Saff · family salah tracker
Privacy Policy
This is written from what the app actually does. If the app changes, this changes with it — a privacy policy that has drifted from the code is worse than none, because it is a promise we are no longer keeping.
The short version
Saff stores your name, your prayer log, and who is in your family circle. Prayer times are calculated on your device; your coordinates are also stored so the server can tell whether a prayer was on time. We never keep a history of where you have been, we do not sell anything to anyone, and there are no ads.
What we collect
Your name. You give it during setup. Family circles need real names — that is the whole point of them — so this is shown to the people you share a circle with.
Your prayer log. For each of the five daily prayers: the date, which prayer, and whether it was prayed on time, prayed late, made up later, or marked as excused. Also when you recorded it.
Your qaza estimate. The number produced by the setup questions, and each adjustment to it as you pay it down.
Your settings. Time zone, calculation method, and madhab.
Your circles. Which circles you belong to, who else is in them, and the nudges sent between members.
Your approximate coordinates. Latitude and longitude, so the server can calculate the same prayer times your phone does and decide correctly whether a prayer was on time. This is a location, not a location history: we store the current one and overwrite it when it changes. We never store a trail of where you have been.
What we do not collect
- No location history, movement tracking, or background location.
- No contacts, photos, microphone, or health data.
- No advertising identifiers. There are no ads in Saff and there never will be — an ad network serving inappropriate content inside a prayer app is not a risk we are willing to take.
- No payment details. Subscriptions are handled by Apple; we only ever learn whether you have an active one.
How location is used
When you allow location access, the app computes prayer times on your device using an offline astronomical calculation. Nothing about your location is transmitted for that.
Your coordinates are sent to us once, and updated when they change, for one reason: the server has to be able to tell whether a prayer was inside its window. That decision has to happen on the server, or a changed device clock could manufacture a streak.
You can decline location access and enter a city instead.
What your family can see
People in your circle see, for each day, only whether it was complete, saved, excused, or incomplete — and your current streak.
They cannot see whether a prayer was on time or late. They cannot see why a day was excused: menstruation, travel and illness are stored the same way and displayed identically, and there is no way to tell them apart. On a day you mark as excused, no streak number is shown for you at all — a number that visibly stopped moving would give away exactly what the neutral marker is there to protect.
Circle members can send you a nudge, limited to one per person per day.
Who we share it with
Nobody, with three narrow exceptions, none of which receive your prayer log:
- Our hosting and database provider, which stores the data on our behalf.
- Apple, which handles subscriptions and sign-in. We never see your card.
- Our analytics provider, which receives anonymous product events — that a quiz was completed, that a paywall was seen. Never your prayer log, your name, or your location.
We do not sell your data. We will not share it with advertisers. If we are ever required to disclose something by law, we will tell you unless we are legally prohibited from doing so.
How long we keep it
For as long as your account exists.
You can delete your account from inside the app, under You. Deletion is immediate and total: your prayer log, your qaza ledger, your circle memberships and any circles you created are removed. There is no grace period and no soft delete — an account marked “deleted” that still holds your prayer history is not what you asked for.
Backups are retained for up to 30 days before being overwritten.
Children
Saff is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send you a copy. Email us and we will do it within 30 days. Deleting your account in the app does the same thing immediately.
If you are in the EEA or UK: our legal basis is performing the contract you entered into by using Saff, and our legitimate interest in keeping it working and secure.
If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising any right above.
Security
Data is encrypted in transit. Your session credential is held in your device’s keychain. Access to the production database is limited to people who need it.
No system is perfect. If you find a vulnerability, please tell us at the address below before telling anyone else, and we will credit you.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect.
Contact
Written to, and answered by, a person.