Privacy Policy

The short version

We collect as little as we can, we keep it in one place, and we never sell it or share it with advertisers, data brokers or anyone else. Your cycle data is not used to target ads to you, ever. You can delete your account and everything in it at any time.

One thing we want to be plain about rather than bury: when you use a HaidKaki account, your data is stored on our servers and is technically readable by us. It is not end-to-end encrypted. We hold it so that you can change phone, reinstall, and find your history intact.

1. Who we are

HaidKaki is a product of NextProdigy Sdn. Bhd. (Company No. 202601002678), incorporated in Malaysia, registered office D-01-01, Menara Mitraland, No 13A, Jalan PJU 5/1, Kota Damansara, 47810, Petaling Jaya, Selangor, Malaysia. We are the data controller for the personal data described here. Contact: support@haidkaki.com.

2. If you join the waiting list

Before the app is released you can join a waiting list, either on this website or through a form inside Facebook or Instagram. In both cases we receive:

• your email address;
• and, only if you used the longer form and chose to answer, an age range, a school of jurisprudence (madhhab), and whatever you wrote in the free-text question.

We use this to tell you when HaidKaki is available and to understand what people need from it. We do not add you to any other mailing list and we do not pass your address to anyone. You can ask us to delete it at any time by writing to support@haidkaki.com, and every email we send carries an unsubscribe link.

If you signed up through a form inside Facebook or Instagram, Meta also holds a copy of what you submitted, under its own privacy policy.

3. This website

The pages where you can sign up carry the Meta advertising pixel, so that we can tell which advertisements bring people who actually join. It records that a visit and a signup happened, not anything about your body or your beliefs. It is not present on the home page.

We do not run any other analytics or tracking on this site.

4. The app, and what it stores

The app works without an account: your record stays on your device. If you create an account, with an email address and a password or through Google, the following is stored both on your device and on our servers:

• Cycle data you log — bleeding days and flow, discharge and purity observations, symptoms, postpartum (nifas) status, and optional intimacy tracking, which is off unless you turn it on.
• Religious settings — the madhhab you select, the country you live in (which you choose yourself; the app never reads your location), Hijri date adjustment, and your worship-related preferences.
• Records the app keeps for you — ghusl history, missed-fast (qadāʾ) balance, planned fasts, notification settings, and where you are in onboarding.
• Account data — your email address, your year of birth (asked when the account is created, to check the minimum age), your consent with its date, and, if you gave one, a first name.

Two of these categories, health and religious belief, are treated as sensitive under Malaysian, Indonesian and European data protection law. We ask for your explicit consent before collecting them, and you may withdraw it by deleting your account.

5. Where it is stored, and who can reach it

Our database is hosted with Supabase in Singapore. Every row is protected by row-level security, which means a signed-in account can read and write only its own data and can never reach another person’s. Access on our side is restricted to the people who operate the service.

The app keeps a copy on your device and works offline; it synchronises when you reconnect. If you install the app on a second device and sign in, your entries are merged rather than overwritten, so signing in somewhere new never deletes anything.

6. What we never do

• We never sell your data, to anyone, for any price.
• We never share your cycle, symptom or religious data with advertisers, data brokers, insurers, employers or any third party, and we never use it to target advertising.
• We carry no advertising SDK and no third-party analytics inside the app.
• We do not read or write Apple HealthKit or Android Health Connect, and we ask for no health permissions from other apps.
• We never show your data, or any claim about your state, to another person. Nothing in HaidKaki can be demanded, polled or presented as proof by anyone else.

7. What you can send, if you choose to

The app can produce a summary you may send to a doctor or to a scholar. It is generated only when you ask for it, it goes only where you send it, and once it leaves the app it is outside our control. Nothing is ever sent automatically.

8. How long we keep it

We keep your data for as long as your account exists. When you delete your account, the data is deleted from our live systems within 30 days and from routine backups within 90 days. Waiting-list addresses are deleted on request, and in any case once the address has been unsubscribed for a year.

9. Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or withdraw your consent. Write to support@haidkaki.com and we will answer within 30 days. If you are in Malaysia you may also complain to the Personal Data Protection Department (JPDP); in Indonesia, to the authority designated under UU 27/2022; in the European Economic Area, to your national supervisory authority.

10. Age

HaidKaki is not for children under 13, and we do not knowingly hold data from anyone younger. Between 13 and the age of majority where you live, local law may require a parent or guardian to consent on your behalf. If you believe a child under 13 has an account, write to us and we will delete it.

11. Changes

If we change how we handle your data we will update this page and change the date at the top. If the change is significant we will tell account holders by email before it takes effect.