Privacy Policy.

🌐 Deutsch · Français · Türkçe · العربية

This English version is provided for convenience. The German version (Deutsch) is binding; in case of discrepancies, the German version prevails.

This Privacy Policy explains what personal data Hadaff collects when you use the Hadaff app at hadaff.de and the native Android app, why we collect it, who can access it, and how long we keep it. It is written to reflect how Hadaff actually works today, not a general template.

This document describes our data practices. It is not a substitute for individual legal advice about your own rights or circumstances — if you have specific legal questions, please consult a qualified professional or your local data protection authority.

1. Who Is Responsible (Controller)

Mostafa Rashid
Heerstr. 441, 13593 Berlin, Germany
Email: support@hadaff.de

Hadaff is operated by a single developer, not a company with a dedicated legal or data protection department. Requests are handled personally by the contact above.

2. Data We Collect, Why, and On What Legal Basis

For every category of data below we explain: what is collected, why, the legal basis under Art. 6 (and, where relevant, Art. 9) GDPR, and roughly how long it is kept. General retention details are in Section 6; account deletion is covered separately in Section 7.

Religious beliefs and your consent (Art. 9 GDPR). Hadaff is an app for Muslims. Using it at all — your profile, the accounts you follow, your posts and messages, your questions to Hadi — can allow conclusions about your religious beliefs, which are a special category of personal data under Art. 9(1) GDPR. We therefore ask every account once, before the app opens, for explicit consent (Art. 9(2)(a) GDPR) to this processing, including by the service providers in the USA named in Section 4. The switch starts off; you turn it on yourself. We store your decision with the exact wording, its version and the time, so that we can prove it (Art. 7(1) GDPR). You can withdraw this consent at any time; because Hadaff cannot be used without it, withdrawing means deleting your account (Section 7). Processing carried out before the withdrawal remains lawful. The separate consents for the religious trackers (2.5) and for Hadi (2.7) remain in addition to this one.

2.1 Account & Login Data

• What: your user ID (a technical identifier generated by Firebase Authentication), full name, email address, username, registration date, account status (active/disabled), and basic authentication metadata (such as last sign-in time). Your password itself is never seen or stored by us — it is handled entirely by Firebase Authentication. So that emails (for example confirmations, moderation decisions) reach you in your language, we store your device language as a two-letter code.
• At sign-up we also ask for: your date of birth (we store it and the resulting age), how you heard about Hadaff ("How did you hear about us?"), and, voluntarily, your interests. Date of birth and age are used to make sure you are at least 18 (Section 11) and to keep minors out of public features; "how you heard about us" is used only for internal statistics about which channels bring new users; your interests are used to suggest content and features that fit you. Because interests (for example Quran, prayer) can reveal your religion, we only store them after you have given the general consent (2.2); until then they stay on your device. Legal basis: Art. 6(1)(b) GDPR for the age check, Art. 6(1)(f) GDPR (legitimate interest in understanding how people find Hadaff) for how you heard about us, and Art. 9(2)(a) GDPR (your general consent) for your interests. Your interests are optional and you can change them in your profile. Older accounts without a date of birth are asked to add it; until then posting, commenting and messaging are paused.
• Unconfirmed accounts: if you sign up with email and password but do not confirm your email address, we send one reminder after 24 hours and delete the account after 48 hours.
• Why: to create, secure, and let you sign in to your account, and to let other users find and follow you by username.
• Legal basis: Art. 6(1)(b) GDPR — performance of a contract (you cannot use Hadaff without an account).
• Your username is public and visible to other users in search, follow lists, on your profile, and on your public profile page (hadaff.de/friend/<username>). That page shows your display name and username and, for public accounts, your profile picture and bio; for private accounts it shows only the name. It asks search engines not to index it, so it is only reached through a link you or others share. If you don't choose a username, we generate a random one for you; you can change it once every 30 days from Edit Profile. Your email address is not shown to other users.

2.2 Technical & Device Data

• What: which platform you use Hadaff on (Android app or web app), and, where available, the time of your last activity or sign-in.
• Why: to operate the app correctly across platforms, to show you your own account status, and for basic security and stability monitoring.
• Legal basis: Art. 6(1)(b) GDPR (operating the service you signed up for) and Art. 6(1)(f) GDPR — legitimate interest in keeping the service secure, stable, and free of abuse.
• Because this data is stored against your user ID, the platform you use and your last activity can be, and are, associated with your specific account — we do not treat this as anonymous or aggregate data at the point of collection.

2.3 App Usage & Session Data

• What: session records (approximate time spent in the app, number of sessions, last-active date), streaks, and feature-usage counters (for example, how many habits you have or how many messages you've sent the AI assistant today).
• Why: to show you your own streaks and stats inside the app, to keep the app synced and working reliably, to diagnose problems, to enforce fair-use limits (such as daily AI message limits), and to compile internal statistics about overall app usage (e.g. how many people used a feature on a given day).
• Legal basis: Art. 6(1)(b) GDPR for the parts of this data that power a feature you see (your own streak, your own usage counters), and Art. 6(1)(f) GDPR — legitimate interest — for using the same underlying records to compile internal operational statistics.
• Error reports: when something in the app goes wrong (a failed request or a script error), the app sends a short technical report - the error message and technical details, the page, whether it is the web or Android app, how often it happened - linked to your account ID so that we can find and fix the problem. Reports are deleted automatically 30 days after the error last occurred, and with your account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working app).
• Website visitor count: when the website hadaff.de is opened, a counter for that day is increased by one. No cookie is set and nothing is stored on your device; to avoid counting the same visitor again and again, the server keeps the connection's IP address in its working memory for up to 30 minutes and never stores it.
• Speed measurements: in about 5 out of 100 app starts the app measures how fast it loads and reacts (browser timings such as first paint, largest paint, layout shifts and tap response), together with whether you use a phone or a computer, your network type (e.g. "4g"), the number of processor cores and memory class your browser reports, whether it was a first or repeat visit and the app version. At most one measurement per account and day is sent; nothing is stored on your device for it. Measurements are linked to your account ID so that they can be limited to one per day, are only used in aggregated form (daily averages) to find and fix slowness, and are deleted automatically after 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fast, working app). You can object at any time via the contact details in section 13.
• Internal statistics compiled from this data are only used by us as the app operator to understand and improve the service. We do not sell this data, share it with advertisers, or use it to build advertising profiles. Note that because these records are stored per user ID, they are personal data linked to your account, not truly anonymous data, even when we look at them in aggregate for internal reporting.

2.4 Habits

• What: the habits you create (name, icon, color, optional goal) and your daily completion/logging history for each one, used to calculate your habit streaks.
• Why: so you can keep your habits, your progress, and your history in your account, and have them available on any supported device you sign in on.
• Legal basis: Art. 6(1)(b) GDPR — this is a core feature you choose to use.

2.5 Prayer Tracker, Tasbeeh, Khatma & Athkar (Religious Activity Data)

Hadaff includes several optional Islamic practice-tracking features: the Prayer Tracker (daily prayer check-ins and prayer statistics), Tasbeeh (dhikr counter), Khatma (your Quran reading/completion progress and the days you read Quran in the Habits screen), and Athkar (daily remembrance sessions and completion history).

• What: which prayers you marked as completed and when, your Tasbeeh counts, your Quran/Khatma reading progress (including which days you read Quran, on Fridays Surah Al-Kahf), and your Athkar completion history and streaks.
• Why: to let you track your own religious practice over time, calculate related streaks, and sync this data across your devices — purely as a personal tool for you.
• Special category data (Art. 9 GDPR): this data can reveal information about your religious beliefs and practice, and may qualify as a special category of personal data under Art. 9(1) GDPR, which requires a specific legal basis beyond the general grounds in Art. 6. We do not rely on "performance of a contract" alone for this category. The applicable basis is your explicit consent (Art. 9(2)(a) GDPR): the first time you open Prayer Tracker, Tasbeeh, Khatma, or Athkar, we ask you to separately agree before we start saving any data for that specific feature, and you can withdraw this consent for each feature independently at any time from Settings, which also deletes the data already saved for that feature.

2.6 Social Features

• What: your followers and who you follow, pending follow requests, blocks you place or receive, records of who viewed your profile, any custom nicknames you set for people you follow, and reports submitted about accounts or content (including the report reason and the reported/reporting user IDs).
• Why: to provide the follow/social features you use, let you control who can see your activity (e.g. private account settings), and to review reports and enforce our Terms of Service.
• Legal basis: Art. 6(1)(b) GDPR for the follow/profile features themselves, and Art. 6(1)(f) GDPR — legitimate interest — for blocks, reports, and profile-view records, which exist to protect users from abuse and harassment.
• What other users can see: your username, display name, and profile picture (if set), whether your account is public or private, and — depending on your settings — your follower/following lists and activity. What is only visible to you and to us as the operator: your email address, full name (unless you choose to display it), who has viewed your profile, and any blocks or reports involving your account.
• Profile visitors: when you look at someone's profile, its owner can see that you visited, as long as "Profile visitors" is switched on in your own settings. It is off for new accounts until you switch it on. If you switch it off, your visits are not recorded and you do not see your own visitors either. Visits are kept for the period you choose in that setting.
• Online status: by default, only people you follow mutually see a basic online/last-active indicator; you can switch it off completely in Settings. It is only visible to all signed-in users if you choose "Everyone" yourself; accounts that were still on the former default "Everyone" were moved once to "people who follow each other". If you choose "Only certain people", that list is stored separately and only you can read it. Other users cannot fetch online status as a list.
• Private lists are enforced on our servers: if you make your follower or following list private, or your whole account private, our database rules refuse other users' requests for that list — it is not just hidden in the app. Other users can still see the number of followers/following.
• Private accounts: the bio, location and links of a private account are not part of the public profile (and not shown on hadaff.de/friend/…), but kept in a separate area that only the account itself and its followers can read. Media from posts of private accounts can only be fetched by followers; older links are made invalid when the account switches to private. Accounts that are deactivated or have requested deletion no longer appear in the public feed.
• Posts, stories and highlights: the texts, photos and videos you post, with the audience you choose (everyone, followers, friends, close friends or only you), and the likes, replies, reposts and saves on them. Stories are deleted automatically after 12, 24 or 48 hours (as you choose) unless you add them to a highlight on your profile, where they stay until you remove them. Uploaded videos are converted on our servers into a smaller format that starts faster.
• Direct messages: the messages, photos, videos and voice messages you send in chats, stored so that you and the person you write to can read them. Messages stay until you or the other person delete them (or, with disappearing messages switched on, until the time you chose has passed); when someone deletes their account, the messages they sent are deleted. Photos sent in chats are deleted automatically 60 days, videos and voice messages 12 months after they were sent; the message then shows that the file is no longer available. "Delete for everyone" (also for several messages at once) removes the message content, its attached file, the chat preview in the chat list, a pin, quotes of it in replies and starred copies for both people; all that remains is a note that a message was deleted. "Delete for me" only hides it for you; it stays stored for the other person. We do not look through chats; when someone in a chat reports a message, that message is reviewed (see Section 3).
• Reports (DSA): a report concerns a specific piece of content (post, reply, story, chat message) or an account. We store the reason, your explanation, your user ID (without an account: your name – except for reports of child sexual abuse – and your email address, so we can reply, Art. 16(2) DSA), the user ID of the reported person and a copy of the reported content as evidence for the review — for a chat message, that means its text or media link, since we do not otherwise read chats. Reports about a threat to life or safety are flagged to our team immediately; where there is a well-founded suspicion, we inform law enforcement authorities (Art. 18 DSA). We tell the reporting person about our decision by email. The reported person is not told who reported them. Reports are deleted one year after the decision. If the account of the reporting or reported person is deleted, we remove the link to that account (the user ID is replaced by a hash, name and email address are deleted) and delete the report and its copy after 6 months, so that it stays traceable how we handled reports. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16–18 DSA, and Art. 6(1)(f) GDPR.
• Affiliation with organisations: if you link your account to a verified organisation account (for example a mosque), this affiliation and your role are shown publicly on both profiles for as long as both sides agree. We store requests, acceptances and endings with their time; either side can end the link at any time. Legal basis: Art. 6(1)(b) GDPR.
• Athkar lists made together and posted: when you create a custom Athkar list you can invite one person to make it with you; that person then sees the list, your username and display name, and can edit it once they accept. If you post a list, it becomes part of that post and is visible to whoever can see the post (with your name, and the co-author's if you made it together); others can add a copy to their own My Athkar.
• Shared Athkar lists: if you choose to share one of your custom Athkar lists, that list and your display name become readable for signed-in users who open the share link. Lists you don't share stay private. You can stop sharing at any time by deleting the list.
• Public posts and stories on hadaff.de: posts you share with everyone and stories for everyone from a public account are also shown on our website hadaff.de, where visitors can see them without signing in — together with your display name, username, profile picture, the time of posting and the like, comment and repost counts. Comments themselves, your followers and your private data are not shown, and liking, commenting or following requires an account. Never shown: private accounts, posts or stories for followers or close friends only, and accounts whose posts tab is not open to everyone. You can turn this off at any time in Settings → Privacy → "Show on hadaff.de" (or by making your account private); your content then disappears from the website within about 5 minutes, and a post you delete disappears within the same time. The website asks search engines not to show these posts and does not load them for search-engine crawlers. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in showing what Hadaff is about to visitors, in line with the public visibility you chose in the app — with your right to object through that switch.

2.6.1 Verification (Badge)

• What: your full name or the name of the organisation, your reason for applying, a link that shows who you are, the titles you ask for, the number of your followers and posts and the age of your account (determined by our server), and — required for scholars, optional for organisations — a proof document (for example an ijaza, certificate or confirmation letter). Please do not upload an ID card or passport; black out anything we don't need.
• Who sees it: only you and administrators with access to the user area. We store the proof document only as a file path (without a public link); every time it is opened, this is logged.
• How long: the proof file is deleted automatically 30 days after our decision. The application itself (without the file) is kept until your account is deleted, so that the badge can be traced back. The badge is publicly visible.
• Legal basis: Art. 6(1)(b) GDPR (the verification you applied for). Proof as a scholar or for a religious organisation (for example an ijaza or a mosque's certificate) can reveal your religion; for that, the legal basis is your explicit consent, which you give by submitting the application (Art. 9(2)(a) GDPR), and – where you present yourself publicly as a scholar or organisation – Art. 9(2)(e) GDPR. When you apply again, we delete the old proof file immediately.

2.6.2 Protection Against Spam, Scams and Abuse (AI Pre-Check and Risk Score)

• AI pre-check of public content: every new public post (its text, every photo, and the cover and three still frames of a video) and every reply under a public post is checked automatically by OpenAI's moderation service for hate, harassment, violence, sexual content, self-harm and illegal content. Posts of private accounts, posts for followers, friends or close friends only, stories and private messages are not checked. A match is a hint for our moderators: nothing is deleted automatically. Only in clear cases — a photo or video that very likely shows sexual content, content that puts minors at risk, or graphic violence — is the post hidden from everyone except its author until a person has checked it (usually within 24 hours); the author is told by email that an automated system was used and why. A person on our team looks at each match and decides; a hidden post that is fine becomes visible again, and if content is removed, the author gets a statement of reasons and can appeal. The still frames of a video are only sent to OpenAI for this check and are not stored. The match (category and score) is stored for our moderators and deleted with the content or your account.
• AI assistant questions and answers: before your question (and an image) reaches the AI model, it is checked by OpenAI's moderation service; clearly harmful requests (for example sexual content, self-harm) get a fixed reply from Hadi, for self-harm with sources of help. Hadi's answer is checked while it is being written (about every 800 characters), at the end and – if you tap "Stop" – the part shown so far. A clearly harmful answer (for example instructions for self-harm or a call to violence) is replaced in the app by a notice; other questions and answers that are flagged are stored with your account ID and an excerpt (at most 600 characters, without images) for human review and deleted with your account. There is no automatic detection of religious questions in posts.
• Risk score: in addition, to protect users from spam, scams, fake accounts and abuse, Hadaff automatically gives accounts that are active a risk score from 0 to 100, at most every few hours.
• What is used: how old the account is, whether it has a profile picture and bio, how many posts, replies and follows it made today, how many of its texts contain links or are copies of each other, and how often it was reported or blocked. Only when these signals already look suspicious, or the account was reported, the account's latest public posts and replies are checked by AI: OpenAI's moderation service (harassment, hate, violence, sexual content and similar) and, if needed, an OpenAI model that rates spam and scam. Posts visible only to followers or friends, posts of private accounts and private messages are never sent to OpenAI.
• What happens: accounts with a medium or high score get stricter limits on how fast they can post, reply and follow, for 24 hours. Nothing is deleted and no account is suspended automatically — such decisions are always made by a person on our team, who can also lift the limits. If we remove content or deactivate an account, you receive a statement of reasons and can appeal.
• What we store: the score, the reasons and the counts listed above, visible only to our moderators. They are overwritten with each new check and deleted together with your account.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in keeping Hadaff safe and free of spam, scams and abuse (see also Recitals 47 and 49 GDPR). Because texts can reveal religious beliefs, only texts that you have made public yourself are checked by AI (Art. 9(2)(e) GDPR). This is not an automated decision with legal or similarly significant effects within the meaning of Art. 22 GDPR: the temporary hiding of a clear case is always checked by a person, who makes the decision, and you can give us your view at any time. You can object to this processing at any time (Art. 21 GDPR) via the contact details in section 13.

2.6.3 Streak and Streak Together

Your streak counts the days on which you did at least one good deed in Hadaff (finished athkar, a prayer checked, Quran pages read in the Khatma, a habit done). It is calculated from the data of these features, which you already agreed to (2.5), and is visible only to you.

Streak together is optional. You can invite someone you follow or who follows you; the streak starts only when they accept. Both of you then see each other's name, your streak together and whether the other did a good deed today. Which deed stays private, unless you start a goal of the week together: then both see the kind of deed it counts (for example athkar) and on how many days each of you did it.

• Special category data (Art. 9 GDPR): because these deeds are religious acts, this shows the other person something about your religious practice. We therefore only start a streak together after your express consent (Art. 9(2)(a) GDPR), asked before inviting and before accepting and recorded with its wording (2.12).
• Stored: both people, who invited whom, the status, the streak, the best streak, the days of the last week on which each of you did a deed, and the day each of you last sent a reminder; the shared medals, the current goal with the days each of you counted for it and the number of goals reached.
• Reminders: "Remind" sends the other person one push notification a day at most.
• Goal of the week: on the screen of a streak together either of you can start a 7-day goal (for example "Athkar every day"). Both see the goal and each person's progress; the other person gets a new or reached goal as a push notification and in Activity.
• Ending and withdrawal: either of you can end a streak together at any time, and you can withdraw your consent in Settings > Privacy > Consent; the streak together is then deleted for both of you right away.

2.6.4 Showing your streak

Show my streak is optional and off until you switch it on. With your express consent (Art. 9(2)(a) GDPR, recorded with its wording, 2.12) your current streak is shown as a 🔥 badge on your profile picture and in the friends ranking. You choose who sees it in Settings > Privacy > "Who sees my streak": everyone, your followers (the default), friends (you follow each other), people you pick, or nobody; this is enforced on our servers.

• Visible to the people you chose: your name, your profile picture, your current streak and, in the ranking, your place among the people the viewer follows. Which deeds you did stays private.
• Stored: your current and best streak, the last day you did a deed, your forgiven day of the month, name and picture, your visibility choice and the people you picked (collection streakPublic), updated when your streak changes.
• Switching off: in Settings > Privacy > Consent or with "Hide my streak"; the stored numbers are deleted right away and your badge and place in the ranking disappear.

2.7 AI Assistant ("Hadi")

• What Hadaff offers: an AI chat feature ("Hadi") that answers Islamic questions and can read images you send it. It is limited to 30 messages and 3 image uploads per account per day.
• What is processed: the text of your messages, any images you upload, and the last few messages of your conversation history (sent along so Hadi has context), plus whether you rate a response with a thumbs up/down. If you report an answer, we store the answer, your question, your note and your user ID for review by our team (not as a rating of the app); it is deleted once handled, at the latest with your account.
• Where it goes: your message, image, and recent conversation history are sent to OpenAI (a third-party AI provider based in the USA) in real time to generate a response. We do not process this with a local or on-device model — it genuinely leaves our systems and is sent to OpenAI's servers. The text of the conversation is also stored under your account in our database so you can continue it later and view your history. We do not store images: they are only sent to OpenAI to answer; your history shows "📷 Image sent" instead. In incognito mode the conversation is not stored at all, but it is still sent to OpenAI.
• Why: to provide the AI chat feature you choose to use.
• Legal basis: your questions can reveal your religious beliefs (Art. 9(1) GDPR). Hadi therefore only answers after your explicit consent (Art. 9(2)(a) GDPR) together with Art. 6(1)(a) GDPR: before your first question a window explains that your messages go to OpenAI in the USA, and you switch the consent on yourself before you can continue. We store your decision with its wording, version and time. You can withdraw it at any time in Settings → Privacy → Hadi (AI); Hadi then stops answering until you agree again. Withdrawal does not affect answers given before.
• Checking questions and answers: questions and images are checked by OpenAI's moderation service before they are sent, answers while and after they are written (see 2.6.2).
• Incognito mode: a chat in incognito mode is not saved in your Hadaff account, but it is still sent to OpenAI to create the answer, like any other chat.
• Hadi is an automated AI system, not a human being or a certified Islamic scholar — see our Terms of Service for the full disclosure required under Article 50 of the EU AI Act. Please avoid sharing sensitive personal information in the chat. You can delete your AI chat history at any time from within the app without deleting your whole account.

2.8 Support Tickets & Feedback

• What: the category, description, and contact email you provide when you submit a support ticket or report a problem, plus any reply we send you and the ticket's status history.
• Why: to respond to your request and keep a record in case you follow up.
• Reviews on Google Play: if you review Hadaff on Google Play, we fetch the name shown there, the stars, the text and the date through the Google Play Developer API in order to reply in our admin console. We keep this until the review is deleted at Google, at most 12 months. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in replying to reviews).
• Legal basis: Art. 6(1)(b) GDPR (responding to a request you made) and, where a ticket concerns a possible violation of our Terms by someone else, Art. 6(1)(f) GDPR — legitimate interest in investigating and resolving it.

2.9 Location Data

• What: your device's GPS coordinates, only if you grant location permission, used to calculate accurate prayer times and to search for nearby places.
• Why: so prayer times and the Athan (call to prayer) feature match your actual location.
• Legal basis: Art. 6(1)(a) GDPR — your consent, given by granting location permission. You can withdraw it at any time in your device settings or the app's Tools section; you can still set your location manually instead.
• Your coordinates are stored locally on your device (browser/app local storage), not on our servers, and are only transmitted at the moment a prayer-time calculation or place search actually happens — see Section 4 for which external services receive this data. For place names, the app rounds your coordinates to about 1 km and looks them up with OpenStreetMap Nominatim through our own server, so Nominatim sees neither your IP address nor your account. We cache the results for up to 30 days without any link to you.
• If you don't grant GPS permission, we fall back to an approximate, city-level location derived from your IP address via a third-party service (see Section 4). This is less precise than GPS but still involves sending your IP address to that service.

2.10 Data Stored Only On Your Device

• Your theme preference (dark/light/system), your last-used location, and a short-lived cache of recently calculated prayer times are saved only in your browser's or device's local storage. This never reaches our servers on its own — it is only read from your device when a feature that needs it runs.

2.11 Push Notifications

• What: your device's push token and your notification settings. A notification contains a title and text (for example the person's name and the type of event). What someone wrote – messages, comments, mentions, replies to stories – only appears if you switch the preview on. There are also announcements from Hadaff to all users or groups of users (for example new features, important notices), which you can switch off under "Announcements". Delivery goes through Google Firebase Cloud Messaging, so Google processes the content. When you sign out or switch account, we remove this device's push token from the previous account.
• Your choice: in Settings → Notifications you can switch off individual types. Written text only appears in a notification if you switch on "Show message content in notifications" yourself (off by default); otherwise only, for example, "New message" or "commented on your post" is sent and the text does not leave Hadaff. Reminders when you haven't opened Hadaff for a while are only sent if you switch them on yourself (off by default).
• Legal basis: Art. 6(1)(b) GDPR; for reminders and the text preview, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

2.12 Records of Consent, Acceptance and Withdrawal

• What: for every consent (use of Hadaff, Hadi, Prayer Tracker, Tasbeeh, Khatma, Athkar) and every withdrawal: type, wording, version, language, platform and server time; the version of the Terms of Service and of this policy you accepted, with language and server time; and declarations made through the withdrawal function (name, email address, time). When you withdraw a consent, we keep the ended consent as a record.
• How long: as long as your account exists; after the account is deleted, we replace your user ID with a hash value and delete the records after 3 years. We store the wording in the language it was shown to you and the version shown; if you withdraw a consent, we record which wording the withdrawal ends. Withdrawal declarations are deleted after 3 years.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (duty to prove consent) and Art. 6(1)(f) GDPR (defending against claims, limitation period under § 195 of the German Civil Code, BGB).

2.13 Data Export

• With "Download my data" we create a file with all data stored for your account (including moderation decisions, your own reports and reports about you, without the name of the reporting person) and a readable page to go with it. Both are kept in our Firebase storage and can only be reached through a secret link that only you receive; the link works for 24 hours, and the files are deleted automatically at the latest 30 hours after they were created. If a list is longer than 5,000 entries, the file says so; we send you the rest on request. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 15 and 20 GDPR.

2.14 Abuse Protection (Usage Limits)

• To protect login codes, forms (support, reports, withdrawal) and other features from abuse, we count requests per IP address, email address or account. For this we only store a hash made with a secret key (HMAC-SHA-256) of the IP or email address or user ID together with a counter, never the address itself; the entry is deleted automatically one day after the time window ends and removed when the account is deleted. For searching other people we count requests per account (at most 300 per hour), so nobody can pull the whole directory. Legal basis: Art. 6(1)(f) GDPR.
• App Check (if switched on): to protect our interfaces from automated access, we may use Firebase App Check. Google then checks that a request comes from our genuine app — with reCAPTCHA Enterprise in the web app and with the Google Play Integrity API in the Android app; in doing so, Google processes device and browser data as well as your IP address. Legal basis: Art. 6(1)(f) GDPR; details: Google Privacy Policy.

3. Administrator Access

Mostafa Rashid, as the operator of Hadaff, and any other individuals he designates as administrators, can access certain account and usage data through an internal admin dashboard when this is genuinely necessary for:

• Responding to support requests and account issues
• Account management (e.g. disabling an account, sending a password reset)
• Investigating abuse, reports, or Terms of Service violations
• Security monitoring and fraud prevention
• Technical maintenance and troubleshooting
• Operating the service generally

We do not claim that administrators can never access user data — as the operator, we have the technical ability to access data stored in our Firebase project and backend systems where necessary for the purposes above. This is how we actually limit and control that access:

• Roles: every administrator has a role (for example moderation, support, analytics) that determines which areas they can open. This is checked not only in the dashboard but also in our database and storage rules.
• Two-factor login: after the normal login, a security code and a one-time code from an authenticator app (TOTP) are required; the unlock lasts at most 2 hours, only for the sign-in that made it, and ends when the admin signs out. A new authenticator can only be set up right after a fresh sign-in, and we are told about it by email.
• Log: every unlock, every opening of a list through our server (for example users, reports, tickets, error reports, verification applications), every view of an individual account's details, every opening of a verification proof document, every badge granted and every administrative action is recorded in an internal audit log with the admin, action, target account and time, and deleted after 2 years. Single views the dashboard loads directly from the database are not each logged separately; they are protected by role and unlock.
• The dashboard does not show sensitive information (such as Prayer Tracker, Tasbeeh or Khatma data). Other administrators are bound to confidentiality in writing.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating, securing, and supporting the service — balanced against your rights through the access limitations described above.

4. Who We Share Data With

We do not sell your data, and we do not share it with advertisers. The following third-party services process data on our behalf or as part of providing specific features:

5. International Data Transfers

Several of the services listed in Section 4 (Google/Firebase — including our backend functions, which run in the USA —, Resend, OpenAI, Aladhan, ipapi.co, Cloudflare, jsDelivr) may process data on servers located outside the European Economic Area, including in the United States. Where this happens, we rely on the safeguards those providers offer — such as the EU-US Data Privacy Framework, where applicable, or Standard Contractual Clauses approved by the European Commission — to ensure your data continues to receive a level of protection equivalent to the GDPR.

6. Data Retention

• While your account is active, your account, habit, streak, religious-feature, social, AI chat, and support ticket data is kept for as long as your account exists, so these features keep working.
• Automatic deletion for inactivity: if you have not signed in for 11 months, we send a warning email. If you have not signed in for 12 months, your account is automatically deleted following the process described in Section 7.
• Individual periods: error reports 30 days after they last occurred; data exports 24 hours (link) or at most 30 hours (files); verification proof documents 30 days after the decision; reports one year after the decision, and if the reporting or reported account is deleted, 6 months without a link to the account (as a record of moderation); moderation cases and appeals one year; profile visits 90 days; consent and withdrawal records 3 years after account deletion (pseudonymised, see 2.12); photos in chats 60 days, videos and voice messages in chats 12 months; the admins' audit log 2 years; usage-limit counters one day after their time window.
• Backups: our database is backed up automatically; backups are overwritten after at most 28 days. Until then, deleted data may still be contained in a backup, but it is only used from there to restore the service after an outage.
• Manual deletion: if you request deletion yourself, your account is permanently deleted after a 14-day grace period (see Section 7) — signing back in during that window cancels the deletion.

7. Account Deletion

You can request deletion of your account at any time from within the app (Account → Delete Account). Without the app, follow the steps at hadaff.de/delete-account. We want to be precise and honest about what this actually does today, rather than making a blanket promise we can't fully verify:

• Your request starts a 14-day grace period. If you sign back in during this window, the deletion is cancelled and your account is restored exactly as it was.
• Once the grace period ends, we delete: your account profile and authentication credentials, your uploaded profile picture, your AI chat history, your habit and streak data, your Prayer Tracker records, your Tasbeeh counts, your Khatma/Quran progress, your Athkar records, your session and AI-usage statistics, your follow relationships, pending follow requests, block records and profile-view records with other accounts, your social settings, your Athkar settings, your saved preferences, your support tickets, your custom nicknames for people you follow, your posts and their images/videos (including copies on Cloudflare R2), your comments on other people's posts, your notifications, your custom and shared Athkar lists, your like/save/view records and your stored consents. Your username stays reserved for 60 days without any name, bio or picture attached, then becomes available again. The direct messages you sent are deleted, including the photos, videos and voice messages you sent; the other person keeps their own messages and sees the chat as a deleted account.
• Inactive accounts (see Section 6) go through the same deletion process automatically after 12 months of inactivity, without a grace period.
• You can delete only your AI chat history at any time, without deleting your whole account, directly from the chat screen.
• Backups (at most 28 days, see Section 6) and records we are legally required to keep (such as records needed to resolve an open support ticket or investigate a report filed before deletion) may persist for a limited additional time after deletion for legitimate, narrowly defined purposes.

8. Your Rights Under the GDPR

If the GDPR applies to you, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Request erasure of your data / the "right to be forgotten" (Art. 17)
• Request that we restrict processing in certain circumstances (Art. 18)
• Receive a copy of your data in a portable format (Art. 20) — in the app under Settings → Account → "Download my data", or by email
• Object to processing based on our legitimate interest (Art. 21)
• Withdraw any consent you've given at any time, without affecting processing carried out before the withdrawal (Art. 7(3))
• Lodge a complaint with a data protection supervisory authority

To exercise any of these rights, contact us at support@hadaff.de. You can lodge a complaint with the authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (www.datenschutz-berlin.de), or with the authority in your own country of residence within the EU.

9. Data Security

We rely on the security measures built into the infrastructure we use: Firebase Authentication so we never see or store your password, Firestore security rules that restrict which data an app or user can read or write, HTTPS encryption in transit, and encryption at rest as provided by Google Cloud/Firebase infrastructure. Access to the admin dashboard requires, beyond a normal account login, a security code and an authenticator code (TOTP); accesses and administrative actions are logged (see Section 3). Browsers report blocked attempts to run unknown scripts on our pages (a Content Security Policy) to our server; such a report contains only the page address without query strings, the blocked address and the affected script line, no account data. No online service can be guaranteed 100% secure, and we do not claim a level of protection beyond what is described here.

We do not publish, and this policy does not disclose, any internal security keys, credentials, or configuration details.

10. Cookies and Local Storage

The Hadaff web app does not use advertising or tracking cookies, and we do not run third-party analytics or tracking SDKs. The app uses your browser's or device's local storage (not cookies) only for technically necessary purposes on your own device: keeping you signed in (Firebase Authentication stores a sign-in token in IndexedDB), your theme preference, your last-used location, short-lived caches (prayer times, daily content, feed), whether you have already seen notices and consent screens, your online-status setting, your interests until you give the general consent, and, for the session only, the link to your data export. None of this leaves your device unless a feature you use needs to send part of it to one of the services listed in Section 4 (for example, your coordinates to calculate prayer times) – legal basis § 25(2) no. 2 TDDDG. The website hadaff.de (home page, legal texts, forms) does not load the Firebase SDK and stores nothing on your device; visits are counted without storing anything on it. Profile pictures from a Google sign-in are loaded from Google's servers (lh3.googleusercontent.com), so Google learns your IP address when they are shown.

Marketing links: when you arrive through one of our own links on Instagram or TikTok (for example hadaff.de/de/?ref=ig_de), the visit is counted for that link, together with a click on Google Play or a new account created right afterwards. Nothing is stored on your device for this: the link name is only passed on in the address of the next page and, for Google Play, as the install referrer. The server keeps your IP address in its working memory for up to 30 minutes to avoid counting the same visit twice and never stores it.

11. Age Requirement and Children's Privacy

Hadaff requires you to enter your date of birth when creating an account and requires you to be at least 18 years old to sign up. This is a self-declared age check based on the birthdate you enter — we do not independently verify it. Hadaff is not directed at children and is not intended for use by anyone under 18.

If we become aware that we have collected personal data from someone below this minimum age, we will delete that account and data. If you believe this applies to you or someone you are responsible for, please contact us at support@hadaff.de.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the app or legal requirements. We will notify you of significant changes in the app, with a summary and the date from which the new version applies. Where a change requires your consent, we will ask for it again. Earlier versions are at hadaff.de/archiv (German, the binding version).

13. Contact

Mostafa Rashid
Heerstr. 441, 13593 Berlin, Germany
Email: support@hadaff.de