Privacy Notice

This notice explains what data the Istighfar Flow app collects, why, and what happens to it. The Service is operated by Imran Nisar ("we", "us"), who is the data controller for it. You can reach us at i@drimrannisar.co.uk.

The short version: the app saves the number of counts you make, your settings and your workout plans. The app never saves a recording of your voice or a transcript of what you said. When you count by voice, your microphone audio is sent live to our speech-recognition provider, Deepgram, in the United States. Every request tells Deepgram not to keep that audio or the text it produces once the result is sent back — see Your voice. Counting by tapping sends no audio at all.

What we collect

• Counts and sessions: how many istighfar you counted, the day, and whether it was by voice, tapping or added by hand. Prayer-mode sessions are tagged with the prayer name (e.g. Fajr).
• Settings: your daily target, your chosen phrase, prayer location and calculation settings, reminder preferences, sound-meter sensitivity.
• Workouts: your workout plans, routines and completed sessions.
• Account details (if you create one): your email address and sign-in method. Guests are not asked for a name or email: their counts, settings and plans are saved under an anonymous identifier instead, which is still linked to that device's data. The anonymous identifier, guest activity and technical logs can still be personal data.
• Misheard words (on your device only): close-sounding words the speech service heard but that were not counted, so you can teach the app. The app stores these only on your device; they never sync to your account.
• Basic technical logs: minimal server logs needed to run and secure the Service.

Your voice

What the app does. Only while voice counting (or a voice test, calibration, training or connection check) is running, your microphone audio is streamed from your phone straight to our speech-recognition provider. The recognised text comes back to your phone, where the app looks for the phrase you are counting and keeps only the count. Our servers never receive or store your audio, and the app never saves a transcript — apart from the short, on-device “Often misheard” list described above, which you can clear at any time.

What the speech provider does. The provider is Deepgram, and this app uses its standard service in the United States. By default Deepgram keeps the audio and transcripts of requests to improve its models, unless a request opts out. Every voice request this app makes — counting, voice tests, calibration, training and connection checks — opts out (Deepgram's mip_opt_out setting). Deepgram's documentation says opted-out audio and transcripts are kept only for as long as needed to process the request. Deepgram still keeps basic request records (such as time, length and settings, not audio or text): retrievable for 90 days, with summarised usage kept longer. Earlier versions of the app did not opt out, so audio sent before this update may have been kept under Deepgram's default terms. Details: Deepgram — Your data. If we change this setting, we will update this notice.

If you would rather your voice was not sent anywhere, count with the +1 and −1 buttons — they work fully without the microphone.

Why we process data (legal bases)

• To provide the Service you asked for — saving your counts and settings so they are there when you return (contract).
• To run the Service securely — preventing abuse of the free daily limit and protecting accounts (legitimate interests).
• Payments — purchase and subscription records are processed by Paddle as merchant of record, who is responsible for billing data, tax and payment-card details.

Who we share with

We share only what is needed to run the Service, and only with:

• Our hosting and database provider (Lovable Cloud, running on Supabase infrastructure) — stores counts, settings and accounts;
• The speech recognition provider (Deepgram, United States) — receives live microphone audio during voice counting, with each request opted out of Deepgram keeping audio or transcripts (see Your voice);
• Paddle — merchant of record for payments; handles your payment details, billing and tax;
• AI assistance features — when you ask for voice guidance, only aggregated metrics (e.g. average sound level and how many repetitions were counted) are sent through our AI provider; never audio, never transcripts. These may be processed outside the UK and EU.

The app's operator can view account and guest records — including email address, count totals, day-by-day count history, settings and plans, but never audio — through admin tools and the database, to give support and prevent abuse of the free limit. Other users cannot see your records. We never sell your data, and we show no adverts and no social feeds.

Where data lives

Your account data — counts, sessions, settings, plans and sign-in — is stored in our database in the European Union (Frankfurt, Germany). Voice audio is processed by Deepgram in the United States, as described above. Pages and requests are delivered through our hosting provider's worldwide network, and Paddle handles payment details under its own policy. Your "Often misheard" list, voice calibration and training words stay on your device and are not backed up to your account.

How long we keep it

• Counts, sessions and settings: for as long as your account exists, then deleted when you delete your account.
• Guest data is stored on your device and in our cloud database. Use Settings → Delete account and data while signed in to the guest account, or contact us, to delete cloud records. Clearing browser or app data removes local copies and may remove access to the guest account; it does not delete cloud records.
• Billing records: Paddle keeps them as long as tax and accounting law requires.
• Voice audio and transcripts: never kept by the app, and Deepgram is told not to keep them after each request; Deepgram keeps request records under its own policy (see Your voice). Deleting your account here cannot remove anything Deepgram kept from before the opt-out was added.

Your rights

You have the right to access your data, correct it, export it, delete it, restrict or object to processing, and withdraw consent where consent is the basis. You can do most of this yourself in the app (settings, or deleting your account at Settings → Delete account and data), or by emailing us — we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are in the UK.

Children

The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it.

Changes

If we change this notice, we will update the date above and, for significant changes, tell you in the app before the change takes effect.

Contact

Data protection questions: Imran Nisar — i@drimrannisar.co.uk.

See also: Terms & Conditions · Refund Policy