Privacy Policy
Almost everything Falah knows about you stays on your iPhone. Your prayer times, your prayer log, your setup answers and the apps you choose to lock never leave the device. Two things do reach a server: the Companion — the chat tab — because answering a question requires sending it somewhere, and anonymous usage statistics that tell us which screens people use. This policy sets out exactly where each goes, and what is kept.
It covers the Falah iOS app and nothing else.
The short version
- Prayer times, the prayer log, your setup answers and your lock settings are stored only on your device.
- Your location is used on your device to calculate prayer times. We never receive it.
- Falah cannot see which apps you lock, and cannot see your app usage. Apple's design makes that technically impossible.
- Companion questions do leave your phone. They go to our server and on to Google, which generates the reply.
- Your Companion conversations are saved to your account, so you can reopen them later. They are stored on our server and only you can read them.
- The Companion is the only feature that needs an account. Everything else works signed out.
- We use one analytics tool to see which screens are used and to receive crash reports. It is not linked to you, your account, or your location.
- We do not use advertising or cross-app tracking, and we do not sell your data.
- Deleting the app erases everything held on the device. Deleting your account — a button in Settings — erases your conversations from our server. See section 9.
1. What Falah stores on your device
All of the following is written to your iPhone's local app storage. It stays on the device, is included in your encrypted iPhone backup if you make one, and is never transmitted to us.
- Your first name, if you choose to enter one during setup. It is used to greet you on the Home screen.
- Your setup answers — how consistently you currently pray, which prayers you tend to miss, what usually delays you, how you feel about missing a prayer, your goal, and how strongly you want to be held accountable. These shape the plan Falah shows you.
- Your approximate location — latitude and longitude, a place name such as "Lahore, Punjab", and a two-letter country code. This is required to calculate prayer times and to pick a sensible default calculation convention for your region.
- Your calculation settings — the calculation method and madhab you follow.
- Your prayer log — which prayers you have confirmed, when you confirmed them, and whether each was early, on time, delayed, made up later, or missed.
- Your Salah Lock settings — which of the five prayers lock your apps, any scheduled locks you have created, and which individual lock windows you ended by hand.
- Which One Good Deed cards you have completed, week by week.
- Your notification preference and the date you first opened the app.
- Your sign-in details and session, if you sign in — see section 3.
Some of this — your prayer habits and your religious practice — is genuinely personal. That is precisely why it stays on your device. None of the above is uploaded to us, including your prayer log and your setup answers.
2. What Falah can never see: your locked apps
This deserves its own section, because it is the most common question about an app like this.
Salah Lock is built on Apple's Screen Time (Family Controls) framework. When you choose which apps to lock, that choice is made inside a screen drawn by iOS itself, not by Falah. Apple hands Falah an opaque token for each app — a meaningless identifier that Apple deliberately designed so that it cannot be turned back into an app name.
The practical consequences are absolute:
- Falah does not know which apps you selected.
- Falah cannot see how long you spend in any app, or when you open one.
- Falah cannot see your browsing history, your messages, or your notifications.
- Falah cannot read the contents of any app it locks.
Where the app appears to show you the icons of the apps you picked, those icons are drawn by iOS inside its own process — Falah is given a sealed view to place on screen, not the identity of what is inside it. Your selection is stored on your device and in a private container shared only between Falah and its own iOS extensions. It is never transmitted.
3. Signing in with Apple
Falah offers Sign in with Apple, and it is the only sign-in method — there is no password and no sign-up form. You only need to sign in to use the Companion. Prayer times, notifications, Salah Lock, the oath and your prayer log all work without an account, and nothing else in the app will ask you for one.
When you sign in, Apple asks whether to share your real email address or hide it behind a private relay address that forwards to you. That choice is made on Apple's screen. Apple then gives Falah:
- a stable identifier for you, unique to Falah and useless for recognising you in any other company's app;
- your name and email address as you chose to share them — provided once, the first time you sign in.
This is stored on your device, and it also creates an account on our backend, which is hosted by Supabase. That account is what lets the Companion know it is answering a real, signed-in user rather than an anonymous request. What Supabase holds is described in section 5.
You can revoke Falah's access at any time in iOS Settings → your name → Sign in with Apple → Falah. Signing out inside Falah ends the session on your device. To delete the account itself, see section 9.
4. The Companion
The Companion is the chat tab, where you can ask about Salah and the wider deen. It is the part of Falah that sends what you write to a server, and it is worth being exact about what happens.
When you send a Companion message:
- Your question, and up to the eight most recent messages in that same conversation, are sent to our backend on Supabase.
- Our backend checks that you are signed in, applies a rate limit, and then forwards your question and those recent messages to Google, which runs the AI model (Gemini) that writes the reply.
- Google generates the answer and our backend streams it straight back to your phone.
- Once the answer has finished arriving, your question and the reply are saved to your account so that the conversation is still there when you come back to it.
Your conversations are saved
Your past conversations are kept so that you can return to them. The portrait in the Companion header opens the list of them, newest first, and tapping one loads it back into the chat.
What that means precisely:
- Each conversation is stored on our Supabase backend as a title, two timestamps, and the turns of the chat in order.
- Only you can read them. The database enforces this at the row level against your signed-in identity — not merely in the app, but in the database itself, so a bug in the app cannot show one person another person's chats.
- A turn is written only after the answer has finished. A request that fails leaves nothing behind.
- We do not use your conversations to train any model, and we do not read them to build a profile of you.
- They are deleted when you delete your account — see section 9. There is currently no way to delete a single conversation while keeping the rest.
The rate limit described in section 5 counts your messages separately from this, so that it still works.
Google processes what is sent to it in order to generate the reply, under Google's Privacy Policy and the terms governing its AI services. We do not control Google's own retention of that data. Please do not type anything into the Companion that you would not want processed by a third party and kept on our server — including personal details, health information, or anything identifying about you or anyone else. The Companion never needs them to help you.
5. What our backend stores
Our backend runs on Supabase. If you have never signed in, it holds nothing about you at all. If you have, it holds only this:
- Your account — the identifier Apple issued, and the email address you chose to share, which may be Apple's private relay address. This comes from Sign in with Apple; we never ask you for it directly.
- A profile row containing your account identifier and the date it was created. Nothing else.
- Companion usage — how many messages you have sent in the past hour and the times you sent them, plus your subscription tier. This exists to enforce a limit of 20 Companion messages per hour, which is what stops the service being abused and the costs running away.
- Your Companion conversations — the title of each chat, when it was created and last added to, and the text of every turn in it. This is what section 4 describes, and it is there so your chats are waiting for you next time.
That is the complete list. Your prayer log, your setup answers, your location and your lock settings are not on our server, and never have been.
6. Other services
Apple — turning coordinates into a place name
When Falah works out which city you are in rather than the next one over, it asks iOS to convert your coordinates into a place name. That request is handled by Apple and may be sent to Apple's servers. Falah receives only the resulting name and country code. This is a convenience for the Settings screen; if it fails, your prayer times are unaffected. Apple's handling of it is governed by Apple's Privacy Policy.
The prayer time calculation itself happens entirely on your device using standard astronomical formulas. There is no prayer-time server and no city database — that part of Falah works with no internet connection at all.
Apple — subscriptions
If you purchase a Falah subscription, the transaction is handled entirely by Apple through the App Store. We never see your name, your card, or your billing address. We receive only Apple's confirmation of whether a valid subscription exists.
PostHog — anonymous usage statistics and crash reports
Falah uses PostHog to understand how the app is used and to find out when it breaks. It receives two things: a record that a screen was opened or that setup was completed, and a report when the app hits an error, containing the technical details of the fault.
What matters is what it is not given:
- No identity. Falah never tells PostHog who you are. Your account, your name and your email are never sent to it, and the anonymous installation identifier it generates is never connected to them. We cannot look up a person and see what they did.
- No location. PostHog would ordinarily estimate a city from the network address a request arrives on. Falah switches that off. Your location is not sent to it, or inferred by it.
- No worship, and no content. Your prayer log, your streak, your setup answers, your Companion messages and anything about which apps you lock are never sent to it. Whether you prayed is not analytics.
Crash reports are the exception to Falah's usual reticence, and a deliberate one: an app that fails silently on someone's phone fails there permanently, because nobody ever finds out. A crash report describes the fault in the code, not the person who met it. See the PostHog Privacy Policy.
Superwall — paywall infrastructure
Falah uses Superwall to display its subscription screen and to track subscription status. Superwall receives technical and commercial information — as declared in their App Store privacy manifest, purchase history, together with standard device and app information such as your device model, operating system version, app version, locale, and an anonymous identifier generated for your installation. It also records that a subscription screen was shown, dismissed, or converted.
Superwall does not receive your name, your location, your prayer log, your Companion messages, or anything about which apps you lock. Their manifest declares that this data is not linked to your identity and is not used for tracking. See the Superwall Privacy Policy.
7. What Falah does not do
- No passwords, and no sign-up form. The only way to sign in is Apple's own, handled on Apple's screen. We never see or store a password.
- No advertising. Falah contains no ads and no advertising SDKs.
- No tracking. Falah does not track you across other companies' apps or websites, and does not request App Tracking Transparency permission because it has nothing to ask for.
- No third-party trackers. There is no Google Analytics, no Firebase, no Facebook SDK, no Amplitude, no Mixpanel. The one analytics tool in the app is PostHog, described in section 6, and it is given no identity and no location.
- No selling or sharing. We do not sell, rent, or share personal information with third parties for their own marketing purposes.
- No push server. Every notification Falah sends — the adhan alert and the closing-window warning — is scheduled by your own iPhone. The app is not provisioned to receive remote push notifications at all.
- No uploading of your worship. Your prayer log stays on your device. We do not know whether you prayed.
8. Location permission
Falah asks for location access while using the app only. It never requests background or "always" location access. You may decline, and you may revoke access at any time in iOS Settings → Privacy & Security → Location Services → Falah. Falah checks your location when it needs to establish or refresh your place; it does not follow you around.
Location accuracy is deliberately requested at a low, coarse level. Prayer times do not change meaningfully across a city, so Falah does not need to know precisely where in it you are.
9. How long data is kept, and how to delete it
On your device
Everything in section 1 stays on your device until you remove it. Deleting the app removes Falah's entire storage container — your prayer log, your setup answers, your location, your lock settings and your saved session. This is complete and irreversible. You can also revoke Screen Time access, and revoke Sign in with Apple, in iOS Settings.
On our backend
If you signed in, your account, your Companion conversations and the rate-limit rows described in section 5 remain on Supabase until the account is deleted. Deleting the app does not delete the account, because the account lives on the server rather than the phone.
You can delete it yourself, from inside Falah. Open Settings and use Delete account at the bottom of the page. It asks you to confirm, and then removes your account and everything attached to it — your profile row, your rate-limit history, and every Companion conversation and message you have ever had. This is immediate and irreversible, and we keep no copy.
Deleting your account does not touch anything on your phone. Your prayer log, your streak, your settings and your locks are all still there, and Falah keeps working signed out. If you want those gone too, delete the app.
If you would rather not do it in the app, email us at the address in section 14 from — or naming — the address you signed in with, and we will do it and confirm when it is done. Rate-limit timestamps older than one hour serve no purpose and are not retained as history.
10. Your rights
Depending on where you live, you may have rights under laws such as the GDPR (Europe and the UK), PIPEDA (Canada), or the CCPA/CPRA (California) to access, correct, delete, or port your personal information, and to object to its processing.
Most of what Falah knows is on your own device, so you already exercise those rights directly: you can see it in the app and erase all of it by deleting the app. For the limited account information we hold on Supabase, described in section 5, write to us at the address below and we will respond as the applicable law requires. We do not discriminate against anyone for exercising these rights, and we do not sell personal information as those laws define the term.
For users in the European Economic Area and the UK, our lawful basis is: your consent for location and for signing in, which you may withdraw at any time in iOS Settings; performance of a contract for operating the Companion, saving your conversations so they are there when you return, and your subscription, once you ask for them; and our legitimate interest in rate limiting, which keeps the service available and affordable for everyone, and in anonymous usage statistics and crash reports, which are what allow a fault on someone's phone to be found and fixed. The analytics carry no identifier that reaches back to you, which is what keeps that interest a light one. Data sent to Google, Supabase and PostHog may be processed outside your country, including in the United States, under the transfer safeguards those providers maintain.
11. Children
Falah is not directed at children under 13, and we do not knowingly collect personal information from them. The app has no public profiles, no messaging between users, and no user-generated content that could be shared with anyone else. If you believe a child has provided us with personal information, contact us and we will act on it.
12. Security
Your on-device data is protected by iOS: it sits in the app's private container, which other apps cannot read, and is covered by your device passcode and iOS file encryption.
Traffic between the app, our backend and Google is encrypted in transit. Our backend requires a valid Apple-issued session for every Companion request, and the database is configured so that a signed-in user can read only their own rows and cannot write to the rate-limit table at all. The key used to reach Google is held only on the server and is never present in the app.
No system is perfectly secure, and we do not claim otherwise. Keeping your prayer log, your answers and your locked apps off our server is a deliberate limit on how much a breach of it could ever expose.
13. Changes to this policy
If this policy changes, the "Last updated" date at the top changes with it. If a change is material — particularly anything that causes information to leave your device that previously did not — we will make that clear within the app rather than relying on you to re-read this page.
14. Contact
Questions about this policy, requests to delete your account, or anything else described here: