Privacy Policy

Last updated: June 2026

Ajwa ("we", "us", or "our") is committed to protecting your privacy. This policy explains what information we collect when you use the Ajwa app or website, how we use it, and the choices you have.

1. Information we collect

We collect information you provide directly when you create or update your account:

Account details: email address, password (stored as a salted hash — never in plaintext), username.
Profile information: display name, age, gender, religion, location (city, state/province, country), profile text (About me, Looking for, Anything else), and keywords/chips.
Photos: images you upload are stored in a private, access-controlled cloud bucket. They are only accessible to users you have sent or accepted an interest request from.
Messages: the content of messages you send and receive within the app.
Device information: device push notification tokens (for sending notifications) and the platform (iOS or Android).
Activity data: the time you were last active in the app, used to show your online status and order search results.

2. How we use your information

To operate and provide the Ajwa service — matching, messaging, and profile discovery.
To send push notifications about new messages and connection activity (you can disable these in Settings).
To send transactional emails such as email verification and password resets.
To respond to support requests and feedback you send us.
To maintain the security and integrity of the platform, including investigating reports and removing users who violate our Terms of Use.
To notify users when someone they were connected with has been removed from the platform for a Terms of Use violation. We do this to protect your safety. The notification does not identify the removed user by name.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

3. How we store your information

Your data is stored on servers within our infrastructure:

Account and profile data is stored in a PostgreSQL database hosted on a dedicated server.
Photos are stored in a private Supabase storage bucket. Signed, time-limited URLs are used to serve your photos — they are never publicly accessible without authorisation.
Session data is stored server-side and tied to a secure cookie on your device.

4. Information shared with other users

Profile information (name, bio, gender, keywords) is visible to other users on the platform.

Photos are private by design — they are only made visible to users you have sent an interest request to, or users whose interest request you have accepted. No one else can see your photos.

Messages are shared only with the user you are in conversation with.

We do not share your email address or device token with other users.

5. Third-party services

We use a small number of trusted third-party services to operate the platform:

Supabase — private photo storage.
Firebase Cloud Messaging (Google) — push notifications delivered to your device. Only a device token and message content are transmitted.
PurelyMail — transactional email delivery (verification emails, password resets).

Each of these services processes only the minimum data necessary to perform their function.

6. Cross-app tracking

We do not track you across other apps or websites for advertising purposes. Ajwa does not use any cross-app tracking technologies, does not participate in advertising networks, and does not share data with data brokers. We respect Apple's App Tracking Transparency (ATT) framework — we will never request ATT permission because we have no use for cross-app tracking.

7. Security

Passwords are stored using salted cryptographic hashes — your plain-text password is never stored.
Photos are stored in a private bucket with no public access; signed URLs expire after one hour.
Communication between the app and our servers uses encrypted connections (HTTPS/WSS).

No system is completely secure. While we work hard to protect your data, we cannot guarantee its absolute security. Please use a strong, unique password and keep your credentials private.

8. Your rights and choices

Access: you can view all profile information stored about you at any time within the app.
Update: you can edit your profile, photos, and preferences from within the app.
Delete: you can permanently delete your account from Settings → Delete Account. This removes all your data — profile, photos, messages, and connections — from our systems.
Notifications: you can manage push and email notification preferences from Settings → Notifications.
Hidden mode: you can hide your profile from discovery at any time from Settings without deleting your account.

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: you may request information about the categories and specific pieces of personal information we have collected about you, the sources, our business purposes for collecting it, and any third parties we share it with.
Right to Delete: you may request deletion of your personal information. Use "Delete Account" in Settings to permanently remove all your data immediately.
Right to Correct: you may correct inaccurate information at any time through the Edit Profile screen.
Right to Opt-Out of Sale or Sharing: we do not sell or share your personal information for cross-context behavioural advertising. There is nothing to opt out of, but you may contact us to confirm this at any time.
Right to Limit Use of Sensitive Personal Information: some information we collect (religion, interests that may reflect sexual orientation, location) is classified as Sensitive Personal Information under California law. You may request that we limit our use of this information to what is strictly necessary to provide the service. Use the "Limit Use of My Sensitive Information" toggle in Settings → Privacy Controls.
Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.

To exercise these rights, use the controls in the app or contact us at [email protected]. We respond to verifiable requests within 45 days.

10. Legal basis for processing (EEA & UK users)

If you are located in the European Economic Area (EEA) or the United Kingdom, the following legal bases apply to our processing of your personal data:

Contract fulfillment: we process your account information, profile data, and messages because it is necessary to provide the Ajwa service you have agreed to use.
Legitimate interests: we process activity data (last seen, online status) for security and abuse prevention, where our legitimate interests are not overridden by your rights.
Consent: where we process Sensitive Personal Information (religion, interests that may reflect sexual orientation, location), we rely on your explicit consent given when you choose to provide this information. You may withdraw consent at any time by removing the relevant data from your profile or deleting your account.

If you are in the EEA or UK, your data may be stored on servers outside the EEA/UK. Where this occurs, we ensure appropriate safeguards are in place consistent with applicable law (including standard contractual clauses where required).

11. Data retention

We retain your data for as long as your account is active. Specific retention periods:

Account and profile data: retained until you delete your account.
Messages: retained for up to 2 years from the date sent, then automatically deleted.
Notifications: retained for 90 days from the date received, then automatically deleted.
Session data and authentication tokens: expire automatically (email verification tokens within 24 hours, password reset tokens within 1 hour).
Photos: retained until you delete them or your account is deleted.

When you delete your account, all your personal data is permanently removed from our systems. Anonymised, aggregated data that cannot identify you may be retained for service improvement.

12. Children's privacy

Ajwa is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, their account will be removed immediately.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Ajwa after changes are posted constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this Privacy Policy or how your data is handled, please contact us at [email protected].