# Privacy Policy

> We collect what Rifqa needs to work, keep sensitive information encrypted, and delete it on a fixed schedule.

- Web page: https://rifqa.fun/privacy
- In Arabic: https://rifqa.fun/ar/privacy.md

Last updated: 2026-09-29

## In short

- We collect what Rifqa needs to work, keep sensitive information encrypted, and delete it on a fixed schedule.
- No advertising, no ad trackers, no analytics trackers, and we never sell your information.
- Your exact location is never stored or shown. You can download or delete your data at any time.

## 1. Who is responsible

The operator of Rifqa ("we", "us") decides how your information is used in Rifqa and is responsible for it. To ask anything about your information or to use your rights, email privacy@rifqa.fun, or use Help & support in the app.

This policy covers members, people invited as chaperones, trusted contacts named in a safety check-in, and visitors to the website.

## 2. What we collect

From you, when you use Rifqa:

- Account: email address, or for an account made without one, a username (stored only as a keyed one-way code that we can't read back), password (stored only as a one-way hash), date of birth, language, recovery codes (stored only as keyed codes), passkeys you add (only their public key), and the devices you have signed in on (a short description such as "Chrome on Android").
- Profile: first name, gender and who you'd like to meet, the age range you're looking for, what you're looking for, city and country, bio, job, answers to prompts, photos, and, only if you choose, how you describe your religiosity and sect.
- Approximate location: when you allow it, your device's position is reduced to the centre of an area about 2 km across, then encrypted. Your exact position is never stored, and no one else ever sees any location, only a rough distance (such as "within 10 km").
- Live selfie: the selfie you take for verification or for the 18+ age check, the pose you were asked for, and the results of the check (such as an estimated age range).
- The 18+ area, if you use it: your 18+ nickname and the words you write there, when you accepted its rules, when you passed its age check, and your conversations there.
- Activity: likes, passes and the comments you add, matches, messages (and the pictures you send in them), chat rooms you join and what you write and share there (pictures included), message requests, reports and blocks you make, support requests, safety check-ins (the meeting place, time, your time zone, and your trusted contact's name and email), and chaperones you invite (their name, email and relationship to you).
- Settings: notification choices, privacy settings, and, if you use them, codes made from phone numbers so people you know don't see you (see section 6).

Automatically, for security:

- Your IP address, when you sign up and until your selfie check passes, and each time you use the 18+ area: we compare it with open lists of data-centre and VPN addresses, and your device's location and time zone with the country of your connection. We don't store your IP address, its country or the result in our database. It appears briefly in the counters that limit repeated requests, for at most a day.
- Technical records of requests (which page or action, when, and whether it worked), without your IP address or the content of what you sent. Our hosting providers' systems handle your IP address to deliver pages and may keep it briefly in their own logs.

From others: what other members say about you in a report, and what chaperones and trusted contacts do in the parts of Rifqa you invited them to.

## 3. How we use it, and why

- To provide Rifqa: your account, profile, matches, messages, chat rooms, support, check-ins and chaperones. This is needed to provide the service you asked for.
- To show you people who fit what you're looking for, and to rank them by how well your profiles fit (see section 4). This is part of the service.
- To keep people safe: checking that members are real adults, checking messages, photos and profile text, handling reports, stopping scams and fake accounts, and protecting accounts from being taken over. This is our legitimate interest and yours, and in some places a legal duty.
- To run the 18+ area where it's open: checking your age once, and your country and connection each time, and keeping it apart from the rest of Rifqa.
- To contact you: codes, security notices and safety emails (for an account without an email, security notices come as push notifications). We don't send marketing.
- To meet legal obligations, and to answer lawful requests from authorities.

Your religiosity and sect, if you add them, your live selfie, and what you share in the 18+ area are sensitive information. We use them only with your explicit consent, which you give by adding them, by taking the selfie, or by entering the 18+ area. You can remove your religion answers or leave the 18+ area at any time; selfies are deleted on the schedule in section 8.

## 4. AI and automated decisions

We use Google's Gemini AI service, on paid terms under which Google may not use what we send to improve its own products. We send only what each task needs:

- messages, room text, and pictures shared in chat rooms and conversations, to check for scams, harassment, threats, anything involving minors and explicit content (not who sent them). So the same short message isn't checked twice, the result for it is kept for 7 days with a keyed code of its words (not the words themselves). In the 18+ area, explicit messages and pictures between two people who accepted each other are allowed, and the AI checks them for what's never allowed. The AI is used only to check content, never to write sexual content;
- photos, to check they're allowed; your selfie with your main photo, to check it's you and that you are an adult; for the 18+ age check, your selfie alone, to estimate your age;
- your 18+ nickname and words, to check them against the 18+ area's rules;
- your bio, job and prompt answers, to rank people by how well profiles fit and to suggest conversation openers (never your name, age, location, religion or photos);
- the text of your support request and the conversation in it, with basic facts about your account (not your email or your other messages), so the assistant can answer you. It passes the request to a person when it can't help, when a decision is needed, or when you ask. Requests about safety always go straight to a person, without the AI reading them.

Some decisions are automatic in clear cases: holding a message, rejecting a photo, or approving or rejecting a selfie or an age check. Anything unclear, and anything suggesting someone may be under 18, goes to a person. You can always ask for a person to review an automatic decision through Help & support.

Every picture you upload (profile photos, pictures in chat rooms and conversations, and the selfies for the checks) is also compared, before it's stored or anyone sees it, with lists of known child sexual abuse images kept by child-protection organisations. For that, the picture is sent to the service we use for it: the Canadian Centre for Child Protection's Arachnid Shield, or Microsoft's PhotoDNA. A picture that matches is never shown, the account that uploaded it is closed at once, and it's reported to the authorities with what the law requires (the picture, the account's email and the address it was uploaded from).

## 5. Who can see your information

- Other members in your section: your profile (first name, age, city, bio, job, prompts, what you're looking for, and the verified badge or the unverified label), your approved photos (blurred until you match, unless you turn that off) and a rough distance. Never your email, date of birth, location, religion answers or selfie.
- In chat rooms: only the name you chose for that room and what you write and share there. Not your profile, photos or account. Public chat rooms (except 18+ ones) can be read by any visitor who confirms they're 18 or older, including people without an account, and search engines may show them; copies they made may take a while to go after you delete something. You can keep what you write in public rooms to signed-in members only. Reactions and who's online are shown only as counts, never who, and you can choose not to be counted or shown typing (when you are, it shows the name you use in that room). Links to pictures in chat rooms expire after two hours; on a public room's page they're for anyone reading it. Each past day of a public room is also kept as a page of its own (its archive), which search engines may show; anything removed, and the words of anyone who keeps theirs off the public pages, leaves it too. A room's owner and admins see a log of what they did in the room (removals, bans and their reasons, mutes), with the names used there.
- In the 18+ area: only your 18+ nickname, your age, your gender, whether you're verified and the words you write there, to people there who fit your preferences, and the pictures you send in a conversation, to the person you send them to. Never your name, profile photos, location or dating profile, and nothing from the 18+ area is shown anywhere else. Chaperones never see anything from it.
- Your matches: your messages to them, and whether a chaperone is involved.
- Chaperones you invite: only what you allow (your matches, and messages from the moment you allow it: that a picture was sent, never the picture, and nothing you unsent). You can change or remove this at any time, and you can see when they looked.
- Your trusted contact in a check-in: your first name, the first name of the person you're meeting (if you picked a match), the meeting place and time, and whether you checked in.
- Rifqa's staff: only as needed for moderation, verification, support and security. Moderators read messages our checks hold back or that are reported, including in the 18+ area. Every time they look at someone's information is recorded.
- Service providers who work for us under contract and only on our instructions: Railway (servers and database), Netlify (website), Resend (email), Google (Gemini AI), the Canadian Centre for Child Protection or Microsoft (checking uploaded pictures against known child abuse images), and your browser maker's push service (Google, Apple, Mozilla or Microsoft) for notifications, which carry no names or message text.
- Authorities, when the law requires it, or when we believe it's needed to prevent serious harm.

We don't sell your information, rent it, or share it for advertising.

## 6. Your privacy controls

- Hide from people you know: phone numbers from contacts you pick are turned into codes on your device before they're sent, and we store only a further keyed code, never the numbers. People whose number matches don't see you, and you don't see them. Changes take effect after a random delay of 18 to 30 hours.
- Incognito: only people you've liked can see you.
- Blurred photos: others see your photos blurred until you match, and, if you choose, until you decide to show them.
- Chat room privacy: keep what you write in public rooms off the public pages, choose not to be seen online or typing, choose who can ask to message you (anyone, verified members only, or nobody), have your room messages remove themselves after 7, 30 or 90 days, and delete everything you've written in one room or in all of them. Notifications can be turned off for each room.
- Unsend: take back a message you sent in a conversation (a match's, one from a room, or one in the 18+ area), a picture included. It goes for both of you at once.
- App lock with your device's own unlock, a blurred screen when the app is in the background, and a discreet "Notes" icon.
- Notifications you can turn off by type. They never show names or message text.

## 7. How we protect it

Your email address, the names of your devices, messages, religion answers, location, check-ins, chaperone details, support requests and report evidence are encrypted when stored: your account is found by a keyed code of your email address, never the address itself. So is your date of birth, except the copy on a dating profile, which matching uses to find people in the ages you choose (others only ever see your age). Every photo and selfie is encrypted too, each file with its own key, and your selfie is never shown to other members; each time our staff open a selfie to review it is recorded. Passwords, codes, links and usernames are stored only as one-way hashes or keyed codes, and passkeys only as public keys. Photos are only reachable through links that are signed for the person viewing them and expire after 15 minutes. Every connection is encrypted. Signing in on a new device needs a code from your email, a recovery code or a passkey. Staff accounts need two-factor sign-in, and staff actions are recorded.

Messages are not end-to-end encrypted, because they are checked for scams and harassment. No system is perfectly secure; if a breach affected your information, we would tell you and the authorities as the law requires.

## 8. How long we keep it

- Your account and profile: until you delete your account. Deletion happens 7 days after you ask (you can cancel until then); your account, profile, photos and messages are then erased.
- Your live selfie: deleted 30 days after the check is decided, or after 30 days if it was never decided. A copy of the main photo it was compared with is kept while your account exists, to check that a new main photo still shows you.
- Your 18+ age-check selfie: deleted as soon as the check is decided, at once when the AI decides or when a person does (after 30 days if it was never decided). Whether you passed is kept while your account exists.
- The 18+ area: your 18+ profile until you leave the area or delete your account. Messages there are kept like other conversations: while the conversation lasts, then 30 more days.
- Messages: while the match, conversation or chat room lasts. Messages of a match or a chat room conversation that ended: 30 more days (with the names used in the conversation); the record that the conversation took place, 90 days. Rooms deleted by their owner, and room messages that were removed: 30 days. The earlier words of a room message you edited: 30 days. A message you unsent in a conversation: hidden at once, and kept 30 days only in case the conversation is reported. Pictures shared in chat rooms and conversations are kept and deleted with their message; a picture you unsent is kept out of reach for those 30 days only (if the conversation is reported meanwhile, the report keeps a copy as its evidence).
- A comment sent with a like: it becomes the first message when you match; without a match it is deleted after 90 days.
- Rejected photos: 30 days. Safety check-ins: 30 days after the check-in time. Today's picks: 30 days.
- Report evidence: 180 days after the report is resolved; the fact that a report was made and its outcome are kept longer, to spot repeat offenders.
- Resolved support requests: 1 year. The record of when a chaperone looked: 180 days.
- A picture that matched known child sexual abuse material, with the details of its upload: kept as evidence until a year after it's reported to the authorities (longer if they ask), then deleted. A record that it happened, without the picture, is kept.
- If an account is removed for breaking the rules, a keyed code of its email (not the address itself) is kept so it can't sign up again; an account without an email has none to keep. Reports about it are kept without its details.

## 9. Your rights

Depending on where you live, you have the right to see, correct, download and delete your information, to object to or limit how it's used, and to withdraw consent. In Rifqa:

- Edit your profile any time (Me → Edit profile).
- Download everything we hold about you (Me → Settings → Download my data).
- Delete your account (Me → Settings → Delete my account).
- For anything else, email privacy@rifqa.fun, or use Help & support in the app. We answer within 30 days.

You can also complain to the data protection authority where you live.

## 10. Your browser and cookies

Rifqa doesn't use advertising or analytics cookies or trackers. Your browser stores only what the app needs: your sign-in (encrypted, on your device), your language, a few settings such as the app lock and the "Notes" icon, and the parts of the app that let it open offline. None of it is shared with anyone.

## 11. Where your information is processed

Our servers and service providers may be in a different country from yours. When your information goes to another country, we rely on the safeguards that the law requires, such as the providers' data protection terms.

## 12. Children

Rifqa is only for adults (18 or older). An account that may belong to someone under 18 is held out of Rifqa while a person checks, and removed if it does. The public chat rooms are for adults too: visitors are asked to confirm they're 18 or older before reading them. Uploaded pictures are checked against known child sexual abuse images, and matches are reported to the authorities.

## 13. Changes to this policy

When we change this policy in a meaningful way, we update the date at the top and ask you to accept it in the app before you continue.