Ryhla

Legal

Privacy Policy

Updated 22 August 2026 · Operated by Dynatheia LLC

On this page

On this page

The short version. Your dhikr, prayers, notes, Quran progress and Zakat records are encrypted on your device before they leave it. We hold the encrypted result and cannot decrypt it. There is no analytics, advertising or tracking of any kind.

What we hold

Your account

  • Email address: to create your account, sign you in, confirm your address and send password reset codes.
  • Password: never stored. Our authentication provider keeps only a cryptographic hash. Separately, your password derives an encryption key that never leaves your device.
  • Wrapped encryption keys: your data key, held twice in locked form: once under your password, once under your recovery phrase. We hold both locked copies and can open neither.

Your content, encrypted

With a subscription and sync enabled, these are stored on our servers as ciphertext: dhikr definitions and counts, prayer records, Quran reading progress, Zakat records, notes, and accomplishment history. Each is encrypted on your device with XChaCha20-Poly1305, using a key derived from your password with Argon2id.

Voice note audio is never uploaded. It stays on the device that recorded it.

What sits in the clear next to it

Being specific rather than claiming more than is true: each encrypted record carries a little unencrypted routing information, without which syncing between your own devices would be impossible.

  • A random record identifier
  • Your account identifier
  • A last-modified timestamp
  • Bookkeeping fields used when a password is reset

What that means in practice: someone with access to our database could tell that an account was active at particular times, and roughly how many records exist. They could not tell which dhikr, which prayers, which notes, or a single word of any content.

Subscriptions

Apple and Google handle purchases. We never see your payment details. Our subscription provider tells us only whether an account has an active subscription, tied to an account identifier.

What we don't do

  • No analytics or usage tracking
  • No crash or telemetry reporting
  • No advertising, and no advertising identifiers
  • No selling, renting or sharing personal information
  • No profiling, no automated decision-making

Location

Ryhla can use your device location to calculate prayer times and the direction of the Qibla. This happens entirely on your device. Your coordinates are not sent to us, not stored on our servers, and not shared with anyone.

You can decline the permission and set your city manually instead. This website also offers to calculate prayer times; if you use it, your coordinates are used in your browser and go nowhere else.

Third parties we rely on

  • Supabase: database and authentication hosting. Sees your email address and your encrypted records.
  • Resend: sends account email such as confirmations and reset codes. Sees your address and those messages.
  • RevenueCat: subscription status. Sees an account identifier and whether a subscription is active.
  • Apple and Google: app distribution and payment, under their own privacy policies.
  • Cloudflare: hosts this website.

None of them can decrypt your content.

How long we keep things

  • Account information and encrypted records stay for as long as your account exists, including after a subscription lapses.
  • If you reset your password without your recovery phrase, your previous encrypted records are archived for 365 days, so they can be restored if you later find your old password or phrase. After that they are deleted.

Deleting your account

Email support@ryhla.app from your account's address and we will confirm and delete everything within 30 days.

Uninstalling the app removes all local data on that device. If you never enabled sync, that is all the data there ever was.

The honest limit of real encryption

If you forget your password and lose your recovery phrase, your data cannot be recovered, not by you and not by us. No key exists anywhere that would let us help. That is what end-to-end encryption actually means, and we would rather say it plainly now than have you discover it later.

Your rights

Depending on where you live you may have rights to access, correct, export or delete your personal information, or to object to how it is processed. Email support@ryhla.app and we will help. Note that we can only provide encrypted content in the form we hold it. The readable version exists only on your devices.

Children

Ryhla is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

Where data is held

Our servers are in the United States. If you use Ryhla from elsewhere, your information is processed there.

Changes

If this policy changes we will update the date above, and for anything significant we will tell you in the app before it takes effect.

Contact

support@ryhla.app