Privacy policy

Mihwar (محور) · Version 2026-08-21 · Last updated: 21 August 2026

Mihwar is local-first. Your private app content is stored in SQLite on your device by default. iCloud sync is optional and can copy supported content, including journals and habits, to your private CloudKit database.

Who is responsible

Muhammad "Shaaf" Kashan, trading as Mihwar in the United Kingdom, is the controller for the processing described in this notice. "Mihwar", "we" and "us" refer to that sole-trader business.

For privacy questions, rights requests or a data protection complaint, email mihwarlive@outlook.com. Use the subject "Privacy" or "Data protection complaint". Please do not include prayer logs, health details, journal text or other sensitive app content in an email.

The short version

Information, sources and choices

Most information comes from you when you enter a name, confirm a location, record habits or prayers, write reflections, use the companion, build a plan, or contact support. With permission, information can also come from your device and Apple services, including calendar events, timezone, geocoding results and StoreKit purchase status. Mihwar creates derived information on your device, such as plans, summaries, insights and companion responses.

Prayer practice, intentions, Quran habits and religious reflections can reveal religious belief or practice. Food, exercise, sleep, energy and mood can be health-related wellness data. These are special-category data when they concern or reveal religion or health.

Core tracking and reflection features cannot operate without explicit consent to process the special-category content they are designed around. Location, calendar access, the companion model download, optional iCloud sync and purchases remain separate choices. You can use features that do not need a permission without granting that permission.

Purposes and lawful bases

Article 6 and Article 9 answer separate questions. An Article 6 basis is required for personal data generally. Special-category data also requires an Article 9 condition.

Purpose Information Lawful basis
Provide the app features you request Profile settings, location inputs, calendar events you permit, plans, purchase status, model-download request and local app records Article 6(1)(b), performance of the app agreement or steps you request. We use this basis only where the processing is objectively necessary for that feature.
Process religious-practice and health-related wellness data on the device Prayer and Quran activity, intentions, reflections, food, exercise, sleep, energy, mood and model-derived content based on them Article 6(1)(b) where necessary to provide the requested feature, plus Article 9(2)(a), explicit consent. Mihwar records a versioned consent choice on the device.
Copy supported sensitive content through optional iCloud sync The supported app-content set and selected settings; raw coordinates are excluded Article 6(1)(a) and Article 9(2)(a), consent and explicit consent. Sync stays off until you make the separate iCloud choice.
Answer support messages, protect the site and investigate problems Your email and message, plus limited website request and security data Article 6(1)(b) when the message concerns the app agreement. Otherwise Article 6(1)(f), our legitimate interests in answering voluntary enquiries, securing the site and keeping proportionate support records. We balance those interests against your rights and minimise what we retain.
Meet legal, tax and regulatory duties Records we must retain or disclose by law, which may include correspondence or transaction statements Article 6(1)(c), compliance with a legal obligation. If special-category data is relevant to a legal claim, Article 9(2)(f) may apply to that limited use.

How app features process information

Local storage and the companion

Intentions, reflections, habits, prayer logs, plans, journal entries and companion messages are stored locally in SQLite by default. Mihwar has no backend server that receives or stores this content.

When you set up the companion, Mihwar downloads the model file from Hugging Face over an encrypted connection. The app may re-download it after you delete the model or when an updated model is required. During a download, Hugging Face may receive normal connection and device metadata, including an IP address, service-use location and device or browser details, under its Privacy Policy. AI inference runs on your device. Prompts and journal content are not sent to Hugging Face.

Location and prayer times

Prayer times are calculated on your device with Adhan JS. The calculation itself makes no HTTP request to a prayer service.

When you choose Current location, your coordinates are sent to Apple's geocoder so iOS can return a city and country. When you manually confirm a city and country, that typed place is sent to Apple's geocoder so iOS can resolve its coordinates. The calculation method and madhab are used on your device and are not sent to Apple's geocoder. Supported settings may sync through your private CloudKit database if you enable iCloud.

Raw coordinates are stored only on the device and do not sync to iCloud. City and country may sync if you enable iCloud. On a second device, you must confirm location again before Mihwar can calculate prayer times there.

Calendar

Calendar access is optional and off until you grant it. Mihwar reads today's events, other than birthday and subscribed calendars, so the planner can schedule around them. Event details are used on your device. Calendar-derived plan titles are excluded from iCloud sync.

If you turn on "Add plan to Calendar", Mihwar creates a calendar named Mihwar using a local, on-device calendar source. It does not use an iCloud, Exchange or Google source. If no local source exists, write-back stays unavailable. You can revoke calendar access in iOS Settings.

Optional iCloud sync

If you enable iCloud sync, supported app content, including journals and habits, can be stored in your private CloudKit database. The supported set is fixed by the app rather than chosen category by category. Mihwar has no server in this path and does not receive or read your private CloudKit records.

Under standard data protection, Apple says iCloud data is encrypted in transit and at rest, with recovery keys secured in Apple data centres. Standard protection allows Apple to use those keys for account and data recovery.

Mihwar stores synced content in CloudKit encrypted fields. Advanced Data Protection is optional; when you enable it, Apple says trusted devices retain sole access to CloudKit service keys, and encrypted CloudKit fields and assets receive end-to-end protection. Some CloudKit metadata can remain under standard protection.

You can turn iCloud sync off at any time. Turning it off deletes Mihwar's private CloudKit zone and the synced copy when iCloud is available. Local data is not touched. If Mihwar cannot reach iCloud, sync remains off on the device and the zone is left in place. Turning sync on and off again once connected retries the deletion, as does deleting Mihwar's data in iCloud account settings. A full consent withdrawal deletes local Mihwar data and records a failed CloudKit deletion for launch recovery when the zone is not shared by another local profile.

Purchases

Mihwar Pro purchases use StoreKit. Purchases, payments, refunds and subscription management are handled by Apple. Mihwar does not receive payment-card or billing details. The app reads entitlement information from StoreKit and caches limited purchase status on the device so it can provide paid features.

Website and support email

Cloudflare hosts this static website. It receives ordinary request and security information such as IP address, requested URL, browser or device data, language and time of request. Mihwar does not add advertising cookies, client-side analytics or tracking pixels to these pages.

If you send a support email, Microsoft hosts the support mailbox. We receive the address you use, your message and any attachments. Do not send private journal, prayer or health content. If troubleshooting needs a screenshot, remove sensitive details first.

Recipients and international processing

Mihwar does not sell personal data. The relevant external recipients are:

Apple
Apple provides geocoding, CloudKit and StoreKit. It receives the information needed for the service you invoke and acts under its own terms and privacy notices.
Hugging Face
Hugging Face hosts the model file. It receives connection and device metadata for the download, not your prompts or journal content.
Cloudflare
Cloudflare hosts and protects the website.
Microsoft
Microsoft hosts the support email mailbox.

These providers may process information outside the UK. Apple's privacy policy says UK personal data is controlled by Apple Distribution International in Ireland and that Apple's onward international transfers use Standard Contractual Clauses. Hugging Face is based in the United States and says its services may process information there and in other countries. Cloudflare says it operates globally and applies safeguards to international transfers. Their linked policies explain their roles, locations and how to request details of safeguards.

We may disclose limited information if law requires it, or where necessary to establish, exercise or defend a legal claim. We do not share private app content for advertising or profiling.

Retention and deletion

Local app data
It is kept on the device until you delete it with Mihwar's controls or remove the app. A factory reset deletes the profile, settings, records, cached content and saved consent.
Consent record
It is kept on the device with its notice version and time until you withdraw consent, factory reset, or replace it by accepting a later notice.
iCloud copy
It is kept in your private CloudKit database until you disable sync, withdraw consent or delete it through Apple. If an ordinary sync-off deletion fails, the zone remains until you retry. If deletion fails during full consent withdrawal, Mihwar records it for launch recovery.
Calendar and exports
Markdown files and events written to the local Mihwar calendar remain where you chose to place them until you delete them. Removing Mihwar does not necessarily remove those separate copies.
Keychain purchase cache
The device-only Keychain entry may survive app removal. An in-app factory reset clears it. It does not sync to iCloud Keychain or restore onto another device.
Support correspondence
Routine support correspondence is kept for up to 12 months after the matter closes, then deleted unless a legal obligation or live dispute requires longer retention.
Legal and tax records
They are kept for the period required by the applicable law.

Cloudflare, Apple, Hugging Face and Microsoft set retention for information they control under their own notices. Cloudflare describes retention by reference to the type of service data and the purpose for which it is held. Links are provided below.

Your rights and controls

Depending on the processing and any legal exception, you may have rights to access personal data, correct inaccurate data, erase data, restrict processing, receive portable data and object to processing. You can export app content to Markdown, correct entries in the app, or use the deletion controls without asking us. Because Mihwar has no account or app-content server, we normally cannot retrieve local or private CloudKit content for you.

You can withdraw consent in Profile under "Sensitive data consent". Withdrawal stops new sensitive processing and factory-resets the local profile. The iCloud sync control has a separate withdrawal path. Withdrawing consent does not make earlier lawful processing unlawful.

Email us to exercise a right over information we hold, such as support correspondence. We may need enough information to verify the request. Rights are not absolute and depend on the lawful basis. We normally respond without undue delay and within one month. There is usually no fee.

Your right to object

You may object to processing based on our legitimate interests, including support-record administration and website security logging. Tell us your reasons by email. We will stop unless we can demonstrate compelling legitimate grounds or the processing is needed for a legal claim.

Complaints

Email mihwarlive@outlook.com with the subject "Data protection complaint". We will acknowledge a complaint within 30 days, investigate it without undue delay, keep you informed where appropriate and tell you the outcome.

You can also complain to the Information Commissioner's Office. You do not have to contact us first. See the ICO's complaint service, call 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Automated processing

Mihwar uses on-device software and an AI model to calculate prayer times, propose plans, create summaries and generate companion responses. There is no solely automated decision that produces a legal effect or similarly significant effect about you. AI output can be wrong and is not medical advice or a religious ruling.

Children

Mihwar is designed for Muslim professionals and is not designed specifically for children. It does not ask for a date of birth and the developer cannot identify app users from local records. Please do not send a child's personal or sensitive information to the support address.

Changes to this policy

We will update the version and date when this notice changes. If a change affects the purpose or consent for special-category processing, Mihwar will ask for a new choice before continuing that processing.

External policies and sources