Hayaa Privacy Policy

Introduction

Hayaa ("we", "us", "our", or the "App") is an Islamic recovery application designed to help Muslims overcome compulsive pornography and masturbation habits. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use the App.

This policy applies to the Hayaa mobile application available on the Apple App Store and Google Play Store, and to any related services we operate.

By creating an account or otherwise using the App, you acknowledge that you have read this Privacy Policy. Where the law requires your consent, we ask for it separately in the App, as described below. If you do not agree, please do not use the App.

Hayaa is operated by Hayaa LLC, a Michigan limited liability company. For privacy questions, contact support@hayaa.io.

Data Controller

For the purposes of the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, and equivalent laws, the data controller for your personal information is Hayaa LLC, contactable at support@hayaa.io.

For the purposes of the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), Hayaa LLC acts as the business that determines the purposes and means of processing your personal information.

Sensitive Personal Information

Hayaa processes categories of personal information that many privacy laws treat as "special" or "sensitive". We ask for your explicit consent to process these categories on a separate screen when you create your account, by ticking two boxes. We process them only to deliver the App's features, and we never sell them or use them for advertising.

• Religious affiliation. Your declared Islamic sect ("Sunni", "Shia", or "prefer not to say") is used to choose the Islamic content you see, to guide the replies of the AI companion (Rafiq/Rafiqa), and to prefer accountability partners from the same tradition.
• Health-related information. Your recovery data (streaks and streak history, check-ins and mood, urges, SOS use, journal entries, and your conversations with Rafiq/Rafiqa) is used to run the App's tools. It is shared only with the service providers listed under "How We Share Your Information" and, if you link one, with your accountability partner as described there.
• Information concerning a person's sex life. By the nature of the App, your use is itself indicative of a sensitive personal context. We do not collect details of sexual behaviour beyond what you voluntarily disclose in journal entries, partner messages, or AI conversations.

You can withdraw this consent at any time under Settings → Privacy and data → Withdraw consent. The App cannot work without it, so withdrawing deletes your account (see "Your Rights" below). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Information We Collect

We collect information you provide directly, information generated through your use of the App, and information from third-party services you authorise.

1. Account & profile information
   • Email address (for authentication).
   • Display name, full name, age, gender, sect, recovery goals, struggle duration, usage frequency, triggers, and motivations supplied during onboarding.
   • Optional avatar selection.
2. Usage data
   • Streak start date, current streak, longest streak, relapse events, check-ins (including the mood you choose), urges you log, and milestone records.
   • When you press SOS, the date, the time and your local hour, which steps and tools you used, how soon you took the first one, and how you said it went afterwards. We use this to run SOS and, in aggregate, to learn which tools help.
   • Journal entries you author.
   • Messages you exchange with the AI companion (Rafiq/Rafiqa), and the mood you choose for a conversation.
   • Messages you exchange with your accountability partner. They are kept for 30 days and then deleted. If either partner reports the partnership, a Hayaa moderator can read the most recent messages to review the report.
   • Posts, replies, and reactions you submit to the community.
   • Reports you file or that other users file against your content.
3. Device & technical information
   • Push notification token (so we can deliver prayer reminders, check-in prompts, partner alerts, and community replies).
   • Which notification you opened and when, kept for 180 days, so we can see which reminders help.
   • Operating system and App version, sent with crash reports and with emails you send us.
   • For a sample of app launches and screen changes, how long the App took to start, to show the screen and to finish its network requests. This goes to Sentry with the screen's name and the request's address with any identifiers removed, never your content.
4. Location information (only if you grant permission)
   • If you allow location, the App rounds your position to about 1 km and uses it to fetch prayer times from the Aladhan API. The rounded position is kept on your device to reuse cached prayer times. We do not store it on our servers and we do not track movement.
5. Subscription and purchase information
   • Subscription status (trial, active, expired, cancelled) and the product identifier supplied by RevenueCat, for your subscription and for any one-time purchase you make in the App (such as the optional Blocker emergency-unlock tip). We do not receive or store your payment card or bank details. Purchases are processed by Apple or Google.
6. Accountability partner data
   • If you connect with an accountability partner, the relationship record links your account to theirs, and your display name, avatar, current streak, last check-in date, recent SOS alerts (24h), recent urge activity (24h), recent streak resets, and, on Android if you turned on partner alerts, Blocker alerts (the kind of event, the time and, for a loosened Blocker, how many times in the last day) and whether your Blocker is on or off right now and since when are shared with that partner.
7. Third-party authentication data
   • If you sign in with Apple or Google, we receive a verified email address and a unique identifier from that provider. Google also sends your name and a link to your profile photo, and Apple may send your name the first time you sign in. The App offers that name to fill in your full name during sign-up, and you can change it. We never use the photo, and we remove the name and photo link before your sign-in record is saved. Your name can still remain for up to 7 days in the security logs of Supabase, our sign-in provider, and both can stay in the sign-in session saved on your phone until the App next refreshes it. We do not receive your password.
8. Referral codes
   • If you enter a referral code, we store that code and the date you entered it to administer our referral program and pay partners. We never share your identity with referral partners. They receive only aggregate totals. Anonymized referral records may be retained for accounting after account deletion.
9. Blocker settings and partner alerts
   • If you use the Blocker, the apps and websites you choose to block and your Blocker settings (including your Timer Lock or passcode choice, your guard choices, and your emergency-unlock preference) are stored only on your device. We do not receive them, we do not store them on our servers, and they are not included in your data export or in anything shared with an accountability partner. If you set a Blocker passcode, only a protected (hashed) form of it is kept, in your device's secure storage.
   • On Android, if you have an accountability partner and turn on partner alerts, we record when your Blocker is turned off inside the App, when you loosen your Blocker while it stays on (for example pausing a group, removing an app or site, or turning off a guard or the lock), when its Accessibility Service is switched off, when you sign out of the App on that phone, and when the App has not reported in for 10 hours, and we tell your partner the kind of event, the time and, for a loosened Blocker, how many times in the last day, never what changed. While partner alerts are on, your partner can also see whether your Blocker is on or off right now and since when (never what it blocks). To do this the App sends us a short still-running signal (a device code and whether it is running) while your phone is in use, and a sign-out signal with the same device code when you sign out. We receive nothing else about your Blocker. These alert records are included in your data export and deleted with your account. Partner alerts have no off switch once they are on. They end when the partnership ends, when your Premium ends, when you sign out of the App on that phone (your partner is told of the sign-out), or when you delete your account. They start again if you sign back in on that phone, link a new partner, or your Premium starts again within 30 days.
   • The personal note shown on your block screen is also added to the motivations on your profile (see item 1), so that one line is stored with your account like your other motivations. Your streak, which the block screen also shows, is already covered by item 2.
   • On Android, the Blocker uses an Accessibility Service. While it is on, the App can see which app is open, the web address shown in a supported browser and, only for a guard you turned on, the words on a few Android settings and install screens. This is used on your device, at that moment, only to decide whether to show your block screen or close a protected settings page. It is not recorded, transmitted, or shared.
   • If you turn on blocking notifications from blocked apps, the App uses Android notification access. It looks only at which app posted a notification, never its content, and hides it if that app is blocked right now. Nothing is recorded or sent.
   • On iOS, the Blocker uses Apple's Screen Time (Family Controls) features. Apple provides the App with opaque identifiers for the apps you select. These identifiers cannot be read by us to determine which apps they are, and they do not leave your device.

How We Use Your Information

We use your personal information only for the following purposes.

• To create and maintain your account.
• To personalise the religious content you see, including filtering by sect and matching content to your stage of recovery.
• To operate the AI companion ("Rafiq" / "Rafiqa") and provide responses grounded in verified Islamic sources.
• To track your streak, milestones, and recovery progress.
• To deliver notifications you have opted into (prayer times, check-in reminders, partner activity, milestone celebrations, community replies).
• To match you with accountability partners (Premium feature) and to enable communication between matched partners. We match partners by gender, and prefer the same sect, a similar age, and a similar recovery stage and streak, widening the search if no match is found.
• To moderate community content and partner messages using automated in-app filters, and to investigate user reports.
• To process and validate subscriptions through RevenueCat, Apple, and Google.
• To operate the Blocker, by checking what you have open against the block list you created and showing your block screen. This happens entirely on your device.
• To detect, prevent, and investigate fraud, abuse, and Terms of Service violations.
• To comply with legal obligations and lawful requests from authorities.
• To improve the App, fix bugs, and develop new features. We use aggregated, de-identified data for analytics where possible.

Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases.

• Contract (Art. 6(1)(b)), for processing necessary to provide the App's features you have requested, such as authentication, streak tracking, and the AI companion.
• Consent (Art. 6(1)(a) and Art. 9(2)(a) for sensitive data), for processing religious, health, and sex-life information, for sending push notifications, and for accessing your location.
• Legitimate interests (Art. 6(1)(f)), for fraud prevention, security, content moderation, and product improvement, balanced against your rights and interests.
• Legal obligation (Art. 6(1)(c)), where we must process data to comply with applicable law.

How We Share Your Information

We do not sell your personal information. We share information only as described below. We do not share any Blocker information with anyone, including accountability partners, except the partner alerts and the on or off status described in item 9, which carry the kind of event, whether the Blocker is on or off, and the time only.

1. Service providers ("processors") acting on our instructions
   • Supabase, Inc. provides database, authentication, file storage, and server-side functions. It hosts your profile, recovery data, journal entries, partner messages, AI conversations, and community data.
   • Anthropic, PBC provides the Claude AI model that powers Rafiq/Rafiqa responses. Each time you send a message, Anthropic receives that message, your 10 most recent messages in the conversation, the mood you chose, and a few profile details (sect, current streak, recovery stage, triggers, and motivation). Anthropic does not use this data to train its models.
   • Voyage AI provides the embedding model used to find relevant religious content. Voyage AI receives the text of each message you send to Rafiq/Rafiqa, and nothing else, to find matching verses, hadith, and duʿās in our database. It processes that text under its own terms.
   • RevenueCat, Inc. provides subscription management. We share an app-specific user identifier and your account email address with RevenueCat to link your subscription to your account across devices. Earlier versions of the App also shared your display name, and current versions remove it. When you delete your account, we ask RevenueCat to delete this customer record.
   • Apple Inc. and Google LLC process purchases through their App Stores and, if you choose, provide authentication via Sign in with Apple or Sign in with Google.
   • The Aladhan API is used to calculate prayer times. If you grant location permission, the App sends your position, rounded to about 1 km, to Aladhan to retrieve prayer schedules. Aladhan receives the rounded position, not your name or account. Like any website it also sees your device's IP address.
   • Expo, Apple, and Google deliver our notifications. A notification can include your partner's display name, the kind of event (for example an SOS or an urge) and, if you allow message previews, the start of a message. A notification about a reply to your community post quotes the start of the reply.
   • Sentry (Functional Software, Inc.) provides automated crash reporting, error tracking and performance monitoring from the App. Sentry receives technical context about errors (stack traces, device model, OS version, App version, an anonymous installation identifier, and screen-navigation and request breadcrumbs, with identifiers removed from request addresses) and, with the same technical context, the sampled timings listed under Device & technical information above, but is not used to collect message content, journal entries, or AI conversations.

Each of these providers may use your information only to provide its service to us, and must protect it at least as well as this policy does.

1. Accountability partners

When you accept a partner relationship, that partner can see your display name, avatar, current streak, last check-in date, whether you triggered an SOS alert in the last 24 hours, your recent urge activity (count and recency within 24 hours), whether you recently had a hard day (streak reset), and, on Android if you turned on partner alerts, a Blocker alert (the kind of event, the time and, for a loosened Blocker, how many times in the last day) and whether your Blocker is on or off right now and since when. Your partner also reads the messages you send them. They cannot see your real name, email, journal entries, AI conversations, or any other private data.

1. Other community members

Posts and replies you submit are visible to other users of the same gender, with your display name and your streak day at the time you posted. Hayaa moderators can see all posts, including hidden ones.

1. Legal & safety disclosures

We may disclose information when we believe in good faith that disclosure is necessary to (a) comply with applicable law, regulation, legal process, or governmental request, (b) enforce our Terms of Service, (c) detect, prevent, or otherwise address fraud or security issues, or (d) protect against harm to the rights, property, or safety of Hayaa, our users, or the public.

1. Business transfers

If Hayaa is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

Data Retention

We keep your personal information while your account exists, unless a shorter period below applies. Some items, such as journal entries, you can also delete yourself at any time.

• Messages with your accountability partner are deleted 30 days after they are sent.
• Blocker partner alert records are deleted after 90 days.
• Blocker device records are deleted 30 days after that phone is signed out or stops sending its signal.
• Data export files are deleted 24 hours after they are made. The download link works for one hour.
• Push notification tokens are deleted when a device has not refreshed them for 90 days.
• Records of which notification you opened are deleted after 180 days.
• Records used to limit how often an action can be repeated are deleted after 2 days.
• Records of subscription events that RevenueCat sends us are deleted after 90 days.

We do not currently delete accounts automatically when they are not used, so please delete your account if you stop using the App.

When you delete your account, we delete it straight away, together with everything linked to it, including your profile, check-ins, urges, SOS use, streak history, journal entries, AI conversation history, community posts and replies, partner relationships and messages, Blocker alert records, and push tokens. We also ask RevenueCat to delete your customer record. Copies in our encrypted database backups are overwritten within 7 days.

Deleting your account also deletes the whole chat with your accountability partner, including the messages your partner sent, for both of you.

A few records stay after deletion, without your name or account. These are reports other users filed about you (the category and the short description they wrote), records of moderator decisions on community posts, anonymised referral records kept for accounting, and records of subscription events from RevenueCat, which are linked only to an account ID that no longer exists and are deleted after 90 days.

Blocker settings and block lists live only on your device. They are removed when you delete the App, and when you delete your account the App clears them from the device on which you are signed in. Because we never receive this information, there is nothing for us to delete on our side.

We may retain limited information after deletion when required to comply with legal obligations (e.g. tax records for subscription transactions), resolve disputes, prevent fraud and abuse, or enforce our agreements. Where retention is required, we store the minimum necessary and apply appropriate access controls.

Aggregated and de-identified information that cannot reasonably be associated with you may be retained indefinitely for analytical purposes.

Your Rights

Depending on your jurisdiction, you have some or all of the following rights regarding your personal information.

• Access. You can request a copy of the personal information we hold about you.
• Rectification. You can request correction of inaccurate or incomplete information. You can update most fields directly in the App.
• Deletion ("right to be forgotten"). You can request that we delete your personal information. The App provides in-app account deletion under Settings → Privacy and data → Delete account. You can also ask us to delete your account by emailing support@hayaa.io from the address you signed up with.
• Portability. You can request your information in a structured, commonly used, machine-readable format. The App provides a data export under Settings → Privacy and data → Request data export. Some records, such as reports others filed about you, are available on request by email.
• Restriction. You can request that we limit how we process your information.
• Objection. You can object to processing based on legitimate interests.
• Withdraw consent. You can withdraw any consent you previously gave. Withdrawing your consent to sensitive information (Settings → Privacy and data → Withdraw consent) deletes your account, which is also the simplest way to withdraw all consents at once.
• Lodge a complaint. If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a privacy regulator, you may lodge a complaint with that regulator.

California residents have additional rights under the CCPA/CPRA, including the right to know the categories and specific pieces of personal information collected, the right to delete personal information, the right to correct inaccurate information, the right to opt out of "sales" or "sharing" (we do neither), and the right to non-discrimination for exercising these rights.

If you live in a US state with a consumer privacy law (for example Connecticut, Washington, or Nevada), you have the rights to access, correct, and delete your data, to get a copy of it, to revoke your consent, and to appeal our decision on any of these requests.

If you live in Washington or Nevada, our separate Consumer Health Data Privacy Policy, available at hayaa.io/health-data-privacy, also applies to you.

To exercise any of these rights, email support@hayaa.io or use the in-app controls described above. We will respond within 30 days (or sooner where required by law). We may verify your identity before fulfilling certain requests.

If we decline your request, you can appeal by replying to our answer with the subject line "Appeal". We answer appeals within 45 days. If we still decline, we will tell you how to contact your state Attorney General.

Blocker permissions. The Blocker only works if you grant it. On Android, that means turning on Hayaa's Accessibility Service and allowing Hayaa to display over other apps, and, if you turn on blocking notifications from blocked apps, allowing notification access. On iOS, it means allowing Screen Time access. You can withdraw any of these at any time in your device settings, which switches that part of the Blocker off. The rest of Hayaa continues to work normally.

Security

We implement technical and organisational measures designed to protect your personal information, including the following.

• Encryption in transit (TLS 1.2+) between the App and our servers and between our servers and third-party processors.
• Encryption at rest for database storage.
• Row-Level Security (RLS) on every database table, ensuring users can only access their own data and the limited information other users choose to share with them, such as community posts and what an accountability partner sees.
• Access controls and audit logging on administrative interfaces.
• Routine application of security updates and dependency upgrades.

No security measure is perfect. In the unlikely event of a data breach affecting your personal information, we will notify you and the relevant regulators as required by applicable law.

Children's & Minors' Privacy

Hayaa is intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. Onboarding asks for your age and does not allow an account for anyone under 18.

If we learn that we have inadvertently collected personal information from a minor under 18, we will delete it promptly. Parents or guardians who believe their child has provided us with personal information may contact support@hayaa.io.

International Data Transfers

Hayaa is operated from North America and uses service providers based in the United States and elsewhere. If you use the App from outside these jurisdictions, your information may be transferred to, stored in, and processed in countries whose data protection laws may differ from those of your country.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK Addendum, to ensure your information receives a level of protection essentially equivalent to that guaranteed by EU/UK law.

Advertising & Tracking

We do not display third-party advertisements in the App.

We do not use cross-site tracking, advertising identifiers (IDFA / GAID), or third-party analytics SDKs that profile users for advertising.

We do not engage in "selling" or "sharing" personal information for cross-context behavioral advertising as those terms are defined under California law.

AI Companion Notice

The AI companion ("Rafiq" / "Rafiqa") is powered by a large language model operated by Anthropic. When you send a message, the following happens.

1. Your message, your 10 most recent messages in the conversation, the mood you chose, and a few profile details (sect, current streak, recovery stage, triggers, and motivation) are sent to Anthropic. Your gender is used only to choose between Rafiq and Rafiqa.
2. The text of your message, and nothing else, is sent to Voyage AI to compute a search embedding used to retrieve relevant verified Islamic content from our database. Voyage AI processes it under its own terms.
3. Your message and the assistant's response are saved in your conversation history within the App's database so you can reference them later.

Anthropic processes these requests under its commercial API terms. Under those terms, your conversations are not used to train Anthropic's models, and Anthropic may retain API inputs and outputs for up to 30 days to monitor for abuse (longer, up to 2 years, only where content is flagged for a trust-and-safety review), after which they are deleted from Anthropic's systems. However, no AI system is perfect, and Rafiq/Rafiqa may occasionally produce inaccurate, incomplete, or inappropriate output despite safeguards. The AI is not a substitute for qualified religious scholarship, medical advice, or mental-health treatment. If you are in crisis or considering self-harm, please contact local emergency services or a qualified professional.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you within the App and update the "Effective date" at the top of this policy. Where required by law, we will obtain your renewed consent.

If a change adds a new use of your sensitive information, we will ask for your consent in the App first. For other changes, continued use of the App after the effective date of an updated policy constitutes acceptance of the updated terms.

Contact Us

If you have questions, comments, or requests regarding this Privacy Policy or our handling of your personal information, please contact us.

Email us at support@hayaa.io

Please use the subject line "Privacy Inquiry".

We aim to respond within 7 business days and, in any event, no later than 30 days from receipt.