Privacy Policy

Qalb ("Qalb," "we," "us," or "our") is a private journaling app designed to help you reflect on your thoughts, emotions, and experiences through an Islamic lens.

Qalb is operated by Ilmara Group LLC, a United States company.

Ilmara Group LLC is responsible for the personal information it processes through Qalb. Our Privacy Officer can be contacted at salam@theqalb.app.

Our approach to privacy is simple: your journal is yours.

We try to collect and process only what is needed to provide Qalb, keep it working, and improve the experience.

What we collect and why

Your journal

Your journal entries, intentions, reflections, journal history, and related content are primarily stored locally on your device.

Qalb may also create information related to your entries, such as:

• Titles and summaries
• Tags and themes
• Emotional classifications
• AI-generated reflections
• Qur'anic connections
• Other journal metadata

This information is generally stored locally with your journal.

Qalb does not operate a general cloud backup or journal-history archive.

AI features

Qalb is an AI-assisted journaling service. AI processing is required to complete onboarding and use Qalb's core reflection and guidance experience.

Before the first journal-derived content is transmitted for AI processing, Qalb presents an AI-processing disclosure and asks you to affirmatively enable that processing.

If you choose not to enable AI processing, Qalb cannot provide its core AI-assisted journaling service.

When you use an AI-assisted feature, Qalb sends only the journal text and related context reasonably necessary to provide that feature.

Qalb does not intentionally include your name, email address, Firebase user identifier, or device identifier in requests sent to these AI providers. However, anything you choose to write in your journal may itself contain personal or sensitive information.

You may later withdraw your consent through Qalb's Settings. If you do, new journal content will not be sent for AI processing and AI-dependent features will no longer operate. Journal content already stored locally remains on your device unless you delete it.

OpenAI and Anthropic

Qalb currently uses commercial API services from OpenAI and Anthropic.

OpenAI is used for journal metadata, writing assistance, embeddings, and safety classification through Chat Completions, Embeddings, and Moderations endpoints. Qalb does not use the OpenAI Responses API. Reflections use Anthropic.

Under their current commercial and API terms, OpenAI and Anthropic do not use API inputs and outputs to train their general models by default unless the customer affirmatively opts into applicable data-sharing or feedback programs.

Qalb's OpenAI organization has API input/output sharing, evaluation/fine-tuning sharing, feedback sharing, and API Call Logging disabled.

OpenAI's standard API abuse-monitoring systems may retain certain API content for up to 30 days depending on the endpoint, subject to legal and security exceptions.

Qalb's Anthropic commercial API configuration uses a 30-day retention period, and user-feedback sharing and participation in Anthropic's Development Partner Program are disabled.

Provider security, abuse-prevention, legal, or other limited exceptions may apply under their applicable terms. These policies may change; we encourage you to review their published data-use terms for the most current information.

Qur'anic matching

Qalb may use semantic-search technology to help identify Qur'anic passages related to what you have written.

This may involve processing portions of your journal content through AI, embedding, or search infrastructure.

Qalb does not send raw journal text, names, emails, Firebase identifiers, or persistent user-profile vectors to Pinecone. Pinecone receives a transient query vector derived from journal content solely to search Qalb's static tafsir corpus. Qalb does not store or upsert journal-derived user vectors in Pinecone.

AI may help determine which passage is relevant, but Qalb does not use generative AI to create or alter the text of the Qur'an.

Email and marketing communications

If you choose to provide your email address, Qalb may store it with your pseudonymous Qalb profile.

We use your email for marketing communications only when you have affirmatively chosen to receive those communications or where otherwise permitted by applicable law.

Marketing communications may include Qalb product news, updates, reflections, offers, or similar communications.

You can stop receiving marketing communications at any time by using the unsubscribe mechanism in the message or by using an available preference in Qalb.

We may retain limited information necessary to record and honor an unsubscribe request.

Unsubscribing from marketing does not prevent us from responding to a message you send us or sending service, privacy, security, billing, or legal communications where necessary.

Optional demographic information

Qalb may ask you to voluntarily provide limited demographic information, such as your age range or gender.

This information is stored with your first-party Qalb profile and may be used to understand the community Qalb is reaching and to improve or evaluate our own outreach and marketing, where permitted by applicable law.

Providing demographic information is optional.

Qalb does not send your age range or gender to RevenueCat or Firebase Analytics, and we do not combine demographic information with private journal content to create advertising profiles.

Website and communications

Theqalb.app does not currently use advertising pixels, behavioral analytics tools, or non-essential tracking cookies.

The website does not currently use Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, Vercel Analytics, Plausible, PostHog, Hotjar, Microsoft Clarity, or similar analytics or advertising technologies.

The website does not currently use an embedded newsletter or marketing-data collection form. Contact and early-access links currently open the user's email application.

Our website hosting and infrastructure providers may automatically process limited technical information generated when the site is accessed, such as IP address, browser or device information, requested pages, timestamps, and similar server or security information.

If you email Qalb, we receive the information you choose to include in the message and use it to respond to you or provide support.

Qalb does not combine website activity with private journal content for advertising.

Technical and performance information

Qalb and our infrastructure providers process limited technical information needed to operate, secure, and monitor the performance of the service.

This may include:

• App version
• Operating-system and device information
• Locale and network type
• Pseudonymous Firebase installation or session identifiers
• IP address or country inferred from IP
• Request URL patterns without journal payload content
• HTTP response codes
• Request and response size
• Latency and response time
• Timestamps
• User agent
• Backend request and security metadata
• Subscription and entitlement status

Qalb does not currently use Firebase Analytics for behavioral or product analytics in the launch build, and Firebase Crashlytics is not enabled.

Qalb uses Firebase Performance Monitoring for technical performance and reliability. This is not journal analytics.

We do not intentionally send journal text, prompts, AI reflections, journal summaries, emotions, tags, or other private journal content to Firebase Analytics or Firebase Performance Monitoring.

Anonymous identifiers

Qalb does not require you to create a traditional account or complete a sign-up process with a name and password.

When Qalb starts, it automatically creates a pseudonymous Firebase authentication identifier so the app can securely access Qalb's backend services.

This Firebase UID is used for backend authentication, user preferences, consent records, and subscription linkage. It does not directly identify you by name.

Qalb uses this pseudonymous Firebase UID as the RevenueCat App User ID for subscription management.

Subscriptions and payments

Qalb may offer paid subscriptions through Apple's App Store.

Apple handles your payment-card and billing information. Qalb does not receive or store your full payment-card information.

Qalb uses RevenueCat to manage subscription entitlements and purchase status.

Qalb uses the pseudonymous Firebase UID as the RevenueCat App User ID.

Qalb does not intentionally provide RevenueCat with your email address, name, age range, gender, journal content, AI-derived journal information, or custom advertising identifiers.

Qalb does not currently have advertising or attribution integrations enabled in RevenueCat.

Subscription information may include your subscription product, purchase history, renewal or expiration status, entitlement status, and transaction identifiers.

How we use information

We use information processed through Qalb to:

• Provide journaling and AI-assisted features
• Generate reflections and journal metadata
• Provide Qur'anic matching and guidance
• Authenticate access to backend services
• Store first-party profile, preferences, and consent records
• Operate and secure backend systems
• Monitor technical reliability and performance
• Manage subscriptions
• Respond to support and privacy requests
• Send marketing communications where you have opted in or where otherwise permitted by law
• Understand and improve Qalb using permitted aggregate, subscription, technical, and business information
• Identify and respond to potential safety concerns (see "Safety" below)
• Prevent fraud and abuse
• Comply with legal obligations

We do not use Firebase Analytics for behavioral or product analytics in the launch build.

What we don't do

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising.
• We do not use private journal content to build advertising profiles or serve targeted advertisements.
• We do not use advertising pixels on the Qalb website.
• We do not currently use Firebase Analytics for behavioral or product analytics in the launch build.
• We do not intentionally send journal text to RevenueCat.
• We do not intentionally attach your name, email, Firebase UID, or device ID to OpenAI or Anthropic model payloads containing journal text.
• Qalb does not maintain a general cloud archive of journal history.
• Qalb's own production application logging is designed not to contain raw journal text, AI prompts, bridge lines, or extracted journal content.

This does not mean that no third-party system can ever create operational, security, or legal logs under its own terms.

When we share information

Qalb uses service providers to perform specific functions on our behalf. Current providers may include:

• OpenAI, for journal metadata, writing assistance, embeddings, and safety classification
• Anthropic, for AI-generated reflections and parts of Qur'anic matching
• Google/Firebase, for pseudonymous authentication, Firestore profile and preferences, Cloud Functions, App Check, performance monitoring, and infrastructure logging
• Pinecone, for vector retrieval against Qalb's static tafsir/search corpus
• RevenueCat, for subscription and entitlement management
• Apple, for App Store distribution, purchases, StoreKit, and related platform services
• Google, for email, support, and privacy communications
• Website hosting and infrastructure providers
• Public Qur'an-content services used to retrieve verse content based on verse identifiers

Qalb does not send raw journal text, names, emails, Firebase identifiers, or persistent user-profile vectors to Pinecone. Pinecone receives a transient query vector derived from journal content solely to search Qalb's static tafsir corpus. Qalb does not store or upsert journal-derived user vectors in Pinecone.

We limit information shared with each provider to what is reasonably necessary for the relevant function.

Third-party providers handle information according to their own agreements, privacy policies, retention practices, and service configurations.

We may also disclose information if required by law or when reasonably necessary to protect Qalb, our users, or others from fraud, abuse, security threats, or harm.

Data retention and deletion

Local data

Journal entries, drafts, locally stored AI reflections, and Hidayah records remain on your device until you delete them, use Qalb's deletion controls, delete Qalb, or your device or operating system otherwise removes the data.

Deleting Qalb generally removes locally stored app data, subject to device-level or iCloud backups outside Qalb's control.

Qalb does not operate a general cloud backup or journal-history archive.

Firestore profile

Qalb may retain your pseudonymous Firebase profile, including information such as email, optional demographics, consent preferences, notification preferences, and subscription status, while needed to operate your Qalb profile or until you use available deletion controls, subject to applicable legal obligations.

OpenAI

As of the Last Updated date, OpenAI's standard API abuse-monitoring systems may retain certain customer content for up to 30 days depending on the endpoint, subject to security, abuse-prevention, and legal exceptions.

Qalb has disabled OpenAI API Call Logging and the optional API data-sharing settings available to our organization.

Anthropic

Qalb's current Anthropic commercial API configuration uses a 30-day retention period, subject to Anthropic's applicable security, abuse-prevention, and legal exceptions. Qalb has disabled applicable user-feedback and data-sharing participation for this use.

Firebase Performance

Google states that Firebase Performance Monitoring retains IP-associated performance events for 30 days and installation-associated or de-identified performance data for 60 days before removal from live and backup systems.

Google Cloud Logging

Qalb's standard Google Cloud application and request log bucket is configured for 30-day retention. Google's required system and audit logging bucket is configured for 400-day retention and contains administrative and system audit information.

Qalb's production logging has been configured to avoid logging raw journal content or AI prompts in Qalb-controlled application logs.

Subscriptions

Apple and RevenueCat may retain purchase, subscription, entitlement, fraud, accounting, and transaction records according to their agreements and applicable legal requirements.

Email

Marketing contact information may be retained while you receive communications from Qalb. If you unsubscribe, we may retain limited suppression information to ensure the request remains honored.

Support, privacy, security, or legal correspondence may be retained for as long as reasonably necessary to resolve the matter, document our response, protect Qalb and users, or satisfy legal requirements.

Where applicable law requires information to be retained longer, or deleted sooner, we follow those requirements.

If you would like us to delete information that we can reasonably identify as associated with you, contact us at salam@theqalb.app.

Because some Qalb systems use anonymous or pseudonymous identifiers, we may not always be able to connect a particular record to a verified individual.

Your choices and rights

You can:

• Use Export My Data from Settings → Privacy
• Use Delete My Data from Settings
• Delete individual journal entries
• Withdraw AI consent through Qalb's Settings
• Manage marketing preferences in Qalb or unsubscribe from a marketing message
• Manage or cancel subscriptions through Apple
• Use available app-lock or device-security features
• Delete Qalb from your device
• Contact our Privacy Officer about your personal information

Qalb's Export My Data feature creates a structured JSON export on your device using locally stored journal data and available Qalb profile information. The export file is generated locally and is not uploaded to Qalb's backend or AI providers.

Depending on where you live, you may also have legal rights to request access to, correction of, deletion of, restriction of, objection to, or portability of the personal information we process.

You may contact our Privacy Officer at salam@theqalb.app to exercise any applicable privacy rights.

Sensitive information

Your journal may contain deeply personal information, including information about religious beliefs, spiritual practices, emotions, relationships, physical or mental health, or other intimate matters.

Some of this information may be considered sensitive or "special category" personal data under applicable privacy laws.

Qalb does not require you to include this type of information in your journal. Journal content that remains stored locally on your device is not transmitted to Qalb simply because you write or save it.

Qalb's core service uses AI processing. Before journal-derived sensitive information is sent for AI processing for the first time, Qalb asks you to affirmatively enable AI processing.

Where applicable law requires explicit consent for processing sensitive or special-category information, Qalb relies on that explicit consent.

If you do not enable AI processing, Qalb cannot provide its core AI-assisted journaling service.

You may withdraw consent for future AI processing through Settings. Withdrawal does not affect processing that occurred before consent was withdrawn.

Additional information for users in Europe and the United Kingdom

If you are located in the European Economic Area ("EEA") or United Kingdom ("UK"), the following information applies in addition to the rest of this Privacy Policy.

Who is responsible for your information

Ilmara Group LLC, the operator of Qalb, is the controller of personal data processed as described in this Privacy Policy.

You can contact us about privacy matters at salam@theqalb.app.

EU/EEA & UK GDPR Representatives (Article 27)

If you are located in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:

EU Representative:
Euverify Ltd (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork
T23 AT2P
Ireland

Email: gdpr@euverify.com

UK Representative:
Euverify Ltd (UK)
3rd Floor
86-90 Paul Street
London
EC2A 4NE
United Kingdom

Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal at:

https://gdpr.euverify.com/verify/75ec516e-766b-4324-8847-95ace0460e1b

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

You may also contact Qalb directly at salam@theqalb.app.

Legal bases for processing

Depending on how you use Qalb and the processing involved, we rely on one or more of the following legal bases:

• Providing Qalb: processing necessary to provide features and services you request, including processing necessary for the performance of a contract or to take steps at your request.
• AI features: your consent when you enable AI-powered processing required for Qalb's core service.
• Sensitive information submitted for AI processing: your explicit consent where the information constitutes sensitive or special-category data under applicable law.
• Subscriptions: processing necessary to administer services or subscriptions you request.
• Security and service operation: our legitimate interests in operating, protecting, troubleshooting, and preventing abuse of Qalb, where those interests are not overridden by your rights and interests.
• Communications: your consent where required, or our legitimate interests where permitted by law.
• Legal compliance: processing necessary to comply with applicable legal obligations.

Where we rely on legitimate interests, we consider the impact of the processing on your privacy and use this basis only where our interests are not overridden by your rights and interests.

Your EEA and UK rights

Subject to applicable law and certain exceptions, you may have the right to:

• Access personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of personal data
• Restrict certain processing
• Receive certain personal data in a portable format and, where applicable, request its transfer
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with an applicable data-protection supervisory authority

Withdrawing consent does not affect the lawfulness of processing that occurred before your consent was withdrawn.

You can withdraw consent for future AI processing at any time through Qalb's Settings. If you do, Qalb's core AI-assisted features will no longer operate.

Because Qalb generally stores your journal history locally rather than maintaining a server-side copy, we may not possess journal entries that exist only on your device. Privacy requests submitted to us apply to personal data that Qalb or its service providers actually hold or can reasonably identify as associated with you.

To exercise an applicable privacy right, contact us at salam@theqalb.app or use the Euverify portal listed above. We may request information reasonably necessary to verify or fulfill your request.

If you are located in the EEA, you may lodge a complaint with the data-protection supervisory authority in the country where you live or work, or where you believe a violation occurred.

If you are located in the UK, you may lodge a complaint with the UK Information Commissioner's Office (ICO).

Automated processing

Qalb uses artificial intelligence to provide reflections, journal assistance, journal metadata, and Qur'anic matching or guidance as part of its core service.

Qalb does not use the AI processing described in this Privacy Policy to make decisions about you that produce legal effects or similarly significantly affect you.

Additional information for users in Canada

If you are located in Canada, this section applies in addition to the rest of this Privacy Policy. Federal or provincial privacy laws may apply depending on where you live and how Qalb processes your information.

Accountability and Privacy Officer

Ilmara Group LLC is accountable for personal information it processes through Qalb.

We have designated a Privacy Officer responsible for privacy questions, requests, and complaints.

Privacy Officer
Ilmara Group LLC
Email: salam@theqalb.app

Canadian privacy rights

Depending on applicable law and subject to permitted exceptions, you may have the right to request access to personal information Qalb holds about you, request correction of inaccurate information, obtain information about how your personal information has been used or disclosed, withdraw consent where processing depends on consent, request deletion in circumstances provided by law, and make a complaint about our privacy practices.

You may submit a privacy request at salam@theqalb.app. We may request information reasonably necessary to verify or fulfill the request and will respond within the time required by applicable law.

Processing outside Canada

Qalb is operated from the United States. Qalb and its service providers may process personal information in the United States or other jurisdictions outside Canada.

When personal information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies, national-security authorities, or other governmental authorities where legally required.

Qalb uses technical, organizational, contractual, and other safeguards appropriate to the information and services involved.

Québec residents

If Québec privacy law applies, you may have additional rights.

These may include the right, where applicable, to obtain certain computerized personal information collected from you in a structured and commonly used technological format.

Qalb provides an Export My Data feature intended to help users obtain computerized personal information available through the app in a structured JSON format.

Requests, questions, or complaints may be directed to our Privacy Officer at salam@theqalb.app.

Where required by applicable law, Qalb assesses privacy risks associated with applicable electronic systems and processing of personal information outside Québec.

Safety

Qalb uses automated safety classification in AI reflection flows to identify language that may indicate an immediate risk of serious harm.

When a safety classification indicates a potential acute concern, Qalb may withhold AI-generated reflection or guidance for that entry and show crisis or emergency resources instead.

Safety classification is not continuous monitoring. Qalb does not monitor journal entries in real time and is not an emergency service.

Children

Qalb is intended for adults aged 18 and older and is not directed to children or minors.

We do not knowingly solicit or intentionally collect personal information from anyone under 18 through Qalb.

If you believe a person under 18 has provided personal information to Qalb, please contact salam@theqalb.app so that we can take appropriate steps.

Security

We use reasonable technical and organizational safeguards designed to protect information processed through Qalb.

Qalb uses safeguards that include authenticated access to backend services, Firebase App Check for supported app requests, access-control rules, request size limits, rate limits, encrypted HTTPS transport, and privacy-conscious operational logging practices.

Qalb's production application logging is configured to avoid raw journal text, AI prompts, bridge lines, and journal-content extractions in Qalb-controlled logs.

If we become aware of a security or privacy incident involving personal information, we will investigate and take reasonable steps to contain and address it. Where applicable law requires notification, we will notify affected individuals, regulators, or other authorities as required.

No method of local storage, electronic transmission, or cloud processing can be guaranteed to be completely secure.

You are also responsible for maintaining control of your device and using appropriate device-security protections.

International use and data transfers

Qalb is operated from the United States.

Depending on where you live and the features you use, Qalb and its service providers may process personal information in the United States or other countries outside your jurisdiction.

Qalb's core Firebase backend and vector-search infrastructure are currently configured in United States regions.

Privacy laws differ between countries. Personal information processed in another jurisdiction may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies, national-security authorities, or other governmental authorities where legally required.

Where applicable data-protection law requires safeguards for an international transfer, we rely on legally recognized transfer mechanisms as appropriate. These may include adequacy decisions, recognized data-transfer frameworks, Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement or UK Addendum to the European Commission's Standard Contractual Clauses, or other legally recognized safeguards.

The transfer mechanism used may depend on the service provider and countries involved. We do not claim that every United States provider has an EU adequacy decision.

A note about AI-generated content

Qalb is designed for personal journaling and reflection.

AI-generated reflections, prompts, and Qur'anic connections are provided for reflective and informational purposes. They are not a substitute for qualified religious, medical, mental-health, legal, financial, or other professional advice.

Changes to this policy

We may update this Privacy Policy as Qalb evolves.

If we make material changes, we may update the last-updated date, provide notice in the app, request renewed consent where required, or take other appropriate steps.

Contact us

Qalb
Operated by Ilmara Group LLC

Privacy Officer:
Ilmara Group LLC

Email:
salam@theqalb.app

Website:
theqalb.app

EU/EEA and UK users may also contact Qalb's appointed representatives using the contact details or secure Euverify portal listed in the Europe and United Kingdom section above.