Privacy Policy

1The short version

• Arqaan keeps a record of the worship you log, prayers, dhikr, deeds, lessons and the garden that grows from them, so your progress survives a reinstall and follows you to any device you sign in on.
• We do not sell your data and we do not show ads.
• Your location is used on your phone to work out prayer times and the direction of the qibla. Your coordinates are never uploaded to our servers, and you can pick a city by hand instead.
• You choose whether to appear on leaderboards, with one toggle, and you can delete your account and everything in it from inside the app.

The rest of this page explains each of those in full.

2Who we are, and how to reach us

Arqaan is an Islamic worship-habit app for Android and iPhone, identified on Android as com.hajify.arkaan and on iPhone as com.hajify.arqaan. It is built and run by a small team at Hajify Ltd.

Hajify Ltd, registered in England and Wales (company number 17088501), registered office 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW, is the controller of the personal data described on this page, ICO registration ZC196071.

Write to contact@hajify.com with any question about this policy, to ask for a copy of your data, or to complain about how we have handled it. A person reads that mailbox.

3What we collect, and why

Your account

An account needs an email address and a password, a Google sign-in, or Sign in with Apple. With Google sign-in we receive the email address on that Google account; we never see your Google password. With Sign in with Apple, offered on iPhone, we receive either the email address on your Apple Account or, if you choose Hide My Email, the private relay address Apple creates for Arqaan, which forwards to you without telling us your real one. Apple also passes your full name once, on the very first sign-in and never again, which we use to fill in your display name; we never see your Apple password.

Alongside whichever of those you used we store a display name, an optional handle, a friend code so other people can add you, and a profile photo if you have one. If you signed up with Google, that is the photo on your Google account, which we link to rather than copy. You can also choose a photo, or take one, in the app. It is cropped to a small square on your phone and uploaded to our storage at Supabase, where anyone who has its web address can open it; that is how friends and the weekly board can show it. When you replace or remove it, the app deletes the old one. Sign-in and account recovery are handled by Supabase Auth.

Worship and progress

This is the record the app exists to keep, and it is stored with your account:

• Prayer logs, which of the five prayers you marked, whether it was on time, and the date.
• Deed completions from the daily deeds board.
• Dhikr counts from the tasbih.
• Your garden, which trees are planted and which skins you chose.
• Lesson and gate completion from the learning path.
• Your level, your streak, and your lifetime Noor.
• Which weekly league bracket you are in, and the Noor you earned in the current week.

We use it to draw your garden, your streak and your standing, to keep them consistent across devices, and to restore them if you reinstall.

Which juz of the Qur'an you've finished, and how much of the Hajj checklist you've ticked, are saved to your account so seasonal emails can show them. They are deleted with your account.

Social features, only if you use them

• Your friends list, built from friend codes people exchange.
• Your leaderboard row for the week.
• Reports you send about another member: who reported, who was reported, and the reason you chose. We use these to moderate.

Steps

If you allow physical activity, Arqaan reads your phone's step count and saves each day's total to your account, one figure for each of your phones, together with a random number that identifies the install rather than the phone itself. That is how the step history can show the last eight weeks. We keep each day's total for 12 weeks, then delete it.

Things that stay on your phone

Your chosen city or last known position, your reminder settings, an unfinished tasbih count, and cached lesson and price data are kept in Arqaan's own storage on the device. They are not uploaded, and uninstalling the app removes them.

Diagnostics and reminders

If Arqaan crashes or runs into an error, Firebase Crashlytics sends us a report, the device model, the operating system version and the technical trace of the fault. We read those to fix bugs. For an error, for example while your data syncs, the app also sends our server a short error record, linked to your account: where in the app it happened, the error itself, your phone's platform and the app's version. It never contains what the app was sending, a sign-in token or an email address, and we delete it after 14 days. Firebase Cloud Messaging issues a notification token for your install so reminders can be delivered.

Support messages

When you write to us from Settings, we receive your message, your email address, your app version and your phone's model and system version, and reply from contact@hajify.com.

4Device permissions

The first time you open Arqaan on a phone, before you sign in, it lists the permissions below, and when you tap Continue your phone asks for each one in turn. You can refuse any of them there, or turn them off later in your phone's settings, and you can allow any of them later, where it is needed. The app keeps working without them; the feature that needed one simply says so. The camera and photo library are the exception: they are asked for only when you add a profile photo.

Notifications

Prayer reminders, the daily nudge, and a note if you have been away. Refuse it and Arqaan stays silent.

Location, approximate or precise

Prayer times and the qibla direction. Choosing a city by hand does the same job without the permission.

Physical activity, called Motion & Fitness on iPhone

Counting your steps for the step counter and its daily goal. Each day's total is saved to your account, as section 3 explains.

Microphone, and speech recognition on iPhone

Optional voice input to Hadi, the in-app assistant. Only while you are actually speaking to it.

Alarms & reminders (Android only)

Lets prayer reminders arrive on the minute rather than late. Android shows it as a settings page rather than a question.

Camera and photo library (iPhone)

Only when you take or choose a profile photo, and only the photo you pick is used. On Android, Arqaan uses the phone's own photo picker and camera, which need no permission.

Run at startup (Android only)

Re-schedules your reminders after the phone restarts, so they do not quietly stop. Nothing leaves the device.

5Location, prayer times and qibla

Prayer times and the qibla are calculated on your phone from a latitude and longitude. You can give Arqaan that position in one of two ways: grant the location permission, or pick your city from the list in the app. A coarse position is enough, prayer times shift by about a minute across a city, so you never have to share a precise one.

Either way, that position is saved only in Arqaan's storage on your device. It is not sent to our servers and it is not attached to your account. Turning coordinates into a readable city name uses your operating system's own geocoding service, provided by Google on most Android phones, and by Apple on iPhone.

6Hadi, the in-app assistant

Hadi's replies are written by Groq, an outside AI service. Before your first message, Hadi asks whether you agree to your messages going to Groq, and nothing is sent until you tap Agree and continue. You can withdraw at any time by turning off Send Hadi chats to Groq in Settings → Privacy & security; Hadi then asks again before your next message.

Once you have agreed, each message you send Hadi, and the recent conversation, is passed through our own server function to Groq, which generates the reply. Groq does not receive your name, your email address or anything else from your account. We do not store those conversations on our servers, and Arqaan does not keep the thread on your device after you close it. Please do not type anything into Hadi that you would not want processed by a third party, and remember that it is a study aid, not a source of religious rulings.

If you tap Report this reply, we keep that reply, the message it answered and the reason you choose, linked to your account, so we can see what went wrong. We keep reports until your account is deleted.

If you use the microphone button, your speech is transcribed by your device's own speech recognition service, a Google service on most Android phones, and Apple's speech recognition on iPhone. Either way it is governed by that company's terms rather than ours, and it may transcribe on their servers rather than on the phone. Arqaan receives only the resulting text.

7Who else handles your data

These are the companies and services involved, and what each one does:

Supabase

Authentication, the database that holds your account and your worship record, storage for the profile photos you add, and the API the app talks to. Your rows are stored in an EU region (eu-central-1).

Google Firebase

Crashlytics for crash reports, Cloud Messaging to deliver reminders, and Hosting for this website.

Apple

Sign in with Apple, if you use it: Apple checks who you are and hands us the email address on your Apple Account, or the private relay address if you chose Hide My Email, plus your name on the first sign-in only. Apple also distributes the iPhone app and its test builds.

Groq

Generates Hadi's replies from the messages you send it, once you have agreed to that in Hadi.

RevenueCat

Checks your purchase for us. It receives your account's ID and, from Google Play or the App Store, the record of your purchase, and tells our server whether your account has bought Arqaan. Section 12 says more.

Cloudflare

Turnstile checks that a person, not a bot, is signing in with an email address, creating an account, resetting a password or joining the waitlist on this website. It sees your IP address and information about your device and browser, and uses them only for that check. On Android, Cloudflare also stores the six 3D Hajj and Umrah scenes in its R2 storage, and a Cloudflare Worker sends each one to the app the first time you open it. Like any website, it sees the ordinary request information, including your IP address. Nothing about your account is sent to Cloudflare for either job.

IONOS

IONOS (IONOS SE, Germany) runs our mailbox and sends our emails: account emails such as confirmations and password resets, the waitlist emails, and the seasonal emails described below.

Your device's speech service

Transcribes voice input when you use it, Google's on Android, Apple's on iPhone.

Public content sources

Recitation audio is streamed from everyayah.com and tafsir text is fetched from qul.tarteel.ai when you open those features. Like any website, they see the ordinary request information, including your IP address. Nothing about your account is sent to them.

A public gold and silver price source

The Zakat calculator needs a current nisab. Our server fetches metal prices and exchange rates from public price services and caches them; your device never contacts them, and nothing about you is sent with that request.

Google Fonts

This website loads its typefaces from Google Fonts. The app itself bundles its fonts and does not.

We do not sell your data, and we do not share it with advertisers or data brokers.

8What other people can see

The weekly leaderboard. Arqaan puts you in a bracket with other members each week. While you are visible, the others in your bracket can see your display name, your handle, your profile photo, your level, your streak, the Noor you earned that week and your lifetime Noor. They do not see your email address, your prayer log or your location. Accounts created from 25 September 2026 start hidden: turn Show me on the leaderboard on in Settings or on your Profile to appear, and off again to remove your row from every leaderboard.

Friends. Friend codes are exchanged by you. Someone who has your code can send you a friend request, and so can any member who taps your row on the weekly board while you are on it. Once you have accepted, that friend sees your display name, your profile photo, your friend code, your level, your streak, your lifetime Noor, and how many trees you have planted, lessons you have finished and pillars you have mastered, the figures on your garden card. Not your email address, and not your prayer log.

Reports. If you report another member, we receive the report so we can act on it. If someone reports you, we may look at your account to decide what to do.

9Where your data is stored

Your account, your worship record and the profile photos you add are held by Supabase in an EU region (eu-central-1). If you use Arqaan from outside the EU, your data is transferred there and stored there. Crash reports and notification tokens are processed by Google Firebase, Hadi messages by Groq, purchase records by RevenueCat, the sign-in and waitlist check and the 3D downloads by Cloudflare, and account emails by IONOS, each on its own infrastructure, which may be outside the UK and the EU.

Some of these providers are based in the United States: Google, Groq, RevenueCat, Cloudflare and Apple. Where we transfer personal data out of the UK or the EU, we rely on the standard contractual clauses or another lawful transfer mechanism offered by that provider.

10Keeping, exporting and deleting it

We keep your worship record for as long as your account exists, a streak that quietly expired would defeat the point of it.

Some records are kept for less time: each day's step totals for 12 weeks, and the error records the app sends us for 14 days. A Hadi reply you report is kept until your account is deleted. When you replace or remove your profile photo, the app deletes the old one.

Deleting your account

Open Settings → Account → Delete account in the app. That starts a 30-day grace period. Sign back in during those 30 days and Arqaan offers to keep the account: tap Keep my account and the deletion is cancelled with nothing lost. That tap is the only thing that cancels it, signing in alone does not, and closing that prompt without tapping leaves the deletion scheduled, though Arqaan asks again the next time you sign in. After 30 days a scheduled job permanently deletes your account and every row attached to it, prayer logs, deeds, garden, lessons, friends and leaderboard history. That step cannot be undone.

When you delete your account in the app, your profile photo is deleted straight away, even if you later keep the account. If you signed in with Apple on iPhone, Arqaan also asks Apple to remove it from your Sign in with Apple list.

No longer have the app? You can ask us to delete the account by email instead; Delete your account explains how, and what is kept afterwards.

Uninstalling the app is not the same as deleting the account: it clears what was on the device, but the account remains until you delete it.

Getting a copy of your data

Open Settings → Account → Download my data in the app. Arqaan asks our server for everything it keeps about your account: your profile and progress, your prayer, deed and dhikr logs, your garden, lessons, journey and league history, your step counts, your friends and the people you blocked, the reports you filed, your Hadi reports and usage, error reports from your devices, your push tokens, purchase events from the stores and queued notifications. It writes them to a JSON file and hands it to your phone's share sheet, so you choose where the copy goes. If you would rather we sent it, email contact@hajify.com from the address on the account. You can also ask us to correct anything that is wrong.

Crash reports are kept by Firebase Crashlytics under Google's own retention schedule and are not part of your worship record.

11Children and families

You must be 13 or older to use Arqaan, or older if your country sets a higher age. There is nothing in Arqaan that is unsuitable for a child, but it is not built as a children's app: an account needs an email address, and the social parts, friend codes, leaderboards, the assistant, assume an account holder who understands them.

We do not knowingly collect data from anyone under that age. If you believe a younger child has an account, write to us and we will delete it.

12Security, payments and advertising

Every table in our database is protected by row-level security: the database itself checks that each request belongs to the account making it, so one account cannot read another's rows even if the app asked it to. Traffic between the app and our servers is encrypted in transit, and access to the production database is limited to the people who maintain it.

Arqaan is sold as a one-time in-app purchase through Google Play and the App Store. Google or Apple takes the payment: no card, bank or payment detail of any kind reaches us. Our purchase provider, RevenueCat, tells us whether your account has bought Arqaan, which store it came from and when. We store that, and a short record of each purchase event RevenueCat sends us, such as a purchase, a restore or a refund, with the product, the store and the time.

No part of Arqaan shows advertising, and no advertising or analytics network profiles you through it.

A few times a year, around Ramadan, Hajj, Eid and the new Islamic year, we email you reminders with your own progress in Arqaan: your level, streak, deeds logged, juz read and Hajj checklist. We send them only if you didn't tick the box to opt out when you signed up, or if you turned them on in Settings. Turn them off any time in Settings, or with the link at the foot of every one; you don't need to sign in.

The arqaan.app website is the one place we measure, and it asks first. It uses Google Analytics 4 to see which pages people visit and which links brought them there, but only after you press Allow on the prompt at the foot of the page. Until then nothing from Google loads and no cookie is set. If you allow it, Google sets its analytics cookies and records your visits against a random identifier rather than your name or email, and truncates IP addresses before storing them. Press Analytics in the site footer at any time to change your answer. The app itself carries no analytics.

If you join the waitlist on this website, Hajify Ltd keeps your email address to send you a confirmation, a reminder a week before launch and a launch-day email. The list is held in Google Cloud Firestore in London and copied to a Google Sheet only we can open. Every email has an unsubscribe link, and the list is deleted 12 months after launch.

13Why we are allowed to use your data

Data protection law in the UK and the EU asks us to name a lawful basis for each thing we do with your data. Ours are:

Providing the app you signed up for

Your account and profile, including a photo you add, your synced record and progress, your step history, friends and the weekly league, your purchase, and the emails about your account. Without these Arqaan cannot do its job.

Your consent

Notifications, location, motion, the microphone, the camera and photos, each asked for by your phone and each yours to refuse or turn off later in your phone's settings; sending your messages to Groq, which Hadi asks you about first; and Google Analytics on this website, which loads only after you press Allow.

Our legitimate interests

Keeping Arqaan secure and working, and its community safe: crash reports, error records, the bot check at sign-in, and the reports you send us about other members or about Hadi's replies.

Your worship record

The prayers, dhikr, deeds and lessons you log say something about your religious practice, and data protection law gives information about religious belief extra protection. We use your worship record only with your explicit consent, which you give when you create your account and agree to our Terms, and only to run Arqaan for you as this page describes. You can withdraw that consent at any time by deleting your account.

14Your rights

You can ask us, by writing to contact@hajify.com:

• for a copy of the data we hold about you;
• to correct anything that is wrong;
• to delete your data, as section 10 describes;
• for your data in a machine-readable form, to take elsewhere;
• to stop using your data for something we do on the basis of our legitimate interests, which is your right to object;
• to use your data only in limited ways while a question about it is settled, which is your right to restrict it;
• to withdraw a consent you have given, at any time. That does not affect what we did with it before.

Write from the address on your account so we can find it. We answer within 30 days. We will not charge you, and we will not make the app worse for you because you asked.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint, or to the data protection authority where you live. We would be grateful for the chance to put it right first.

15Changes to this policy

When this policy changes we update this page and change the date at the top. If a change materially affects what we do with your data, we will tell you in the app before it takes effect.