Privacy policy

1. Information we collect

Account Information: When you create an account, we collect your email address. You may optionally provide a display name and avatar.

Device Information: When you register a mobile device, we collect your device platform (Android/iOS), app version, OS version, and device model. This helps us provide platform-specific features and troubleshoot issues.

Aggregated Usage Statistics: We collect daily aggregated statistics including the number of blocked attempts, overrides, time saved, and category-level usage breakdowns. We do not collect specific URLs, domain names, or browsing history.

Payment Information: Payment processing is handled entirely by Stripe. We never store your credit card numbers or bank account details.

Product analytics: We use PostHog in anonymized mode to understand how the product is used (screens viewed, features used, funnel steps). Analytics never includes your browsing activity, domain lookups, or the content the filter sees, and we use no advertising or tracking SDKs.

Referral data: If you arrive through a referral link, we record the referral code and — once you verify your email — which member referred you, so we can pay that member their commission. To keep the program honest at scale we also capture fraud-prevention signals (sign-up IP address, a device identifier, and a card fingerprint provided by Stripe) used solely to detect self-referrals and referral fraud, never for advertising.

2. How we use your information

• To provide and maintain the NurGuard Shield service
• To send authentication emails (sign-in codes)
• To generate your analytics dashboard and streak tracking
• To send accountability reports to your designated partners (if enabled)
• To process subscription payments and donations
• To send push notifications for streaks, prayer times, and tamper alerts

3. Content filtering

Content filtering happens at the network level — the shield. When a device on NurGuard looks up a domain, our resolver checks it against our blocklists: blocked domains are refused, and everything else resolves normally. Our resolver necessarily sees the domains your device asks to resolve — that is how filtering works — but it never logs or stores individual lookups, never sees the content of your traffic, does not build browsing-history profiles, and never sells this data. The only record it keeps is your daily count of blocked lookups — a single number with no domains and no timestamps, stored in your daily usage statistics and retained for 365 days like the rest of your dashboard history (see section 7).

Where you enable on-device app management, that enforcement runs locally on your device. On iOS it uses Apple Screen Time (Family Controls). On Android it uses two system permissions, and this is exactly what each one does:

Android accessibility service: used for one purpose — detecting which app has moved to the foreground, so the Niyyah Gate can show its pause before an app you chose to gate opens. The service is configured so it cannot read window content: it does not read, log, or transmit your screen content, messages, or anything you type, and which apps you open is processed only on your device — it is never sent to our servers or to analytics.

Android VPN (VpnService): NurGuard runs its DNS filter as a local VPN. Only your device's domain lookups pass through it — checked against a blocklist on your device, then resolved through our encrypted resolver as described above. Your actual web traffic is never proxied, inspected, stored, or transmitted.

4. Accountability reports

If you opt into the accountability partner feature, your designated partner will receive periodic reports containing aggregated statistics: blocked attempts, overrides, compliance score, time saved, and category breakdowns. Reports never contain specific URLs or browsing history.

5. Sensitive data

By its nature, NurGuard touches data connected to a struggle most people would never want exposed. We treat everything in that category as sensitive personal information (in the sense of laws like the CPRA and GDPR) and hold it to a stricter standard than the rest of your data:

• Private reflections (relapse notes): If you write a private note in the app, it is encrypted at the application layer (AES-256-GCM) before it is stored. Only you can read it. It is never shown to accountability partners, guardians, or staff, never used for analytics, and if encryption is ever unavailable the note is discarded rather than stored unprotected.
• Relapse and struggle data: Never leaves your account. Accountability reports carry aggregated statistics only (section 4); the “request a dua” feature sends a content-free nudge with no details attached.
• Browsing content: We do not collect the URLs or domains you visit (section 3), so a browsing profile of you does not exist for anyone to expose.
• No advertising use, ever: Sensitive data is never sold, shared for advertising, or used to build marketing profiles. There are no ad or tracking SDKs in the product.

6. Data sharing

We do not sell, rent, or share your personal information with third parties, except:

• Stripe: For payment processing
• Stripe Connect (affiliates only): If you opt into affiliate payouts, Stripe collects your identity and tax information directly during onboarding. We receive payout status, not your tax details.
• PostHog: Anonymized product analytics, as described above
• Web Push (VAPID): For browser and installed-PWA notifications you opt into. No third-party push vendor.
• Accountability Partners: Aggregated reports only, at your request

Infrastructure subprocessors that host or transmit data on our behalf (under contract, for the purposes above): Cloudflare (DNS resolution and edge infrastructure), Railway (application hosting and PostgreSQL database), Upstash (Redis cache and rate limiting), and Resend (transactional email).

Public leaderboard: The affiliate leaderboard is strictly opt-in. You appear only if you choose a display handle, and only that chosen handle and your referral count are shown — never your name, never your email, never anything about your own use of the product. You can remove your handle at any time in Settings, which removes you from the leaderboard immediately.

7. Data retention

We keep as little as we can for as short as we can. Your account data lives for as long as your account is active. Beyond that, an automated schedule deletes older records on a fixed timetable: aggregated daily usage statistics are removed after 365 days, our send-history ledgers (used only to avoid sending you the same reminder or notification twice) after 90 days, and affiliate leaderboard snapshots after 180 days.

The narrow exception is records we are legally required to keep or that protect the service: billing and payment records (retained for the period tax and financial-records law requires) and records needed to prevent fraud or abuse. Where those must be kept after you leave, we de-link them from your identity — they remain as financial entries, not as data about you.

You can request deletion of your account and all associated data at any time by contacting us at [email protected].

8. Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), JWT-based authentication with token rotation, and secure password-less email code authentication. Tokens are stored in secure storage (Keychain on iOS, Keystore on Android).

9. Children's privacy (COPPA)

NurGuard Shield is for adults. A NurGuard account holder must be 18 or older. We collect a date of birth at sign-up to enforce this: anyone under 13 is blocked before any account is created and we keep none of their information, and anyone 13–17 cannot open their own account.

On a household plan, a parent or guardian can create a managed profile for a child aged 13–17 and consents on the child's behalf to our operating the filter for that child's device. A youth profile exists only to protect that device — it has no billing, purchase, or affiliate/earning ability, and we never ask a child to refer or recruit anyone. A guardian can view a profile's protection status but not the child's private message content; NurGuard filters, it does not covertly surveil. A parent may review or delete a child's data, or remove a youth profile, anytime at [email protected].

10. Your rights

Wherever you live, you can ask us to access, correct, export, or delete the personal information we hold about you, and you can withdraw consent or close your account at any time. If you are in the EU/EEA or UK, you have these rights under the GDPR; if you are in California, you have the rights described in the CCPA/CPRA, including the right to know and the right to delete. We do not sell your personal information and never have, so there is nothing to opt out of — but you may still exercise every right above. To make a request, email [email protected] and we will respond within the time your law requires. We will never charge you or degrade your service for exercising a privacy right.

11. Changes to this policy

We may update this policy as the product evolves. When we make a material change, we will update the “Last updated” date above and, where the change is significant, notify you by email or in the app. Continuing to use NurGuard after a change takes effect means you accept the updated policy.

12. Contact

NurGuard is operated by Rizq Labs AI LLC (Florida, USA). For questions about this privacy policy, contact us at: [email protected]