Privacy Policy

Riwaayah is operated by Samiul Islam, trading as Riwaayah (“we”, “our”, “us”). We are the data controller responsible for your personal data under UK GDPR.

Contact: hello@riwaayah.uk

We collect only what is necessary to provide the service:

• Account data — email address, display name, and profile photo (provided via Google or Apple sign-in, or entered directly)
• Study progress — which hadith you have studied, memorised, or reviewed; your streak; your SRS review schedule
• Saved words — hadith and vocabulary items you have bookmarked
• Settings — your language preference, harakaat toggle, and display settings
• Usage analytics — pages visited, features used, session duration (anonymised where possible)
• Error reports — technical error data to help us fix bugs (no personally identifiable information is intentionally included)

We do not collect payment card details. If you make a voluntary contribution via Monzo.me, that transaction is handled entirely by Monzo and is subject to their privacy policy.

• Contract — processing your account data and study progress is necessary to provide the service you signed up for (UK GDPR Article 6(1)(b))
• Legitimate interests — usage analytics and error tracking help us improve the app; we balance this against your privacy rights (UK GDPR Article 6(1)(f))
• Consent — where we request any optional data, we obtain your explicit consent first

We use the following third-party processors. Each is bound by a data processing agreement:

• Supabase (supabase.com) — database and authentication. Data stored in EU-West region (Ireland)
• Vercel (vercel.com) — hosting and deployment. Servers in EU region
• PostHog (posthog.com) — product analytics. Data stored in EU region (eu.i.posthog.com)
• Sentry (sentry.io) — error monitoring. Error reports may contain device/browser information
• Resend (resend.com) — transactional email (e.g. magic link sign-in)

We do not sell your data. We do not share your data with advertisers or data brokers.

• Your account and study data is retained for as long as your account is active
• If you delete your account, all personal data is permanently deleted within 30 days
• Anonymised, aggregated analytics data (with no link to your identity) may be retained indefinitely

You have the following rights, which you can exercise by emailing hello@riwaayah.uk:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data ("right to be forgotten")
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — ask us to pause processing of your data

You can also delete your account directly from the app (Profile → Delete Account). This triggers immediate soft-deletion and permanent removal within 30 days.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Riwaayah is a Progressive Web App. We use browser local storage (not cookies) to store your session token, UI preferences, and word notes. This data never leaves your device unless you are signed in, in which case your progress is synced to our servers.

We do not use advertising cookies or third-party tracking cookies. PostHog may set a first-party analytics cookie; you can opt out by contacting us.

Riwaayah is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this policy from time to time. We will notify you of significant changes via the app. The “last updated” date at the top of this page always reflects the most recent version.

For any privacy-related questions or to exercise your rights: hello@riwaayah.uk