Privacy Policy

Account Information:

• Email address (required for account creation and communication)
• Username (you may use a pseudonym; real names are never required)
• Password (encrypted and never stored in plain text)
• Optional demographic information (age range, location by country/region only)

Recovery Journey Data:

• Streak tracking and progress metrics
• Habit tracker entries
• Course completion status
• Journal entries and personal reflections (stored with end-to-end encryption)
• Community forum posts and messages (anonymous within gender-separated groups)

Support Interactions:

• Messages sent to our support team
• Feedback and survey responses
• Panic button usage logs (for improving emergency support features)

Payment Information:

• We use third-party payment processors (Stripe, Apple Pay, Google Pay) and do not store your full credit card information on our servers
• We retain only transaction IDs and subscription status

Technical Data:

• Device type, operating system, and app version
• IP address (anonymized for analytics)
• App usage analytics (pages viewed, features used, session duration)
• Crash reports and error logs (anonymized)

Location Data:

• We do NOT collect precise geolocation
• We may collect country/region-level location for content localization and legal compliance

• Real names (unless you voluntarily provide them)
• Profile photos or identifying images
• Precise geolocation or GPS coordinates
• Contacts from your device
• Social media profiles or connections
• Browsing history outside the app

To Provide Recovery Support:

• Deliver personalized recovery courses and content
• Track your progress and celebrate milestones
• Facilitate anonymous community support
• Provide crisis intervention through panic button features
• Send Islamic reminders and motivational content

To Improve Our Services:

• Analyze usage patterns to enhance user experience
• Develop new features based on community needs
• Conduct research on addiction recovery effectiveness (using only aggregated, anonymized data)

To Communicate With You:

• Send account-related notifications
• Provide customer support
• Share updates about new features and content
• Send educational newsletters (you may opt out at any time)

To Ensure Safety and Security:

• Prevent fraud, abuse, and violations of our Terms of Service
• Protect against security threats
• Comply with legal obligations

For users in the European Economic Area (EEA), UK, and other GDPR-compliant jurisdictions, we process your personal data based on:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract Performance: Processing is necessary to provide the Services you requested
• Legitimate Interests: Processing is necessary for our legitimate interests in improving Services and preventing fraud, provided these interests do not override your rights
• Legal Obligation: Processing is necessary to comply with applicable laws

Encryption:

• All data transmitted between your device and our servers uses TLS 1.3 encryption
• Sensitive personal data (journal entries, private messages) is encrypted at rest using AES-256 encryption
• End-to-end encryption for direct messages in community forums

Access Controls:

• Multi-factor authentication (MFA) required for staff accessing systems
• Role-based access controls ensuring staff can only access data necessary for their duties
• Regular access audits and automatic session timeouts

Infrastructure Security:

• Data stored on HIPAA-compliant, SOC 2 certified servers
• Regular security assessments and penetration testing
• Automated backup systems with encrypted storage
• 24/7 security monitoring and intrusion detection

• All staff undergo HIPAA privacy and security training
• Strict confidentiality agreements for all employees and contractors
• Background checks for personnel with access to user data
• Incident response plan with breach notification procedures

• Servers hosted in secure, access-controlled data centers
• Physical security measures including surveillance and restricted access

• Gender-separated communities with no cross-gender visibility
• Anonymous usernames with no requirement for real names
• No public profiles or user directories
• Moderated forums to prevent doxxing or harassment

We work with carefully vetted third-party service providers who help us operate the Services:

• Cloud Hosting: AWS, Google Cloud (HIPAA-compliant infrastructure)
• Payment Processing: Stripe, Apple Pay, Google Pay
• Email Services: SendGrid, Mailchimp (for newsletters and notifications)
• Analytics: Google Analytics (with IP anonymization), Mixpanel
• Customer Support: Zendesk

All service providers are bound by strict confidentiality agreements and Business Associate Agreements (BAAs) as required by HIPAA. They may only use your data to provide services to us and are prohibited from using it for their own purposes.

We may disclose your information if required by law, including:

• In response to valid legal processes (subpoenas, court orders)
• To comply with applicable laws and regulations
• To protect the rights, property, or safety of ShukrApp, our users, or the public
• In connection with investigations of fraud, security threats, or violations of our Terms

Important: We will notify you of legal requests for your information unless prohibited by law. We will challenge overly broad or inappropriate requests.

If we believe in good faith that disclosure is necessary to prevent imminent harm to you or others (e.g., credible suicide threats), we may share information with emergency services or appropriate authorities.

If ShukrApp is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and prominent notice in the app before your information is transferred and becomes subject to a different privacy policy.

We may share your information for purposes not described in this Privacy Policy with your explicit consent.

• Right to Access: You may request a copy of all personal data we hold about you
• Right to Data Portability: You may request your data in a structured, machine-readable format

• Right to Rectification: You may correct inaccurate or incomplete information
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your account and personal data, subject to legal retention requirements

• Right to Restrict Processing: You may request that we limit how we use your data
• Right to Object: You may object to processing based on legitimate interests
• Right to Withdraw Consent: You may withdraw consent at any time where we rely on consent as the legal basis

• Opt-Out of Marketing: You may unsubscribe from promotional emails at any time
• Notification Settings: You may control push notifications through your device settings

To exercise any of these rights, please contact us at privacy@shukrapp.com or through the app's settings menu. We will respond within 30 days (or as required by applicable law).

• For GDPR Requests: If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.
• For CCPA Requests: California residents may request information about data shared with third parties for marketing purposes and may opt out of such sharing.

• Account data is retained while your account is active
• Recovery journey data (streaks, courses) is retained to support your ongoing progress

• If you do not log in for 24 months, we will send a reminder email
• After 36 months of inactivity, we may delete your account and associated data

• When you delete your account, we will permanently delete your personal data within 30 days
• Some information may be retained in anonymized form for research and analytics
• We may retain certain data longer if required by law or to resolve disputes

• Records of legal requests and safety incidents may be retained for up to 7 years as required by law

• We comply with GDPR requirements for international data transfers
• We use Standard Contractual Clauses (SCCs) approved by the European Commission
• We participate in the EU-US Data Privacy Framework where applicable
• Your data receives equivalent protection regardless of where it is processed

• We ensure all international transfers meet applicable legal requirements
• Service providers in other countries are contractually bound to protect your data

Essential Cookies:

• Session cookies to keep you logged in
• Security cookies to prevent fraud

Analytics Cookies:

• Google Analytics (with IP anonymization) to understand how users interact with our Services
• Mixpanel for feature usage analytics

Preference Cookies:

• Language and display preferences

You may disable cookies through your browser settings, but this may limit functionality. We do not use advertising cookies or sell data to advertisers.

Do Not Track: We honor Do Not Track (DNT) signals from your browser.

• Material changes will be communicated via email and in-app notification
• You will be required to review and accept significant changes before continuing to use the Services
• Non-material changes will be posted with an updated "Last Updated" date