FirdausPrivacy Policy
Last updated 13 November 2026. Applies to the Firdaus app (iPhone) and the firdaus.life website.
In short
- Prayer check photos, your cycle calendar and your coordinates never leave your phone.
- Our server holds what your loved ones need to see you: profile, prayer marks, posts, messages.
- We don’t sell data, show ads or track you across other apps.
- You delete your account in the app: Settings → “Delete account”. Your data and files go with it.
- 1. Who is responsible
- 2. What stays on your phone
- 3. What is stored on the server
- 4. Why we need it
- 5. Who else receives data
- 6. What other people see
- 7. How long we keep it
- 8. Deleting your account
- 9. Your rights
- 10. Children
- 11. How we protect data
- 12. Changes
- 13. Contact
1. Who is responsible
The data controller is the developer of Firdaus, an individual based in Kazakhstan. The name is shown as “Seller” on the Firdaus page in the App Store. You can reach us on Telegram at @firdaus_support or by email at support@firdaus.life.
2. What stays on your phone
We never receive any of this — not on the server, not in analytics, not in crash reports.
- Prayer check photos. When you confirm a prayer with the camera, the frame is analysed on your phone and is not saved. Only the mark “verified” leaves the device.
- Coordinates. Location is used to calculate prayer times and the qibla direction. Your phone does the maths. Neither coordinates nor your city are sent to our server. You can decline location access and pick a city from the list.
- Cycle calendar. Stored only on your phone. Loved ones can see neither the calendar nor the fact that you keep one.
- The list of apps for Focus. You choose them in Apple’s system picker. iPhone does not tell us which apps you chose.
- Settings and drafts. Calculation method, madhhab, theme, unfinished posts and messages.
- Using Firdaus without an account. Until you sign in, everything you do — marks, streak, settings — lives only on your phone.
Two caveats about location, to be straight with you:
- To name your city, your phone may ask Apple’s geocoding service. That is done by iOS, not by our server.
- If “Official timetable” is on, your phone downloads the prayer timetable for the nearest city from the servers that publish the timetables of official religious authorities (the Muslim boards of Kazakhstan and Tatarstan, Türkiye’s Directorate of Religious Affairs). The request names a city from our list, not your exact position. Like any website, that server sees your phone’s IP address.
3. What is stored on the server
This reaches the server only once you have signed in.
| What | Why | Details |
|---|---|---|
| Account | So you can sign in from any phone | Sign in with Apple or Google. We receive an account identifier and an email address (Apple may give a private relay address). We never see or store a password. |
| Profile | So loved ones recognise you | Username, name, avatar or photo, gender (it decides the app’s wording — “brother” or “sister” — and access to the cycle calendar), last seen time, privacy settings. |
| Prayer marks | Streak, calendar, “together”, the shared picture for loved ones | The day, which prayer, on time or not, verified or not. Your streak and weekly totals. |
| Loved ones and circles | So reminders and “together” work | Who your loved ones are, requests, circles, invitations, follows, people you have hidden or blocked. |
| Cards and invitations | So they arrive | Whom you sent a card or a “together” invitation to and for which prayer, and the prayer time you agreed on. |
| Messages | So your chats are on all your devices | Text, photos and voice messages in chats, reactions, read marks. Messages are stored on the server and are not end-to-end encrypted. |
| Posts in Umma | So others can see them | Text, photos, stories, replies, polls, likes, bookmarks, views. |
| Instants | So your photo reaches your loved ones | The photo you sent to loved ones after a prayer, whom it went to and who viewed it. Your photos stay in your archive until you delete them. |
| Dhikr | The shared count | How many times you said a dhikr today and which one — the number goes into the shared count. |
| Subscription and gifts | To turn on Firdaus Plus or Premium | Whether you have a subscription and until when, the gifts in “Gifts” and when you turned them on, the codes you entered or bought, and whose creator or friend code brought you to Firdaus. We never see card details: Apple handles the payment. |
| “If you can’t pay” letter | To choose whom to give a subscription to | Your story and your wish, if you wrote them. Only the Firdaus team reads it, and the letter is never published. It is deleted with your account or when you ask. |
| Notifications | To send push notifications | Your device’s notification address (token) and a technical delivery log. If “Show message text” is on, a notification about a personal message shows its first words; turn it off and you see only the name and “New message”. |
| Reports | To look into them | What you reported and why; reports about you. |
4. Why we need it
- To make the app work — sign-in, loved ones, cards, chat, Umma, subscription. Without this data those features don’t exist.
- To keep Umma clean — an automated check of posts, photos, Instants, names and avatars before they are published (done by OpenAI, only with your consent in the app) and handling reports.
- To fix what breaks — crash reports.
- To understand what works — de-identified events: opened the app, finished onboarding, marked a first prayer, added a loved one.
You grant access to the camera, microphone, photos, location, notifications and Screen Time yourself in iPhone’s system prompts, and you can take it back at any time in your phone’s settings. The camera runs only on the prayer check screen and when you take a photo for a post; the microphone only while you hold the voice message button.
We don’t use data for advertising, don’t build an advertising profile of you and don’t sell data to anyone.
5. Who else receives data
Firdaus runs on services from other companies. Each one receives only what its part of the job needs.
| Who | What it does | What it receives |
|---|---|---|
| Supabase | Cloud: database, files, sign-in | Everything in section 3. Files sit in private storage and cannot be opened by a direct link. |
| Apple | Sign-in, payments, push delivery, Screen Time | What is needed for Sign in with Apple, for a purchase and to deliver a notification. Payment details stay with Apple. |
| Sign in with Google | What is needed to sign in, if you choose this method. | |
| RevenueCat | Subscription records | A de-identified account identifier and purchase information from Apple. |
| Expo | Delivery of push notifications and app updates | Your device’s notification address and the notification text (the first words of a message only if “Show message text” is on). |
| OpenAI | Processor for the automated check for prohibited content (moderation) | Text and photos of posts, replies and stories, Instants, your own profile and cover photos, your name and bio — before publishing and only for the check. Nothing is sent without your consent in the app (Umma rules, the name step, editing your profile): until then it stays “being checked” and others can’t see it. Private messages are not sent there. |
| PostHog | Usage statistics, servers in the EU | The events from section 4, an account identifier, phone model and iOS version. Location by IP is switched off. Never: coordinates, city, prayer times, cycle calendar. |
| Sentry | Crash reports | What broke and where in the code, phone model, iOS and app version. No name, email or content of your posts. |
| LiveKit | Live audio for “Stage” and calls, once they arrive | The audio and video of a conversation while it is happening, and an account identifier to connect the people talking. Conversations are not recorded or stored. |
Firdaus partners (creators whose code you entered) never receive your name, your messages or your prayer marks from us. We only tell them how many people came with their code and how many payments there were, so we can calculate their share.
These companies’ servers may be located outside your country, including in the EU and the USA.
We may disclose data when a court or public authority lawfully requires it — and only as much as we must.
6. What other people see
- Everyone on Firdaus: your username, name, avatar and the posts you published to “Everyone”.
- Loved ones and your circle: whether you have prayed the current prayer, your streak and missed prayers — unless you hid them in privacy settings; when you were last online.
- The person you chat with: the messages you sent them.
- No one: your cycle calendar, prayer check photos, your coordinates.
The app does not fill in a city on your profile and does not show one to others.
7. How long we keep it
- Your account and everything tied to it — until you delete the account.
- Stories — 24 hours, then deleted together with their files. Highlights pinned to your profile stay until you remove them.
- Deleted messages, photos and voice messages — files are erased from the server within a few hours.
- Database backups — overwritten within 30 days at most.
- Crash reports — up to 90 days.
- Usage events — up to 12 months.
- Reports and decisions on them — for as long as needed to resolve them and keep offenders out.
- Purchase records — for as long as accounting and tax law requires.
8. Deleting your account
In the app: Settings → “Delete account”. Deletion is permanent. It erases your profile, prayer marks, loved ones and circles, posts, replies, stories, messages and files — avatar, photos, voice messages. If you signed in with Apple, we revoke Firdaus’s access to your Apple ID.
Deleting your account does not cancel a subscription — that is done in your Apple ID settings (see the Terms).
Can’t get into the app? Write to support and we will delete the account on request.
9. Your rights
You can:
- find out what data we hold about you and get a copy;
- correct your data — most of it right in the app;
- delete your account and data;
- object to processing or ask us to restrict it;
- withdraw permissions in iPhone settings.
Write to @firdaus_support or support@firdaus.life — we reply within 30 days. If you believe we have violated your rights, you may contact the data protection authority in your country.
10. Children
Firdaus is not intended for children under 13. If the law in your country sets a higher age for consenting to data processing on your own (up to 16 in EU countries), that age applies. We do not knowingly collect children’s data. If you are a parent and see that your child has created an account, write to us and we will delete it.
11. How we protect data
- The connection to the server is encrypted.
- Every table in the database is locked down by access rules: a person sees only their own data and what others have opened to them.
- Files are kept in private storage.
- Sign-in keys are kept in iPhone’s secure storage.
No protection is absolute. If a breach ever affects you, we will tell you.
12. Changes
When this policy changes, we update the date at the top of the page. We will warn you in the app ahead of any significant change.
13. Contact
Telegram: @firdaus_support
Email: support@firdaus.life