Privacy policy

Who is responsible for your data?

Faraz Malik, operating Hira, is the data controller. This means he decides why and how Hira uses personal data. Highland Code operates the service as a processor on his instructions.

Contact the controller about privacy at hello@highlandcode.com. Please write “Hira privacy” in the subject line.

What we use and our lawful bases

• Account and security information: your Hira ID, name, email, avatar, sign-in identity, password hashes, sessions, IP address and user-agent. We use this to create and secure your account, verify email, reset passwords and prevent abuse. The bases are performance of our contract with you and our legitimate interests in keeping Hira safe.
• Profile and personalisation: age band, gender, goals, wake time, timezone, wellbeing levels, reminder choices and coarse location or chosen city. We use these to personalise Hira, calculate prayer times and schedule features you request. The basis is performance of our contract. Location and notifications also depend on your device permission and can be switched off.
• Religious information: beliefs, prayer calculation method and madhab, prayer records, Quran position, milestones and notes, Adhkar sessions, spiritual goals, streaks and achievements. This reveals religious belief and is special-category data under UK GDPR Article 9. We use it only for the spiritual-wellbeing features you choose. Our Article 6 basis is consent and our special-category condition is your explicit consent under Article 9(2)(a).
• Wellbeing and physical records: mood check-ins and notes, mindfulness activity, reflections and journal answers, meals and nutrition, water, daily step totals, workouts and targets. We use these to provide your logs, summaries and progress. The basis is performance of our contract; where an entry reveals health information, we also rely on explicit consent under Article 9(2)(a).
• Community information: posts, comments, photos, videos, likes, event responses, challenge progress, reports and blocks. We use it to provide the community and its safety controls. The bases are performance of our contract and our legitimate interests in moderation, fraud prevention and protecting users. If you choose to include special-category information, explicit consent applies.
• Device and notification information: push token, platform, device model, operating-system/app version, locale, notification preferences and delivery receipts. We use it to send and troubleshoot notifications you enable. The bases are performance of our contract and your consent to receive push notifications.
• Purchases: store platform, product and transaction ID, trial/subscription status, renewal/expiry and verified store messages. We use it to verify access, restore purchases and process renewals, cancellations and refunds. While your account exists, the bases are performance of our contract and our legal obligations for financial and store records. If you delete your account, we remove the personal account link and retain only a payments record with no user ID, email, name or device identifier. That limited record is kept under our legal obligation basis (UK GDPR Article 6(1)(c)) and the erasure exception in Article 17(3)(b).
• Usage analytics: screen/event name, time on screen, device type, country, acquisition source, app version and a random analytics ID. We use this to understand aggregate feature use and improve Hira. The basis is our legitimate interest in improving the service. We do not use it for advertising or cross-app tracking, and you may object at any time.
• Rights, audit and operational records: export/deletion request status, hashed confirmation details and administrator action logs. We use these to fulfil legal rights, prove security-sensitive actions and meet legal obligations. The bases are legal obligation and our legitimate interests in accountability and security.
• Launch list: the email address you enter in the sign-up box on hira-app.com, and when you entered it. We use it only to tell you about Hira’s launch. The basis is your consent, which you can withdraw at any time by asking us to remove you or using the unsubscribe link in any launch email.

AI food scans

Hira asks for separate, explicit consent before a meal photo is sent to the AI provider named in the consent notice. The current provider is Cloudflare Workers AI; an Anthropic API fallback may be enabled only after the disclosure is updated. The provider receives the chosen image and the analysis prompt and returns a nutrition estimate. Hira stores the scan image and result for no more than 30 days. Estimates may be inaccurate and are not medical advice.

You can refuse and log a meal manually. If you withdraw AI consent, Hira records the withdrawal and blocks future food scans unless you consent again.

Who receives personal data?

We use only the providers needed to run the service:

• Highland Code operates and supports Hira in the UK as a processor.
• Cloudflare provides the Worker/API, D1 database, R2 media/export storage, KV, Analytics Engine and security logging.
• Cloudflare Turnstile checks administrator login and public deletion forms for bots using network/browser signals.
• Cloudflare Workers AI analyses consented meal photos; Anthropic is the configured fallback.
• Cloudflare Stream stores, transcodes and delivers administrator and community video.
• Resend sends verification, password-reset, deletion and export emails.
• Expo Push Service receives the push token and notification payload, then passes it to Apple Push Notification service or Google Firebase Cloud Messaging.
• Apple and Google provide sign-in, store billing, subscription lifecycle and platform push delivery under their own terms.
• Backblaze B2 is the planned encrypted backup mirror. It will not receive production data until the controller approves the separate processor and EU region.
• Open Food Facts receives a product barcode for a lookup, without your Hira ID or your device IP address.

We may also disclose information where law requires it, or to establish, exercise or defend legal claims. We do not sell personal data or disclose it to advertisers or data brokers.

International transfers

Hira's D1 database and current R2 buckets use EU jurisdictional restrictions. Other services may process outside the UK and EU. Cloudflare Workers AI and Stream are global services and are not covered by Cloudflare Regional Services; Turnstile and Analytics Engine also have separate location controls. Resend, Expo, Apple, Google and Anthropic may process in the United States or other countries.

For restricted transfers we require an applicable adequacy mechanism or contractual safeguards, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We assess the transfer and any additional security measures before enabling a provider. You may ask for more information by contacting us.

How long we keep data

• Account, profile, worship, wellbeing, physical and current community records remain while your account or content is active. Account deletion erases current personal records and media immediately; individual deleted media may remain in protected trash for up to 90 days.
• AI food-scan images and scan records are deleted after 30 days.
• Usage analytics remain for three months (about 90 days). After account deletion the random identifier can no longer be linked back to you.
• Completed notification jobs remain for 30 days and delivery logs for 90 days. Expired session records remain for up to 30 days after expiry.
• Unattached video uploads are deleted after 24 hours. Soft-deleted media is deleted after 90 days.
• Generated data exports expire after 7 days.
• Launch-list emails are kept until you unsubscribe or until we stop sending launch news, whichever comes first.
• Completed web deletion-confirmation records remain for 30 days; email and token values are stored as hashes.
• Cloudflare Worker invocation/application logs remain for up to 7 days.
• After account deletion, a payments-only record containing no personal identifiers remains for store reconciliation and legal/accounting obligations. It is deleted once its subscription expiry is more than seven years old. Later verified renewals, cancellations and refunds update that record without recreating an account link.
• Administrator audit records and deletion tombstones currently have no automated time expiry. Any temporary purge or Apple-revocation retry secret on a tombstone is cleared when the retry succeeds.
• The planned backup service keeps 30 daily database copies and 12 monthly copies. Deletion tombstones make a restored backup re-erase deleted accounts before service. Planned Backblaze media mirrors age out within 90 days of source deletion.

Consent and analytics choices

You may withdraw consent for religious/wellbeing processing or AI food scans at any time through the available account privacy controls or by contacting us. You may switch off location and notification permission in your device settings. Withdrawal does not affect processing that was lawful before it, but we will stop the consent-based processing and remove data unless another legal reason requires us to keep it.

You may object to usage analytics at any time through the privacy control or by contacting us. Once opted out, Hira does not write new Analytics Engine events. You can later opt back in.

Your data-protection rights

Depending on the circumstances, UK data-protection law gives you the right to:

• be informed about how your personal data is used;
• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• ask us to erase your data;
• ask us to restrict how data is used;
• receive data you provided in a portable, machine-readable form;
• object to processing based on legitimate interests, including analytics;
• withdraw consent at any time; and
• ask for human review where a solely automated decision has legal or similarly significant effects. Hira does not currently make such decisions.

You can export or delete your data in the app. If you no longer have the app, use the public account deletion page. We may need to verify your identity before completing another rights request. Deleting Hira does not cancel an App Store or Google Play subscription; cancel it in the relevant store.

Contact and complaints

Send privacy questions or rights requests to hello@highlandcode.com. We hope to resolve concerns directly. You also have the right to complain to the UK Information Commissioner's Office through its complaint service.