Privacy Policy
Almost everything Falah knows about you stays on your iPhone. Your prayer times, your prayer log, your streak and the apps you choose to lock never leave the device. A few things do reach a server: the Companion and Reflect, because answering you requires sending what you wrote somewhere; anonymous usage statistics, which tell us which screens people use and whether setup flows well; and the handful of requests listed in section 7. This policy sets out exactly where each goes, and what is kept.
It covers the Falah iOS app and nothing else.
The short version
- Prayer times, the prayer log, your streak, your setup answers and your lock settings are stored on your device. The one setup answer that leaves it is how you heard about Falah — see section 6.
- Your location is used on your device to calculate prayer times. We never receive it.
- Falah cannot see which apps you lock, and cannot see your app usage. Apple's design makes that technically impossible.
- Companion questions do leave your phone. They go to our server and on to Google, which generates the reply, together with your first name so the Companion can address you by it.
- Your Companion conversations are saved to your account, so you can reopen them later. They are stored on our server and only you can read them.
- Reflect sends how you are feeling to our server and to Google to choose three duas for you. It needs no account, and nothing you tell it is saved.
- The Companion is the only feature that needs an account. Everything else works signed out.
- We use one analytics tool to see which screens are used, to receive crash reports, and to record the setup screens so we can see whether setup flows well. It is not linked to you, your account, or your location, and recording stops before the subscription screen.
- We do not use advertising or cross-app tracking, and we do not sell your data.
- Deleting the app erases everything held on the device. Deleting your account — a button in Settings — erases your conversations from our server. See section 10.
1. What Falah stores on your device
All of the following is written to your iPhone's local app storage, or to a private container shared only between Falah and its own widgets and iOS extensions. It stays on the device, is included in your encrypted iPhone backup if you make one, and is never transmitted to us, except where this list says otherwise.
- Your first name, if you enter one during setup, or the name Apple shares when you sign in. Falah uses it in setup, in Reflect, and in the Companion. The Companion is the one place it leaves the device — see section 4.
- Your setup answers — how consistently you currently pray, which prayers you find hardest, how often and why you delay, roughly how much screen time you have, which kinds of apps distract you, how you feel about missing a prayer, your goals, your commitment, how you would like to be reminded, and where you heard about Falah. These shape the plan Falah shows you. Only the last one is sent anywhere — see section 6.
- Your approximate location — latitude and longitude, a place name such as "Lahore, Punjab", and a two-letter country code. This is required to calculate prayer times and to pick a sensible default calculation convention for your region.
- Your calculation settings — the calculation method and madhab you follow.
- Your prayer log — which prayers you have answered for, when, and whether each was early, on time, delayed, made up later, or missed — and the streak built from it.
- Your Salah Lock settings — which of the five prayers lock your apps, any scheduled locks you have created, which individual lock windows you ended by hand, and a count of the times a locked app was opened during a Salah. That count records the prayer, the time and Apple's opaque token for the app (see section 2), never its name.
- Your notification settings, including which adhan you chose and whether the Tahajjud reminder is on.
- Your Fajr Alarm settings, if you set one up — when it rings, its sound, whether you scan your prayer mat or your sink, and a numerical summary of that spot that Apple's on-device image recognition produces, so the alarm can recognise it again at Fajr. The photo you take of the spot is deleted as soon as that summary is made, and the summary cannot be turned back into a picture.
- Your Daily Quiz answers, so that reopening the quiz continues rather than starts again.
- Your Quran bookmarks and recently read surahs, and the Quran page fonts Falah has downloaded (see section 7).
- Prayer times prepared for your widgets, so they stay correct when Falah is closed.
- Small records the app keeps for itself: the date you first opened Falah, which streak milestone you were last shown, and, for anyone who used it in an earlier version, which One Good Deed cards were completed.
- Your sign-in details and session, if you sign in — see section 3.
Some of this — your prayer habits and your religious practice — is genuinely personal. That is precisely why it stays on your device. Your prayer log, your streak and your lock settings are never uploaded to us.
Some features store nothing at all. Reflect does not keep your feeling or what you typed; Learn to pray does not record your progress; the Qibla does not keep any picture or direction; the Fajr Alarm keeps no photo, and stopping it does not log Fajr as prayed.
2. What Falah can never see: your locked apps
This deserves its own section, because it is the most common question about an app like this.
Salah Lock is built on Apple's Screen Time (Family Controls) framework. When you choose which apps to lock, that choice is made inside a screen drawn by iOS itself, not by Falah. Apple hands Falah an opaque token for each app — a meaningless identifier that Apple deliberately designed so that it cannot be turned back into an app name.
The practical consequences are absolute:
- Falah does not know which apps you selected.
- Falah cannot see how long you spend in any app. When a locked app is opened during a Salah, iOS asks Falah's own extension to draw the block screen over it; the extension keeps only the count described in section 1, never the app's name, and sends nothing anywhere.
- Falah cannot see your browsing history, your messages, or your notifications.
- Falah cannot read the contents of any app it locks.
Where the app appears to show you the icons or names of the apps you picked, they are drawn by iOS inside its own process — Falah is given a sealed view to place on screen, not the identity of what is inside it. Your selection is stored on your device and in a private container shared only between Falah and its own iOS extensions. It is never transmitted.
3. Signing in with Apple
Falah offers Sign in with Apple, and it is the only sign-in method — there is no password and no sign-up form. You only need to sign in to use the Companion. Prayer times, notifications, Salah Lock, the oath, your prayer log, Reflect, the Quran and the Qibla all work without an account, and nothing else in the app will ask you for one.
When you sign in, Apple asks whether to share your real email address or hide it behind a private relay address that forwards to you. That choice is made on Apple's screen. Apple then gives Falah:
- a stable identifier for you, unique to Falah and useless for recognising you in any other company's app;
- your name and email address as you chose to share them — provided once, the first time you sign in.
This is stored on your device, and it also creates an account on our backend, which is hosted by Supabase. That account is what lets the Companion know it is answering a real, signed-in user rather than an anonymous request. What Supabase holds is described in section 6.
You can revoke Falah's access at any time in iOS Settings → your name → Sign in with Apple → Falah. Signing out inside Falah ends the session on your device. To delete the account itself, see section 10.
4. The Companion
The Companion is the chat tab, where you can ask about Salah and the wider deen. It is the part of Falah that sends what you write to a server, and it is worth being exact about what happens.
When you send a Companion message:
- Your question, your first name if Falah has one, and the identifier of the conversation it belongs to are sent to our backend on Supabase.
- Our backend checks that you are signed in, applies a rate limit, and reads back up to the twelve most recent messages of that conversation from your saved chats. It does not accept a conversation history from the app.
- It then forwards your question, those recent messages, and your first name to Google, which runs the AI model (Gemini) that writes the reply. Your name is given to the model only so it can address you by it; it is not saved with your conversation.
- Google generates the answer and our backend streams it straight back to your phone.
- Once the answer has finished arriving, your question and the reply are saved to your account so that the conversation is still there when you come back to it.
Your conversations are saved
Your past conversations are kept so that you can return to them. The portrait in the Companion header opens the list of them, newest first, and tapping one loads it back into the chat.
What that means precisely:
- Each conversation is stored on our Supabase backend as a title, two timestamps, and the turns of the chat in order.
- Only you can read them. The database enforces this at the row level against your signed-in identity — not merely in the app, but in the database itself, so a bug in the app cannot show one person another person's chats.
- A turn is written only after the answer has finished. A request that fails leaves nothing behind.
- We do not use your conversations to train any model, and we do not read them to build a profile of you.
- They are deleted when you delete your account — see section 10. Clear Chat History in Settings hides your past chats on that iPhone only; it does not delete them from our server. There is currently no way to delete a single conversation while keeping the rest.
The rate limit described in section 6 counts your messages separately from this, so that it still works.
Google processes what is sent to it in order to generate the reply, under Google's Privacy Policy and the terms governing its AI services. We do not control Google's own retention of that data. Please do not type anything into the Companion that you would not want processed by a third party and kept on our server — including personal details, health information, or anything identifying about you or anyone else. The Companion never needs them to help you.
5. Reflect
Reflect asks how you are feeling, then which of three shades of that feeling fits best, and lets you add a note if you want to. It answers with three duas for that moment.
When you finish, Falah sends to our backend on Supabase: the feeling you chose, the shade you chose, your note if you wrote one (at most 600 characters), and a shortlist of duas from Falah's own collection to choose between. Our backend forwards these to Google's Gemini model, which picks three of the duas and writes a short paragraph to go beneath them. The duas themselves — their Arabic, their meaning and their references — come from Falah's own collection, never from the model. Your name is not sent; Falah adds it on your phone.
- No account is needed, and the request is not linked to one.
- Nothing you tell Reflect is saved — not on your phone, and not on our server. Reopening it starts from the first question every time.
- To stop the service being abused, our backend counts requests by the network address they arrive from, allowing a limited number per hour. That count is kept with the address and the time the current hour began, and with nothing about what you asked.
- If our server or Google cannot be reached, Falah chooses the duas on your phone instead, and nothing is sent.
As with the Companion, Google processes what is sent to it under its own terms, and we do not control its retention. A note is optional, and Reflect works just as well without one.
6. What our backend stores
Our backend runs on Supabase. If you have never signed in, it holds nothing about you except the Reflect request count described in section 5, which is tied to a network address and nothing else. If you have signed in, it holds only this:
- Your account — the identifier Apple issued, and the email address you chose to share, which may be Apple's private relay address. This comes from Sign in with Apple; we never ask you for it directly.
- A profile row containing your account identifier and the date it was created. Nothing else.
- Companion usage — how many messages you have sent in the past hour and the times you sent them, plus your subscription tier. This exists to enforce a limit of 20 Companion messages per hour, which is what stops the service being abused and the costs running away.
- Your subscription status — whether your subscription is active, when it expires, which plan it is, and the transaction identifier Apple assigned to it. Superwall sends this to our backend when your subscription starts, renews or ends, and the app can confirm it after a purchase, so the Companion knows your account is subscribed. It contains no payment details.
- Your Companion conversations — the title of each chat, when it was created and last added to, and the text of every turn in it. This is what section 4 describes, and it is there so your chats are waiting for you next time.
That is the complete list. Your prayer log, your streak, your setup answers, your location and your lock settings are not on our server, and never have been.
7. Other services
PostHog — anonymous usage statistics, crash reports and setup recordings
Falah uses PostHog to understand how the app is used, to see whether setup is working, and to find out when the app breaks. It receives:
- Usage events — that Falah was opened, installed or updated; which tab was opened; which setup screen was reached; and that setup was completed. These come with standard technical details such as your device model, iOS version, app version and language.
- Where you heard about Falah — the answer to that one setup question, so we know which channels bring people in.
- Crash reports — when the app hits an error, the technical details of the fault.
- A recording of setup. While you go through setup, PostHog records the screens and your taps, so we can watch where people get stuck and make setup clearer. Recording begins when setup begins and stops the moment you finish it, before the subscription screen. Nothing after that point — the paywall, Home, your prayer log, the Companion, the Quran or anything else — is ever recorded. Within the recording, everything you type, every image, your name, and Apple's app picker are blacked out. It does show which answers you tapped. Recordings are deleted after 30 days.
What matters is what it is not given:
- No identity. Falah never tells PostHog who you are. Your account, your name and your email are never sent to it, and the anonymous installation identifier it generates is never connected to them. We cannot look up a person and see what they did.
- No location. PostHog would ordinarily estimate a city from the network address a request arrives on. Falah switches that off. Your location is not sent to it, or inferred by it.
- No worship, and no content. Your prayer log, your streak, your Companion messages, what you tell Reflect, and anything about which apps you lock are never sent to it. Whether you prayed is not analytics.
Crash reports are the exception to Falah's usual reticence, and a deliberate one: an app that fails silently on someone's phone fails there permanently, because nobody ever finds out. A crash report describes the fault in the code, not the person who met it. See the PostHog Privacy Policy.
Superwall — the subscription screen
Falah uses Superwall to display its subscription screen and to track subscription status. Superwall receives technical and commercial information — as declared in their App Store privacy manifest, purchase history, together with standard device and app information such as your device model, operating system version, app version, locale, and an anonymous identifier generated for your installation. It also records that a subscription screen was shown, dismissed, or converted.
If you sign in, Falah also gives Superwall your account's identifier — a random string, not your name or email — so that your subscription follows your account and Superwall can tell our backend about it (section 6). Superwall does not receive your name, your email, your location, your prayer log, your Companion messages, or anything about which apps you lock. See the Superwall Privacy Policy.
Apple
Place names. When Falah works out which city you are in, it asks iOS to convert your coordinates into a place name. That request is handled by Apple and may be sent to Apple's servers. Falah receives only the resulting name and country code. If it fails, your prayer times are unaffected. The prayer time calculation itself happens entirely on your device using standard astronomical formulas — there is no prayer-time server and no city database.
Subscriptions. If you purchase a Falah subscription, the transaction is handled entirely by Apple through the App Store. We never see your name, your card, or your billing address.
Ratings. During setup Falah may ask iOS to show Apple's own rating prompt. Whether and what you rate is between you and Apple; Falah is not told.
Apple's handling of all of these is governed by Apple's Privacy Policy.
Quran.com — page fonts
The Quran tab draws each page of the mushaf in its own font, and there are 604 of them, so Falah downloads each one from Quran.com's servers the first time you open that page and keeps it on your phone afterwards. The request contains no account and no information about you, but like any download it reaches Quran.com from your network address, and the file it asks for corresponds to a page of the Quran. Your bookmarks and reading history are never sent.
Expo — app updates
Falah can receive small fixes without a full App Store update. To do that, it checks Expo's update service when it opens, sending standard technical information such as the app version, the update it currently has, and the platform. It sends nothing about you or your use of the app.
8. What Falah does not do
- No passwords, and no sign-up form. The only way to sign in is Apple's own, handled on Apple's screen. We never see or store a password.
- No advertising. Falah contains no ads and no advertising SDKs.
- No tracking. Falah does not track you across other companies' apps or websites, and does not request App Tracking Transparency permission because it has nothing to ask for.
- No other analytics. There is no Google Analytics, no Firebase, no Facebook SDK, no Amplitude, no Mixpanel. The one analytics tool in the app is PostHog, described in section 7, and it is given no identity and no location.
- No selling or sharing. We do not sell, rent, or share personal information with third parties for their own marketing purposes.
- No push server. Every notification Falah sends — the adhan, the warning that a prayer's time is closing, the weekly Reflect and Jummah reminders, the Tahajjud reminder if you turn it on, and the reminder you can ask for from the block screen — is scheduled by your own iPhone, and so is the Fajr Alarm. The app is not provisioned to receive remote push notifications at all.
- No uploading of your worship. Your prayer log stays on your device. We do not know whether you prayed.
9. Permissions Falah asks for
Every one of these is optional, and each can be revoked at any time in iOS Settings → Falah.
- Location, while using the app. Used to calculate prayer times and to find the direction of the Qibla. Falah never requests background or "always" access, and asks for a deliberately coarse fix, because prayer times do not change meaningfully across a city. It checks your location when it needs to establish or refresh your place; it does not follow you around.
- Camera. Used by the Qibla, which shows the direction of the Kaaba over the view from your back camera, and by the Fajr Alarm, which asks you to photograph your prayer mat or sink when you set it up and to scan it again to stop the alarm. Everything is processed on your phone. The Qibla records nothing; the Fajr Alarm keeps only the summary described in section 1, never a photo. Nothing from the camera is sent anywhere. Without the camera, the Qibla shows a compass instead.
- Motion sensors. The Qibla reads your phone's orientation to know which way it is pointing. iOS does not ask about this one, so it is listed here instead: it happens on your phone and is never stored or sent.
- Adding to your photo library. Only when you tap Save Image, for example on your Salah journey. Falah can add the image you chose and cannot see or read anything else in your library.
- Notifications. For the alerts listed in section 8.
- Alarms. Only if you set up the Fajr Alarm, which uses iOS's own alarm system (iOS 26 and later) to ring at Fajr. The alarm is scheduled on your phone.
- Screen Time. For Salah Lock, as section 2 describes.
10. How long data is kept, and how to delete it
On your device
Everything in section 1 stays on your device until you remove it. Deleting the app removes Falah's entire storage container — your prayer log, your setup answers, your location, your lock settings and your saved session. This is complete and irreversible. You can also revoke Screen Time access, and revoke Sign in with Apple, in iOS Settings.
On our backend
If you signed in, your account, your subscription status, your Companion conversations and the rate-limit rows described in section 6 remain on Supabase until the account is deleted. Deleting the app does not delete the account, because the account lives on the server rather than the phone.
You can delete it yourself, from inside Falah. Open Settings and use Delete account at the bottom of the page. It asks you to confirm, and then removes your account and everything attached to it — your profile row, your subscription status, your rate-limit history, and every Companion conversation and message you have ever had. This is immediate and irreversible, and we keep no copy. Deleting your account does not cancel a subscription; Apple manages that.
Deleting your account does not touch anything on your phone. Your prayer log, your streak, your settings and your locks are all still there, and Falah keeps working signed out. If you want those gone too, delete the app.
If you would rather not do it in the app, email us at the address in section 15 from — or naming — the address you signed in with, and we will do it and confirm when it is done. Rate-limit timestamps older than one hour serve no purpose and are not retained as history.
With PostHog
Setup recordings are deleted after 30 days. Usage events and crash reports are kept by PostHog for as long as our account with them retains them. Because none of it is linked to you, we cannot pick out your data from anyone else's — which is also why none of it can describe you.
11. Your rights
Depending on where you live, you may have rights under laws such as the GDPR (Europe and the UK), PIPEDA (Canada), or the CCPA/CPRA (California) to access, correct, delete, or port your personal information, and to object to its processing.
Most of what Falah knows is on your own device, so you already exercise those rights directly: you can see it in the app and erase all of it by deleting the app. For the limited account information we hold on Supabase, described in section 6, write to us at the address below and we will respond as the applicable law requires. We do not discriminate against anyone for exercising these rights, and we do not sell personal information as those laws define the term.
For users in the European Economic Area and the UK, our lawful basis is: your consent for location, the camera and signing in, which you may withdraw at any time in iOS Settings; performance of a contract for operating the Companion and Reflect, saving your conversations so they are there when you return, and your subscription, once you ask for them; and our legitimate interest in rate limiting, which keeps the service available and affordable for everyone, and in anonymous usage statistics, setup recordings and crash reports, which are what allow us to find and fix what is not working. None of these carries an identifier that reaches back to you, which is what keeps that interest a light one. Data sent to Google, Supabase, Superwall, PostHog and Expo may be processed outside your country, including in the United States, under the transfer safeguards those providers maintain.
12. Children
Falah is not directed at children under 13, and we do not knowingly collect personal information from them. The app has no public profiles, no messaging between users, and no user-generated content that could be shared with anyone else. If you believe a child has provided us with personal information, contact us and we will act on it.
13. Security
Your on-device data is protected by iOS: it sits in the app's private container, which other apps cannot read, and is covered by your device passcode and iOS file encryption.
Traffic between the app, our backend and Google is encrypted in transit. Our backend requires a valid Apple-issued session for every Companion request, and the database is configured so that a signed-in user can read only their own rows and cannot write to the rate-limit or subscription tables at all. The key used to reach Google is held only on the server and is never present in the app.
No system is perfectly secure, and we do not claim otherwise. Keeping your prayer log, your answers and your locked apps off our server is a deliberate limit on how much a breach of it could ever expose.
14. Changes to this policy
If this policy changes, the "Last updated" date at the top changes with it. If a change is material — particularly anything that causes information to leave your device that previously did not — we will make that clear within the app rather than relying on you to re-read this page.
15. Contact
Questions about this policy, requests to delete your account, or anything else described here: