Privacy Policy

1. Scope and who is responsible

This policy explains how Mohammad Rabi ("we," "us," or "our") handles personal information when you use appclabs.com, any app published or operated by Mohammad Rabi under the AppCLabs brand, and related updates, widgets, support and services (the "Services").

AppCLabs is an unregistered publishing brand used by Mohammad Rabi, the individual developer, publisher and operator of the Services. AppCLabs is not a separate legal entity or company. Mohammad Rabi is responsible for the processing described here as the data controller and, where applicable, the business under privacy law. Our providers may act as processors or service providers. Platforms and advertising providers may also act as separate controllers under their own terms.

Data handling depends on the app version, the information you submit, the permissions you grant and your privacy choices. Not every app handles every category listed here. A notice for a specific submission adds detail to this policy.

2. Information we handle

Some information stays on your device. Other information is sent to us or our service providers. Saving a record locally does not mean that an AI request or an analytics event stays on your device.

When you submit content for AI processing, the request may include text, photos, supported audio, relevant conversation or submitted-record context, and technical identifiers used to process the request and detect abuse. Requests go to OpenAI directly or pass through our Cloudflare proxy, depending on the app version. A supported voice submission sends audio for transcription; versions with transcription disabled do not offer that submission.

Some records, such as prayer check-ins, medication and symptom entries, weight history, saved meals, chat history and attachment files, are stored locally. These local records are distinct from content you submit to an online service and from separate analytics, purchase and attribution information. A saved copy on your device does not remove a copy already sent to a provider.

When you request location-based prayer or fasting calculations, coordinates for the selected or permitted location and calculation settings are sent to AlAdhan. When you choose to export or share a report, it may contain the records included in that report and is sent to the recipient or service you select.

The sections below describe the categories handled when you use the relevant submission or permission. Available controls depend on the app version.

Information you provide

• Support and privacy requests: your email address, message, attachments, and information you choose to include.
• Account information, where offered: identifiers and limited profile information you provide when creating or using an account.
• Purchase information: subscription status, entitlement, product, transaction or receipt identifiers, renewal and restore status. Apple or Google processes payment details; we do not receive full payment-card data.

Religious activity, location and submitted content

• Prayer and app activity: prayer check-ins, streaks, preferences, reading/listening progress, recent items, reminder settings, and feature interactions.
• Location: precise location when you grant permission, used to calculate prayer, suhoor, and iftar times and related reminders. Approximate location may also be inferred from IP by service providers.
• AI content: prompts, chat text, and images you choose to attach or capture so an AI provider can generate a response. Local chat history and attachment thumbnails may remain on your device until cleared.
• Safety reports: The information sent depends on the reporting tool. Contextual reports include the flagged answer, preceding text prompt, reason, optional note, message or session identifiers, app version, platform and language. Answer-only reports include the answer, reason, optional note, request identifier and receipt time; they exclude the prompt and conversation history. Images and attachments are excluded from both payloads. The answer or your note may still contain personal information.
• Notifications: push token, notification preferences, and delivery or interaction information.

Meal, wellness and health information

• Meal content: meal descriptions, voice recordings submitted for transcription, meal photos, notes, timestamps, meal type, and generated nutrition estimates.
• Profile and goals: age, gender, height, weight, goal weight, activity level, weekly pace, calorie target, and onboarding choices.
• Progress information: meal history, weight entries, calorie and macro history, streaks, wellness estimates, and reminder settings. Where medication or symptom records are supported, these include medication selections, recorded dose amounts and units, dose times, recorded injection sites where applicable, symptoms and check-in notes.
• Apple Health: if you connect HealthKit, authorized data may include VO₂ max, resting heart rate, heart-rate variability, one-minute heart-rate recovery, step count, walking speed, and waist circumference. In the current implementation, this information is processed on your device for wellness estimates and is not uploaded by us.
• Local operational data: locally stored app state and failed background jobs retained for retry until completed or removed.

Collected automatically in an app

Installation, app-user, profile and device identifiers can link activity, diagnostics and purchase records within a provider's systems. This can happen without a named account. An identifier described as anonymous does not by itself make the associated data anonymous or unlinkable.

• Device, installation, app-instance, vendor, advertising, account, or push identifiers, depending on platform permission, consent, and the SDK used.
• App interactions, screens, feature actions, session information, attribution data, consent choices, and subscription conversion events.
• Device model, operating system, app version, language, country or approximate region, network information, crash logs, diagnostics, and performance information.
• IDFA on iOS only when Apple’s App Tracking Transparency permission is granted; Android advertising identifiers where permitted by platform settings and law.

We do not intentionally collect government identifiers, full payment-card information, contact lists, genetic data, biometric templates, political opinions, trade-union membership, sexual orientation, or race/ethnicity. Religious activity and health- or wellness-related inputs may be considered sensitive under some laws and are handled only for the app functions you request and as otherwise described here.

3. Why we use information and our legal bases

You may withdraw consent at any time. This does not affect processing already carried out. You may also object to processing based on legitimate interests as explained in Section 10. We do not use solely automated processing to make decisions about you with legal or similarly significant effects.

4. Service providers, SDKs, and disclosures

Depending on the app, platform, region, feature, and your consent choices, we use providers in the following categories:

These links explain the providers' policies and relevant legal documents. Some general privacy notices exclude data processed on a customer's behalf; provider agreements and data-processing terms address that processing. Linking those business agreements does not make you a party to them. Separate terms may apply when you use a provider's own service, such as an app store. For privacy requests about information processed for us, contact dpo@appclabs.com.

The ipify privacy and terms links are on its geolocation service website; the SDK request described here is a public IP lookup, not a geolocation request. We have not verified a separate AlAdhan privacy notice. Its API and terms links explain the service; they do not establish a retention period for the coordinates sent.

OpenAI-powered features

When you use an AI feature, the app sends the content needed for the request to OpenAI, L.L.C. or the applicable OpenAI affiliate through its API. In versions that use our proxy, the request passes through Cloudflare Workers first. Depending on the feature, it can include text, photos, audio, relevant conversation or dog context, and technical information such as an installation safety identifier. OpenAI uses the content to return the result, detect abuse and operate and protect its API. We do not opt API content into model training or improvement programs without separate notice and any consent required by law.

OpenAI states that API inputs and outputs are not used to train its models by default. Standard abuse-monitoring logs can retain content for up to 30 days, with legal and safety exceptions. Retention also depends on the endpoint and account settings. For example, the Responses API can retain response state for at least 30 days under its default storage settings; stored objects or other features may have different deletion rules. This is not a promise of zero retention or deletion of all copies after 30 days. See OpenAI's Privacy Policy and API data controls. Submit only content you are comfortable sending for this processing.

Consent-management configuration

A provider listed in a consent configuration is not necessarily active. The table describes providers supported by the reviewed Services; use depends on the app version, submission, platform, region and privacy choices. Consent configuration alone does not authorize processing.

We may also disclose information to professional advisers, authorities, courts, or counterparties when reasonably necessary to comply with law, protect people or the Services, investigate abuse, establish or defend claims, or complete a merger, financing, acquisition, or transfer of assets. Any successor must honor this policy for information collected under it unless you are notified otherwise.

We assess providers before use and require them, through applicable contracts, data-protection terms, and platform controls, to protect personal information consistently with this policy and applicable law. We remain accountable for personal information transferred to processors. A separate controller remains responsible under its own privacy terms.

5. Consent, tracking, and advertising choices

In supported versions, Usercentrics provides regional consent choices and privacy settings. You can change available choices in the app and permissions in device settings. On iOS, App Tracking Transparency (ATT) separately controls permission for tracking across other companies' apps and websites and access to IDFA. Tracking can involve other identifiers as well as IDFA. A consent-management choice does not replace ATT permission when ATT applies.

Before an AI feature sends personal content to a third-party AI provider, it must identify the provider, explain what is sent and why, and ask for an affirmative choice where platform rules or law require it. If you choose "Not now," the submission must not be processed. Withdrawing consent stops future processing that relies on that consent, but does not undo earlier processing. An AI feature may stop working if it needs that processing. Reading this policy or accepting the Terms does not replace the in-app notice and choice.

We do not sell personal information for money. Disclosures of identifiers or app interactions to advertising or attribution providers may be treated as “sharing,” “targeted advertising,” or a “sale” under certain US state laws even when no money is exchanged. Where applicable, you may opt out through the consent interface and platform settings or by emailing dpo@appclabs.com. We do not knowingly sell or share personal information of users under 16.

Mobile apps do not provide a uniform browser Global Privacy Control signal. If a supported platform-level opt-out signal becomes available for our apps, we will process it as required by applicable law. This website currently has no advertising or analytics trackers to opt out of.

6. International data transfers

We operate from Pakistan and use providers that may process information in the United States, European Economic Area, Canada, and other countries. These locations may have different data-protection laws. Where required, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, vendor transfer commitments, or another lawful transfer mechanism. You may request information about applicable safeguards by contacting the DPO address below.

7. Storage, retention and deletion

Records you save in the app, such as prayer check-ins, medication and symptom entries, weight history, saved meals, chat history and attachment files, are primarily stored on your device. They remain until you delete them in the app, clear app data or uninstall, subject to device backups and synchronization you control. This is separate from content sent for AI processing and from analytics, purchase, attribution or other service data described in this policy.

Some information is stored on servers. For example, submitting an AI safety report can store the report in Google Firebase Cloud Firestore. Firebase is a cloud service, not local device storage. Deleting local records or uninstalling an app does not automatically delete information already sent to us or a provider. We do not promise that all Firebase or other server data is automatically deleted after 30 or 90 days.

To request deletion of information we hold, including an AI report stored in Firebase, email dpo@appclabs.com or use our deletion-request page. Tell us which app and information the request concerns, and include a report or reference identifier if you have one. Do not send additional sensitive content just to identify a request. We handle requests under the rights and applicable requirements described in Section 10, including any necessary verification. Where a deletion request must be honored, we delete or de-identify the information we control and request deletion from providers processing it for us, as appropriate. Information may be retained where law permits or requires it, such as for a legal obligation, an active dispute or a necessary fraud or security investigation. We will explain any applicable limitation when responding.

• Our retention policy is to keep server-side information only as needed for the purposes described here and as permitted by applicable law, and to delete or de-identify it when it is no longer needed.
• Support, privacy, and legal correspondence is generally retained for up to 24 months after the matter closes, or longer where legally required.
• Purchase, tax, dispute, and fraud-prevention records may be retained for the period required by law or reasonably needed to protect legal rights.
• Provider retention depends on the service, data type, endpoint and settings. OpenAI's standard API abuse-monitoring logs may retain request and response content for up to 30 days, with legal and safety exceptions. Some endpoint state or stored objects follow different rules, as explained in Section 4. This is not a universal 30-day deletion limit.
• Google/Firebase, Cloudflare, analytics, attribution, crash and subscription providers have service-specific retention and deletion rules. Their documents linked in Section 4 explain those rules; there is no single 30- or 90-day period that applies to all providers or all data.

Deletion from active systems may not immediately remove copies in backups or provider systems. Those copies follow the applicable backup and provider deletion cycles, and legal retention requirements may still apply. We do not promise immediate deletion of every copy or zero provider retention.

8. Security

We use reasonable technical and organizational safeguards appropriate to the nature of the information, including encrypted transport, platform access controls, consent gating, data minimization, and restricted administrative access. No transmission or storage system can be guaranteed completely secure. If you believe information has been compromised, email dpo@appclabs.com.

9. Your choices

• Decline or revoke camera, photos, microphone, location, notification, health, or tracking permissions in device settings.
• Change available consent choices through the in-app Usercentrics privacy settings.
• Clear app data or chat history using in-app controls where offered, or uninstall to stop future app collection.
• Use our Privacy Choices page to request an opt-out, withdraw consent, or exercise a regional right.
• Use our Account & Data Deletion page to initiate deletion from outside an app.
• Manage or cancel subscriptions through the Apple App Store or Google Play account used to purchase them.
• Avoid entering sensitive or confidential information in AI prompts, images, support messages, or meal descriptions.

10. Privacy rights by region

Subject to identity verification, exceptions, and the law that applies to you, you may have the following rights:

• EEA, UK, and Switzerland: access, correction, erasure, restriction, portability, objection, withdrawal of consent, and a complaint to your local supervisory authority.
• California and other applicable US states: know/access, correct, delete, obtain a portable copy, opt out of sale/sharing or targeted advertising, limit certain uses of sensitive personal information, and appeal a denied request where provided by law.
• Canada: know why information is collected, access and correct it, withdraw consent subject to legal or contractual restrictions, and complain to the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.
• Other regions: any comparable rights provided by applicable privacy law.

Submit a request to dpo@appclabs.com and identify the relevant app, platform, approximate dates of use, and an app/device or purchase identifier if available. Do not send a password, complete payment-card number, or government ID unless we specifically and securely request proof needed for verification. We will respond within the time required by applicable law. Authorized agents may submit requests where law permits, subject to proof of authority. We do not discriminate against you for exercising a privacy right.

11. Supplemental US state privacy notice

For laws that require disclosure by statutory category, the table below summarizes personal information we collected and disclosed for business purposes during the preceding 12 months. The categories collected from any particular person depend on the app, features, permissions, region, subscription, configuration, and consent choices.

We collect these categories for the purposes in Section 3. We do not sell personal information for money. As described in Section 5, some advertising or attribution disclosures may be considered a sale, sharing, or targeted advertising under a particular state law; eligible users may opt out. We do not use or disclose sensitive personal information for purposes that require a separate right to limit under California law, such as inferring characteristics unrelated to the service you request.

12. Children

The Services are intended for a general audience and are not directed to children under 13. Where a higher minimum age applies to consent-based processing, parental authorization may be required. We do not knowingly collect personal information from children in violation of applicable law, permit interest-based advertising to users known to be under 16, or knowingly send a child's personal content to OpenAI without any consent required by law. If an app is ever directed to children or we learn that a child has provided personal information, we will apply the required age-screening, parental notice/consent, data-minimization, access, and deletion protections. Contact us so we can investigate and delete information where required.

13. AI, health, and religious information

AI outputs can be inaccurate, incomplete, or inappropriate. Nutrition and wellness estimates are not medical advice or diagnosis. Religious AI content is not a definitive religious ruling and does not replace qualified scholars. We do not use your AI, health, or religious information to determine eligibility for employment, housing, credit, insurance, health care, or other legally significant services.

We use sensitive health, precise-location, or religious information only for the feature you request, with explicit consent where required, and not for unrelated profiling or targeted advertising. Do not use an AI feature for emergencies or to submit protected health information intended for HIPAA-regulated treatment, payment, or health-care operations. In-app reporting tools, where offered, let you flag unsafe or inappropriate AI output for review.

14. Changes to this policy

We may update this policy when the Services, providers or legal obligations change. We will post the new version here and update its effective date. If a change materially affects your rights, we will give additional notice or obtain consent when required.

15. Contact us

Controller: Mohammad Rabi, publishing under the AppCLabs brand
Location: Lahore, Punjab, Pakistan
Data Protection Officer / privacy requests: dpo@appclabs.com
General support: hi@appclabs.com

EEA and UK representative: none appointed as of the effective date. Until representative details are published here, direct questions and rights requests to the DPO contact above.