Privacy policy

Who we are

Khalad is published by Khalad LTD (“we”, “us”). If you have any question about your privacy, email khalad.global@gmail.com.

What stays on your phone

Most of what Khalad knows about you never leaves your device:

• Location. If you allow it, Khalad uses your approximate location, rounded to about 1 km, to calculate prayer times and the Qibla direction. It is used on your phone only and is never sent to us. You can choose a city instead.
• Your progress. Reading goal, pages and ayahs read, streak, adhkar and surahs completed, tasbih counts.
• Sadaqah. Your monthly goal and the amounts you log. These are never sent anywhere.
• Settings. Calculation method, madhab, reminders, language, text size and theme.

We don't back this up to our servers. Uninstalling Khalad, or clearing its storage, deletes it.

What is sent to our servers

Anonymous usage statistics

To learn which features are used and what to improve, Khalad sends small usage events. This is on by default. Turn it off any time in More → Share anonymous usage, or during setup.

Each event contains: a random ID created on your phone (not linked to your name, email, phone number or Google account), the event name (for example “screen opened”, “adhkar completed”, “setting changed”), a few simple values (for example the reading goal you picked, the text size, which reminder you turned on, or counts rounded into ranges), the app version and the time.

Events never contain your location, your name or contact details, your sadaqah amounts or anything you type.

We keep individual events for 90 days. After that we keep only daily totals, which contain no ID at all.

Ummah goals

When you add your recitation to a shared Ummah goal, the app creates an anonymous account (no email or name) so the count can be added safely and abuse can be limited. We store the count and that anonymous account ID.

Sadaqah Jariyah: ideas and sharing

Ideas. If you send an idea, we store what you wrote, and the first name and city only if you choose to add them, linked to the same kind of anonymous account. Your name is shown publicly (in “Built from everyone’s ideas”) only if you switch on “Show my name if it’s built”, and only after we check it. You can ask us to delete an idea at any time.

Sharing. When you share Khalad, your link carries a random code. We count how many times you shared, how many browsers opened your link, and how many phones installed Khalad from it. When someone installs from a link, Google Play passes the code to the app once. We never see or store who the people are: no names, numbers or contacts. Only you see your own counts.

Dua for parents. If you switch this on, we count the number of times the dua is said, as a total for everyone. Nothing about your parents is asked or stored.

Zakat ledger (optional, only if you create an account)

The Zakat ledger lets you and your family keep one shared record, in the app and on the web. If you create a Zakat account we store:

• Your account: the username and name you choose, and your password (stored only as a one-way hash by our database provider; nobody at Khalad can see it).
• An email for password resets. We use it only to send you 6-digit codes to confirm it or reset your password. It is never shown to anyone, including people in your ledger, and never used for marketing.
• Your ledger: its name, currency, Zakat years, amounts due, the payments you record (amount, date and any note you add), calculator entries, who added each entry, invites, join requests and a log of changes.

Everything in a ledger can be seen only by its members. Anyone in a ledger can add, change or remove its entries and members; deletions and removals can be undone for 30 days, then they're erased. To stop people sending our emails to strangers, we keep a hashed form of the network address used for sign-ups for one day. If you forget your password and can't open your email, a member of your ledger must confirm it's you before we send a code to a new email.

You can delete your Zakat account any time in the app (Deeds › Zakat › settings) or on the web, as explained at khalad-global.vercel.app/zakat#delete-account. Your account details are deleted straight away; ledgers you share stay with the others, with your name removed.

Downloading content

The app downloads hadith, adhkar, reminders and app settings from our database. As with any internet request, the servers that answer see your device's IP address in standard logs.

Services we use

• Supabase hosts our database: content, anonymous usage events, Ummah goal counts and, if you use it, the Zakat ledger and its accounts.
• Brevo sends the Zakat ledger's code emails (only to people who give us an email for that).
• Quran Foundation (Quran.com). The Quran text and translations are downloaded from their service, which sees your IP address when you download a surah.
• Vercel hosts this website. It counts page visits without cookies (Vercel Web Analytics) so we know which pages help people.
• Google Play delivers the app and its updates under Google's own privacy policy. If we offer an optional supporter subscription in future, payment will be handled by Google Play; we never see your card details.

Khalad contains no advertising or tracking SDKs, and it does not use the Android advertising ID. Reminders and prayer times are scheduled on your phone; we don't run push-notification servers.

Children

Khalad is suitable for all ages. The app asks for no name, email or contact details. The optional Zakat ledger, which does ask for an email, is meant for adults managing their family's Zakat.

Your choices and rights

• Turn off usage statistics in More → Share anonymous usage.
• Refuse location access and choose your city instead.
• Turn off notifications in the app or in your phone's settings.
• Delete everything on your phone by uninstalling Khalad or clearing its storage.

Because usage events use a random ID that isn't linked to you, we can't normally tell which events are yours. Depending on where you live, you may have rights to access, correct or delete personal data. Email khalad.global@gmail.com and we'll help however we can.

Security

All connections use HTTPS. Our database only allows the app to read published content and to add anonymous events; the app cannot read anyone's usage data. Zakat ledgers are protected by database rules that let only a ledger's members read it, and one-time codes are stored only as hashes, expire within 15 to 30 minutes and allow 5 tries.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects what is collected, we'll tell you in the app before it applies.