Privacy Policy
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Safa and its related services (collectively, the "Service").
By using Safa, you agree to the collection and use of information in accordance with this policy.
1. About Safa
Safa is developed and operated by Khalid Hadadi ("Kai"), an independent developer. This app is built by one person — there is no company behind it.
This policy applies to all users of the Safa mobile application and is written in compliance with:
- Saudi Arabia's Personal Data Protection Law (PDPL), Royal Decree No. M/19 (2021), amended by M/148 (2023)
- The EU / UK General Data Protection Regulation (GDPR)
- The California Consumer Privacy Act (CCPA / CPRA)
- Apple App Store privacy requirements
2. Information We Collect
Safa collects only what is necessary to provide the Service. Below is a full breakdown of what we collect and why.
2.1 Information You Provide Directly
| Data | When | Purpose | Legal Basis (PDPL) | Legal Basis (GDPR) |
|---|---|---|---|---|
| Name | Auto-synced from iCloud — onboarding | Personalise experience; display in app UI | Consent (Art. 5) | Consent (Art. 6(1)(a)) |
| Email address | Optional — when sending feedback | Reply to your feedback (opt-in only) | Consent (Art. 5) | Consent (Art. 6(1)(a)) |
| Profile photo | Optional — onboarding | Display in app UI — stored on device only, never transmitted | Consent (Art. 5) | Consent (Art. 6(1)(a)) |
Your name is pulled from iCloud automatically so onboarding feels effortless. Your profile photo never leaves your device. We will only ask for your email if you choose to send feedback — it is never required to use the app.
2.2 Information Collected Automatically
| Data | Purpose | Legal Basis (PDPL) | Legal Basis (GDPR) |
|---|---|---|---|
| Device identifier | Subscription management; product analytics | Contractual necessity / Legitimate interest | Contract (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f)) |
| Product interaction | Understand feature usage; improve the App | Legitimate interest | Legitimate interests (Art. 6(1)(f)) |
| Crash & diagnostic data | Identify and fix bugs; ensure stability | Legitimate interest | Legitimate interests (Art. 6(1)(f)) |
| Purchase history | Verify and manage your subscription | Contractual necessity | Contract (Art. 6(1)(b)) |
2.3 Information We Do Not Collect
- Your location
- Your microphone
- Your camera — except optionally, when you choose to upload a profile photo
- Your browsing or search history
- Your health data — Safa only writes Mindful Minutes to Apple Health (opt-in). It never reads your health records
- Your app usage — Screen Time is only used to block apps during focus sessions (opt-in). No app usage data is read or transmitted
- Anything sensitive — religious beliefs, biometric data, financial records, etc.
- Your payment details — Apple handles all payments; we never see your card or billing information
3. Apple Privacy Disclosure
Apple requires all developers to disclose what data leaves your device. Nothing below is used to track you across other apps or websites, and we do not use advertising identifiers.
| Apple Category | Data Type | Linked to You | Used for Tracking | Purpose |
|---|---|---|---|---|
| Contact Info | Name, Email | Yes | No | Developer marketing (opt-in only) |
| Identifiers | Device ID | No | No | App functionality, analytics |
| Purchases | Purchase history | Yes | No | Subscription management |
| Usage Data | Product interaction | No | No | Analytics |
| Diagnostics | Crash data | No | No | Bug fixing |
Everything else — your profile photo, focus sessions, templates, achievements, app settings, Health data, calendar events, and Screen Time selections — stays on your device and is never transmitted.
4. Third-Party Services
We use a small number of trusted third-party services to operate the app. Each service receives only the data it strictly needs to perform its function.
| Service | Role | Data Shared | Location |
|---|---|---|---|
| RevenueCat | Subscription management | Device ID, purchase tokens | United States |
| PostHog | Product analytics | Device ID, usage events (no PII) | United States |
| Loops | Email updates (opt-in only) | Email address, first name | United States |
| UserJot | In-app feedback | Text of feedback you voluntarily submit | United States |
| Cloudflare | Push notification delivery (Apple Push Notifications) | Device push token, notification payload (no personal content) | Global edge network (US-based) |
About push notifications: Safa uses Cloudflare Workers as a relay to send notifications through Apple's Push Notification service (APNs). When you enable notifications, your device generates an anonymous push token that is forwarded through Cloudflare to Apple. Cloudflare does not receive your name, email, or any focus session content — only the token and the short message body needed to deliver the notification.
These third-party services are subject to their own terms and privacy policies. We are not responsible for their practices beyond what is described here.
5. Where Your Data Goes
Some of the services we use — such as analytics and subscription management — are operated in the United States. When data crosses borders, it is sent only to services we have vetted and trust to handle it responsibly.
6. Optional Integrations
All integrations below are entirely optional. Safa works fully without any of them. You can enable them at any time from within the app.
- Apple Health — Completed focus sessions are logged as Mindful Minutes. We write to HealthKit only — we never read your health data, and no health data is transmitted to us or any third party.
- Calendar — Completed sessions are added as events to your calendar. We write only. No calendar data is read or transmitted off your device.
- Screen Time / App Blocking — Your selected apps are blocked during focus sessions. Your blocked apps list stays on your device and is never transmitted to us or any third party.
- iCloud Sync — Timer settings are synced across your devices via your personal iCloud account. This data goes to your iCloud — not our servers.
7. Data Retention
We retain your data only for as long as necessary for the purpose it was collected.
| Data | Retention Period |
|---|---|
| Email / name (Loops) | Until you unsubscribe or request deletion |
| Usage events (PostHog) | Up to 1 year per PostHog's policy |
| Purchase records (RevenueCat) | Duration of subscription + as required by Apple |
| On-device data (sessions, settings, templates) | Until you delete the App |
8. Security
We implement appropriate technical and organizational measures to protect your information:
- All data transmitted over the internet is encrypted
- We only work with third-party services that maintain strong security practices
- Each service is granted access only to the data it requires
- We regularly review data flows to keep them minimal and secure
No system is completely secure. In the event of a data breach that could affect you, we will notify the relevant authority within 72 hours and contact you directly if required.
9. Your Rights
You have the following rights regarding your personal data:
All Users
| Right | What It Means | How to Exercise |
|---|---|---|
| Right to be informed | Know what data we hold and why | Read this policy; email us |
| Right of access | Receive a copy of your data in a clear, readable format, free of charge | Email khalid.support@gmail.com |
| Right to correction | Request correction of inaccurate or incomplete data | Email us |
| Right to erasure | Request deletion of your data | Email us |
| Withdraw consent | Withdraw any consent at any time, without affecting prior processing | Email us or use the unsubscribe link in any email |
Saudi Arabia Users
All rights above apply. Additionally:
- You may file a complaint with SDAIA within 90 days of becoming aware of an issue
- You may seek compensation for harm caused by a violation of privacy law
- We will respond to any data request within 30 days (up to 60 days for complex cases)
EU / UK Users
All rights above apply. Additionally:
- Right to data portability
- Right to restrict processing while disputes are investigated
- Right to object to processing based on legitimate interests
- Right to lodge a complaint with your local supervisory authority
California Users
- Right to know what personal information is collected and how it is used
- Right to delete your personal information
- Right to non-discrimination for exercising your privacy rights
- We do not sell your personal information
10. Consent & Your Choices
You can withdraw consent or change your preferences at any time by emailing us at khalid.support@gmail.com or using the unsubscribe link in any email we send. Providing your email address or profile photo is never required to use Safa — all such data is strictly opt-in.
11. Disclaimer of Warranties
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
We do not warrant that the Service will be uninterrupted, error-free, or completely secure. We make no warranties about the accuracy or completeness of any information provided through the Service.
12. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SAFA AND ITS DEVELOPER SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF DATA, ARISING FROM YOUR USE OF THE SERVICE.
Some jurisdictions do not allow the exclusion of certain warranties or limitations of liability, so some of the above may not apply to you.
13. Children's Privacy
Safa is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the app, please contact us at khalid.support@gmail.com and we will remove it promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We will notify you of any material changes through the app or by email. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
15. Contact
If you have any questions about this Privacy Policy or our data practices, please contact us: