Privacy Policy

1. Our Sacred Amanah (Trust) Commitment

Nurah is designed specifically to serve Muslim women during menstruation, trying to conceive (TTC), pregnancy, and postpartum. In Islamic jurisprudence, confidentiality regarding biological and intimate matters is governed by the principle of Amanah (moral trust and responsibility).

We consider safeguarding your health records a sacred duty. We enforce privacy-by-design across our client application, database architecture, and authentication layers.

2. Information We Collect

We only collect information strictly required to calculate menstrual cycles, calculate gestational age, track baby milestones, and provide accurate Islamic Fiqh prayer rulings.

• Account Identifiers: Email address, pseudonym/name, and verified authentication token (Google Sign-In, Apple Sign-In, or Supabase Email Auth).
• Cycle & Fertility Data: Menstrual flow start/end dates, flow intensity, basal body temperature, ovulation test results, symptoms (cramps, headaches, mood), and cervical fluid notes.
• Pregnancy & Postpartum Logs: Estimated due date, gestational age, kick counters, contraction records, weight logs, and postpartum bleeding (Nifas) observations.
• Spiritual & Fiqh Preferences: Preferred school of jurisprudence (Hanafi, Shafi'i, Maliki, Hanbali) used strictly to compute prayer suspension periods during Hayd and Nifas, and saved daily duas.
• Device & Diagnostics: App version (e.g. 1.0.1), device operating system version (iOS/Android), and anonymous crash reports to resolve technical bugs.

3. How We Use Your Information

Your data is processed exclusively for the following purposes:

• To calculate cycle predictions, fertile windows, and expected due dates.
• To provide tailored daily Quranic reflections, Duas, and Fiqh guidance.
• To sync your records securely across multiple personal devices when signed in.
• To deliver local notifications and reminders (such as medication, kick tracking, or cycle start dates) configured by you.

4. Medical & Health Disclaimer

In accordance with the Google Play Health Content and Services Policy, we explicitly disclose:

• No Medical Advice or Clinical Diagnosis: No cycle forecasts, ovulation estimates, gestational milestone calculations, symptom logs, or Fiqh guidance provided by Nurah constitute clinical medical advice, formal medical diagnoses, prescriptions, or clinical treatment plans.
• No Doctor-Patient Relationship: Using Nurah or tracking your symptoms does not establish any doctor-patient or clinical healthcare provider relationship.
• Always Consult Licensed Healthcare Professionals: Never disregard professional medical advice, delay seeking clinical care, or alter prescribed treatments because of information tracked or observed within Nurah. Always consult an obstetrician, gynecologist, certified midwife, or licensed healthcare practitioner regarding menstrual irregularities, unusual bleeding, pregnancy symptoms, or health concerns.
• Medical Emergencies: If you experience severe abdominal pain, acute heavy hemorrhaging, sudden illness, or suspected pregnancy complications, immediately contact emergency medical services (such as 911 or your local emergency hospital) without delay.

5. Prominent Disclosure: Zero Data Selling

In full compliance with the Google Play User Data Policy, Health & Reproductive Data Policy, and Apple App Store Review Guidelines (5.1.2):

• We NEVER sell personal or sensitive health data to third parties.
• We DO NOT embed advertising tracking pixels (such as Meta/Facebook Pixel, TikTok SDK, or Google AdMob).
• We DO NOT use reproductive or cycle logs for behavioral profiling or third-party targeted advertising.

6. Data Security, Encryption & Cloud Storage

We employ enterprise-grade technical and organizational safeguards to protect your personal data:

• In-Transit Encryption: All client-server communications are encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
• Rest Encryption: Cloud database storage utilizes AES-256 encryption at rest.
• Row-Level Security (RLS): Our database isolates user records with cryptographic policies, ensuring that only your authenticated session can access your cycle entries.
• Local Storage: Device-cached logs are stored securely using private sandboxed storage (GetStorage).

7. Essential Third-Party Service Providers

We work only with vetted cloud infrastructure providers required to operate the app securely:

• Supabase: For cloud authentication, encrypted database hosting, and secure data synchronization.
• Google & Apple Identity Services: To facilitate optional one-tap sign-in without storing passwords on our servers.

8. Your Privacy Rights (GDPR, CCPA & Global)

Regardless of your geographic location, Nurah grants all users full rights over their personal data:

• Right to Access & Portability: You can view all logged entries inside the app or request an exported machine-readable archive (JSON/CSV).
• Right to Rectification: You can edit or correct past dates, symptoms, or due dates at any time.
• Right to Restrict Processing: You may toggle cloud synchronization or use guest mode on device.
• Right to Erasure ("Right to be Forgotten"): You have the unconditional right to delete your account and all associated cloud entries permanently.

9. Data Retention Policy

In accordance with the Google Play User Data Policy, we strictly disclose our data retention practices and timelines for all categories of personal and sensitive health data:

• Active Account Data & Health Logs: We retain your personal identifiers (name, email) and sensitive health records (menstrual cycles, fertility symptoms, pregnancy logs, baby kick counts, and postpartum observations) for as long as you maintain an active Nurah account. This continuous retention is strictly necessary to calculate personalized historical cycle averages, forecast future ovulation windows, and preserve your longitudinal health history across cycles and pregnancies.
• Local On-Device Storage: Cached cycle records and offline preferences stored locally on your device remain stored until you manually clear the app cache/storage via your device settings, tap "Reset Data" in settings, or uninstall the application from your device.
• Anonymized Diagnostics & Crash Logs: Performance telemetry, crash reports, and system diagnostics that do not identify individuals are retained for a maximum duration of ninety (90) days to debug technical errors and ensure app stability, after which they are permanently deleted.
• Data Retention Following Account Deletion: If you delete your account or submit a data erasure request, your personal identifiers and all associated reproductive health records are permanently purged from our active production databases within 24 to 48 hours. Routine encrypted database backups are overwritten on a rolling basis, ensuring complete and irreversible deletion across all backup storage within thirty (30) days.
• Inactive Accounts: If an account remains inactive with no logins for twenty-four (24) consecutive months, Nurah reserves the right to send an advance notification to your registered email address before securely deleting or archiving dormant account data.

10. Account & Data Deletion Instructions

In accordance with Google Play's Account Deletion Policy, users can delete their account and data through either of the following methods:

1. In-App Deletion: Open the Nurah app ➔ Go to Profile ➔ Scroll to Account ➔ Tap Delete Account & Data.
2. Web / Email Request: Send an email from your registered email address to privacy@nurah.app with the subject line "Account Deletion Request".

Upon receipt of a deletion request, all personal identifiers, cycle logs, health notes, and backup entries are permanently purged from active databases within 24 to 48 hours, and rolling backups within 30 days. You may also contact us directly at privacy@nurah.app for any data export or deletion assistance.

11. Children's Privacy

Nurah is intended for women and mothers of legal age managing reproductive health, pregnancy, and postpartum. We do not knowingly collect personal data from individuals under 13 (or under 16 in the European Union). If we become aware that personal information from a child has been collected inadvertently, we will delete it immediately.

12. Contact Information & Data Protection Officer

If you have any questions, feedback, or concerns regarding this Privacy Policy, our data handling practices, or Islamic privacy principles, please contact: