Privacy

• Your practice is kept on your own device by default.
• Nothing leaves your device unless you create an account.
• Your private writing syncs only if you turn it on.
• There are no adverts, no analytics and no tracking cookies.
• Your information is never sold.

Everything you do in the app is saved in your browser’s own storage: dhikr counts, reflections, the trigger log, If–Then plans, your pathway, dated notes, family ties, your prayer-time location, and settings such as theme and text size.

Without an account, none of this is sent to us. Clearing your browser’s site data deletes it permanently, so we cannot recover it for you.

Accounts are provided by Supabase, our database and sign-in provider, with data stored in Europe. We keep your email address and a securely hashed password. We never see your password itself.

If you continue with Google, Google shares your name, email address and profile picture with the sign-in provider. The app uses your email address to identify your account. We receive nothing else from your Google account.

Automatically, while you are signed in:

• your profile: display name, time zone, focuses, pace, and the struggles you chose
• bookmarks and follow-later items
• progress and settings: today’s focus and completions, learned cards, lessons marked done, your chosen guide, your practice rhythm, how you divided your day, the reminders you chose on the calendar, and the protection techniques you practised today
• what you are working on: the struggles, diseases of the heart and stage of the self you chose, and whose method you follow
• one summary per day: counts, how many prayers you logged, whether you reflected, and your presence ratings — numbers only, with no journal text in it

Only if you switch it on under Account → Privacy & sync:

• evening reflections
• the trigger log
• If–Then defence plans
• pathway accounts, and your past pathways
• dated notes

Back up is different. When you press it, a copy of everything the app has stored in this browser is saved to your account, including private writing, whatever your sync settings. It exists so you can restore your practice on a new device, and it asks before it copies, naming the private writing it will include.

Reminders you choose on the calendar always show on Today, and as a notification when you open the app if you allow notifications. Nothing is sent anywhere for that.

If you are signed in and allow notifications, your browser gives the app a push address for this device. That address and your time zone are stored with your account so reminders can arrive while the app is closed. A small service on Cloudflare checks every few minutes what is due and sends an encrypted message through your browser’s own push service (Google, Apple or Mozilla). A record of which reminder was sent on which day, with no text, is kept so nothing is sent twice. Push addresses that stop working are removed.

Access rules in the database let each account read and change only its own data. Other users cannot see anything of yours.

Your data is encrypted in transit and at rest by our providers, but it is not end-to-end encrypted. The person who runs this site could technically access the database. We only do so when needed to keep the service running or when you ask for help.

• Cloudflare hosts the site. Like any web host, it handles your IP address and standard request details in order to deliver pages.
• Supabase stores accounts and synced data, as described above.
• Google is involved only if you choose to continue with Google.
• Push services run by Google, Apple or Mozilla, depending on your browser, carry reminder notifications if you turned them on. They see an encrypted message and the push address, not its contents.
• Email to [email protected] is forwarded by Cloudflare to the inbox of the person who runs this site.
• Aladhan (api.aladhan.com) calculates prayer times for places outside the built-in UK and Switzerland timetables. In that case the city you enter, or your approximate coordinates if you use your location, is sent to it. Your location is otherwise stored only on your device.
• Links to sources such as al-islam.org, and the Add to calendar button, take you to other sites that have their own privacy policies.

• Use the app without an account. Nothing is sent to us.
• Turn private-writing sync on or off at any time under Account → Privacy & sync.
• Sign out, or clear your browser’s site data to remove everything from a device.
• Delete your account yourself under Account → Delete account. It removes the account and everything stored with it on our side, straight away. To ask for a copy of your data, email [email protected].

Accounts are not intended for children under 13. If you are under 13, please use the app without an account.

If this policy changes, the date below will change with it. For any question about your data, email [email protected].

Last updated 10 October 2026.