This Privacy Policy explains how Rifaq ("Rifaq", "we", "us"),
operated by BrightByte LLC, handles your information when you use the Rifaq mobile
app and related services (the "Service"). Rifaq is a habit and task
accountability app with group leaderboards.
Information we collect
- Account details — your email address, display name, optional
avatar, time zone and language. Rifaq is passwordless: we never
collect or store a password.
- Sign-in identities — when you sign in with Google, Apple or
Facebook, we receive a provider user identifier and, where you allow it, your
email and name, solely to create or link your Rifaq account.
- Your content — the tasks, task completions, groups and invites
you create or join, and the timelines you build: their titles, descriptions,
links and step order.
- Books in your timelines — for a PDF you add to a timeline we
store only its file name, size, page count and a fingerprint keyed to your
account, so your other devices can recognise the same file. The PDF itself
never leaves your device, and PDFs you open in Rifaq from other apps are not
sent to us at all.
- Goals — the goal boards you create and the goals and goal groups
inside them: their titles, descriptions, icons and colours, start and end dates,
order, and whether each one is done. When you share a board or a goal with one of
your groups, the members of that group can see it and your progress on it. You can
stop sharing at any time, and leaving a group withdraws everything you shared into
it.
- Focus sessions — for each focus session we store when it started
and ended, the length you picked, how many minutes you actively focused, whether
you finished it or stopped it early, and the day it falls on in your time zone.
If you started it for a task or a timeline step, we also store an internal
reference to that item, never its title or any label. This lets your other
devices show your focus time, and sessions earn a limited number of points each
day.
- Weekly reviews — for each weekly review you complete we store the
week it covers, when you completed it, how many unfinished items you carried
over, and up to three priorities you chose for the coming week. Priorities are
stored only as internal references to your own tasks or timeline steps, never
their titles. We also store your review-reminder settings: whether the reminder
is on, and the day and hour it comes. A completed review earns points, at most
once a week.
- Your device library — PDFs you add to My library stay on
this device only. They are never uploaded to us or included in device backups,
and no title, file name or fingerprint of them reaches our servers. The library
belongs to the device, not to your account: every account signed in to Rifaq on
that phone sees the same library, and it stays after you sign out until you
remove it with Clear library in Settings. The count of pages you read
each day, used in your weekly review, is also kept only on the device.
- Device & notifications — push-notification tokens and device
platform, so we can deliver notifications you have enabled.
- Support messages — when you write to us through the app's
Contact-us form, we store your message, the topic you chose, and the app
version, platform and language of the device you sent it from, so we can
answer you.
- Usage for features — records of notifications sent and read to
operate reminders, leaderboards and gamification.
How we use your information
- Provide, operate and secure the Service.
- Send one-time sign-in codes and group invitations by email.
- Compute daily leaderboards, streaks, badges and challenges.
- Award points and levels for tasks, timeline steps, focus sessions and weekly
reviews.
- Show your goals, focus sessions and weekly reviews on every device you sign in on,
and send the weekly-review reminder if you turn it on.
- Deliver push notifications you have opted into (you can opt out per category).
Service providers we share with
We share limited data with processors strictly to run the Service. We do
not sell your personal data.
- Railway — application hosting and database.
- Resend — transactional email (sign-in codes, invites).
- Google Firebase Cloud Messaging — push-notification delivery.
- Google, Apple, Facebook — verifying your sign-in when you choose
social login.
Data retention & deletion
We keep your information while your account is active. You may request deletion
at any time — see our Data Deletion page. We remove
your personal data within 30 days of a verified request, except where limited
records must be retained to comply with law.
Security
Data is encrypted in transit (HTTPS). Sensitive tokens and one-time codes are
stored only as cryptographic hashes, and there are no passwords to leak.
Children
The Service is not directed to children under 13 (or the minimum age required in
your country). We do not knowingly collect data from them.
Your rights
You may access, correct or delete your data, and object to or restrict certain
processing, by contacting us at privacy@rifaq.app.
Contact
For anything about the app, write to
support@rifaq.app or use the Contact-us form in
the app under Settings. See our Support page.
Changes
We may update this policy; we will revise the effective date above and, for
material changes, notify you in the app.
Questions? Contact privacy@rifaq.app.