Privacy Policy
Last updated: 28 July 2026
Niyyah is operated by Hugo Software. This policy explains exactly what the app stores, where it stores it, and how to get rid of it.
We have tried to write this so you can actually tell what happens to your data. If something here is unclear, write to us and we will fix the wording.
What we collect
What you type into your profile. First name, age, city, a short bio, your stated intention, your level of practice, an optional guardian (wali) contact, and your interests. All of it is optional except a first name, an age and an intention.
Photos you upload. Up to six. They are resized on your phone before they are sent, stored in a private bucket, and only ever delivered through short-lived signed links. They are not on a public URL. A new photo is not visible to any other member until a person has reviewed and approved it.
What you do in the app. Which profiles you connected with or skipped, your matches, and the messages you exchange with people you have matched with.
Purchases. If you buy a subscription or a pack, we store the Google Play purchase token and what it entitled you to. We never see your card, your billing address or your name as it appears on the card — Google Play handles payment entirely.
Reports and blocks you create, so we can act on them and keep the blocked person away from you.
A count of how many times you were shown an upgrade screen. This is ours alone, used to judge whether the app is being pushy. It is not sent to anyone.
What we do not collect
- No location. Your city is a text box you fill in. The app never reads GPS or network location.
- No advertising identifier, and no advertising at all. There is no ad SDK in Niyyah.
- No analytics or crash-reporting SDK. No Firebase, no Google Analytics, no third-party tracker of any kind.
- No contacts, no microphone, no background camera.
- No email address or password, unless you choose to add one later. The app signs you in anonymously.
Where it lives
On Supabase (PostgreSQL, Storage and Auth), hosted in the European Union — Frankfurt, eu-central-1. Supabase Inc. is our data processor.
The only other company involved is Google, for Play Billing when you buy something and for verifying that the purchase was real.
How long we keep it
While your account exists. Delete the account and it goes.
We may keep a record of a report after the account it concerns is gone, where that is what stops a banned person from simply coming back.
Deleting your account
In the app: Settings → Delete account and data. You will be asked to confirm once, and then it is done.
That deletes your profile, your photos, your matches, the messages in them, your purchase entitlements and the account identity itself. It is a deletion, not a deactivation, and it cannot be undone. The people you had matched with will no longer see the conversation.
If you cannot reach the app, see Data deletion or write to [email protected] and we will do it for you.
Your rights
You can ask us what we hold about you, ask for a copy, ask for corrections, or ask us to delete it. Write to [email protected]. If you are in the EU or UK, these are your rights under the GDPR and we will answer within one month.
Age
Niyyah is for adults. The minimum age is 18 and the app enforces it when you create a profile. It is not directed at children and we do not knowingly hold data about anyone under 18. If you believe we do, tell us and we will remove it.
Changes
If we change how any of this works, we will update this page and the date at the top. Material changes will be announced in the app.