually, you can search for a city instead — that search text is sent to OpenStreetMap's Nominatim service to look up its coordinates.

2.5 Subscription & purchase information

If you buy a subscription, Apple or Google processes the payment and we receive your subscription status and a purchase identifier (via our subscription provider) to unlock features. See Section 7.

2.6 Photos, audio & other optional inputs

• Photos — only a profile photo you choose to add.
• Microphone / audio — only if a parent chooses to record a short voice clip in Qafilah Kids. These recordings are stored on the device only and are not uploaded to us.

2.7 What we do NOT collect

• Your contacts, calendar, or files
• Your browsing history outside the app
• Your religion as a stored profile attribute (even though the app is Islamic)
• Any data used to track you across other apps or websites for advertising

3How we use your information

• To run the app — sign you in, show prayer times and Qibla, save your activity, send reminders you opt into, and sync hybrid features across your devices.
• To manage subscriptions — unlock and maintain paid features you purchase.
• To answer you — respond to support requests you send us.
• To improve the app — using anonymous, aggregated usage and (if you opt in) crash diagnostics.

4AI features (Noor)

Some features — such as our companion Noor and other AI-assisted help — use artificial intelligence to generate responses. When you use these features:

• The text you submit is sent to a third-party AI provider (currently OpenAI) to generate a reply, over an encrypted connection.
• We instruct our providers not to use your inputs to train their models, and we do not use them to train models either.
• AI responses are generated by software and may be incomplete or imperfect. They are for general guidance only and are not a fatwa or a substitute for a qualified scholar. See our Terms.
• The Deen Buddy inside Qafilah Kids is not generative AI — it is a fixed set of scholar-reviewed answers, and a child's questions are not sent to any AI provider.

5Children's privacy & Qafilah Kids

Qafilah includes Qafilah Kids, an experience for children and teenagers, organised into four age bands: Sprout (2–6), Cubs (7–10), Compass (11–14) and Voyage (15–18). It is designed to be set up and managed by a parent or guardian, and we take children's privacy seriously. We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the Google Play Families Policy.

• We do not knowingly collect personal information from children online. A child's activity (progress, rewards, avatar) is stored on the device under the parent's control.
• Child avatars are chosen from a preset library — children do not upload their own photos.
• The Deen Buddy is a fixed, scholar-reviewed question-and-answer set — no free-text AI, and nothing a child taps is sent to an AI provider.
• Any parent-recorded audio and family "moments" are created at the parent's initiative, protected behind a parent PIN where applicable, and stored on the device.
• We do not show behavioural or targeted advertising to children, and we do not build advertising profiles of children.

If you are a parent or guardian and believe a child has provided us personal information, or you want to review or delete it, please contact us and we will act promptly.

6Sister Sanctuary & sensitive data

Sister Sanctuary is a private space for women that may include optional menstrual-cycle awareness to adjust worship guidance (for example, prayer and fasting reminders).

Because this data is not collected or transmitted by us, it is not part of any cloud sync or backup we operate. You can delete it at any time within the app, and it is removed if you delete the app from your device.

7Subscriptions & payments

Qafilah offers optional paid subscriptions (for example, Plus, Kids, and Family). Core worship features are always free.

• All payments are processed by the Apple App Store or Google Play under their own terms and privacy policies. We never receive or store your card or bank details.
• We use a subscription-management provider (RevenueCat) to confirm your purchase and unlock features. It receives a purchase token and an app user identifier — not your payment details.
• Manage, cancel, or view your subscription in your Apple or Google account settings. See the billing terms in our Terms of Service.

8Advertising

Qafilah offers an ad-supported free tier. Where ads are shown:

• They are shown only to signed-in adult users on the free tier, and served by a third-party ad network (currently Google AdMob), which may receive a device advertising identifier and ad-context information.
• We do not show ads to children, and we do not show ads inside sensitive surfaces such as Sister Sanctuary.
• We do not track you across other apps or websites for advertising, and we do not show Apple's App Tracking Transparency prompt because we do not track in that sense.
• Paid subscribers do not see ads.

9How we share information

We do not sell your personal information. We share information only with service providers who process it on our behalf, and only as needed:

• Supabase — secure cloud hosting for account info and hybrid-feature data.
• RevenueCat — subscription status and entitlements (no payment details).
• OpenAI (and any future AI providers we name here) — processes text you send to AI features.
• Google AdMob — if ads are shown to you (free tier only).
• OpenStreetMap (Nominatim) — if you search for a city to set your location manually, that search text is sent to their public service to look up its coordinates.
• Expo / push services (Apple & Google) — to deliver notifications you opt into.
• Every.org — if you choose to make a charitable donation, you complete it on their site under their terms.
• News publishers — when you open in-app news feeds, the publisher can see your device's IP address, as with any web request.

We may also disclose information if required by law (and will challenge overbroad requests), and we may share aggregated, non-identifying statistics.

10Storage, retention & security

• On your device: most of your activity lives in a local database and never leaves the device unless a hybrid feature needs it.
• In our cloud: account info and hybrid-feature data are stored with Supabase. Data in transit is encrypted with HTTPS/TLS, and data at rest is encrypted (AES-256).
• Retention: we keep your account and synced data while your account is active. If you delete your account, we delete it and associated cloud data (see Section 12). Local data is removed when you delete the app.

No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

11Your rights & choices

• Access & portability — you can view your data in the app; contact us to request a copy.
• Correction — edit your profile and activity directly in the app.
• Deletion — delete individual items anytime, or your whole account (see Section 12).
• Notifications & location — turn these on or off anytime in your device settings or in the app.

If you are in the EEA or UK (GDPR): you have rights to access, correct, delete, restrict, port, and object to processing of your personal data, and to withdraw consent. Our lawful bases are performance of our contract with you, your consent, and our legitimate interests in operating and improving the app.

If you are in California (CCPA/CPRA): you have rights to know, access, correct, delete, and to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined. We do not discriminate against you for exercising your rights.

To exercise any right, contact us. We aim to respond within 30 days.

12Account & data deletion

You can request deletion of your account and associated personal data at any time:

• In the app — open your Profile and choose Delete account. This deletes immediately; you do not need to wait for us.
• By email — write to contact@getqafilah.com from your account email, and we will process your request within 30 days.

Deleting your account removes your account information and cloud-synced data. Data stored only on your device is removed when you delete the app. Some records may be retained where required by law (for example, tax or fraud-prevention records held by the app stores).

13International users & data transfers

Qafilah is operated from the United States, and your information may be processed in the U.S. and other countries where our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers. By using the app, you understand your information may be processed in these locations.

14Do Not Track / Global Privacy Control

Because we do not track you across other websites or apps, there is no cross-site tracking to disable. Our website honours a Global Privacy Control (GPC) signal where applicable.

15Changes to this policy

We may update this policy as the app evolves. When we make material changes we will update the "Last updated" date, and for significant changes we will show an in-app notice and, where required, ask for renewed consent before continuing to use affected features.

16Contact us

For any privacy question or request:

• Email: contact@getqafilah.com
• Company: Qafilah Inc., Delaware, USA

We aim to respond to privacy requests within 30 days.