Your privacy is part of your practice.

Amalify is an Islamic spiritual-practice and self-improvement application operated by Peacebox Studio in Lahore, Pakistan.

In this Privacy Policy, “Amalify,” “Peacebox Studio,” “we,” “us,” and “our” refer to Peacebox Studio and the Amalify application.

This Privacy Policy explains how Amalify collects, uses, stores, discloses, and deletes information when you:

• Use the Amalify mobile application;
• Create or use an Amalify account, including a guest account;
• Record prayers or other religious activities;
• Use community, family-circle, leaderboard, coaching, notification, or subscription features;
• Contact Peacebox Studio; or
• Visit Amalify’s legal and account-deletion pages.

Third-party websites, stores, authentication providers, speech services, and content providers have their own privacy practices.

A. Account and authentication information

Depending on how you sign in, Amalify may process:

• Firebase user identifier;
• Name or display name;
• Email address;
• Optional telephone number;
• Profile or account image;
• Authentication provider;
• Guest-account status;
• Account creation and last-activity timestamps; and
• Account, onboarding, and deletion status.

Amalify supports email/password authentication, anonymous guest authentication, Google Sign-In, and Sign in with Apple. Passwords and third-party authentication credentials are processed by Firebase or the selected authentication provider. Peacebox Studio does not receive or store your raw Google or Apple password.

A guest account is still assigned an online Firebase identifier and may synchronize data with Firebase.

B. Profile and preference information

Amalify may process information you provide or select, including:

• Practice level;
• Spiritual goals;
• Whether you identify as a new Muslim;
• Preferred language and locale;
• Prayer calculation and Asr methods;
• City and country;
• Location and travel-mode settings;
• Quran script and font-size preferences;
• Theme settings;
• Azan voice and sound preferences;
• Prayer-alert settings;
• Coach tone or voice preferences;
• Leaderboard and profile-visibility preferences; and
• Onboarding choices.

C. Location information

With device permission, Amalify may access your current approximate or precise location to:

• Calculate prayer times;
• Calculate the Qibla direction and distance;
• Select location-specific settings;
• Display a readable city name;
• Support travel mode; and
• Prepare prayer and Azan reminders.

Coordinates and a resulting city name may be stored in your private Firebase profile and in a local device cache. Amalify may send coordinates to OpenStreetMap’s Nominatim service to convert them into a readable place name.

If location permission is denied, Amalify may use a location you enter manually, a previously saved location, or limited fallback behavior. Some location-based features may be unavailable or less accurate.

D. Religious-practice and activity information

Amalify may process information you choose to record, including:

• Prayer completion, timing, status, scheduled time, and notes;
• Missed or Qada prayer records;
• Quran-reading sessions, pages, bookmarks, and study notes;
• Hifz plans and review records;
• Dhikr and Tasbeeh names, targets, and counts;
• Favorite Duas;
• Habits, good deeds, charity, fasting, Taraweeh, and Ramadan activity;
• Ramadan plans and personal reflections;
• Quest and challenge participation;
• Streaks, experience points, coins, levels, and achievements;
• Notification and reminder history;
• Zakat calculations, including entered asset values, currency, calculation breakdown, and estimated Zakat amount; and
• Spiritual Coach messages and history.

This information may reveal or relate to religious beliefs and practices and may be considered sensitive information in some jurisdictions. Amalify processes it only to provide features you request and subject to the choices and controls described in this policy.

E. Spiritual Coach and voice information

Amalify’s current Spiritual Coach primarily uses local, prewritten educational content. Coach messages may be stored locally on your device, and certain app flows may synchronize the current conversation to your private Firebase account.

Do not enter confidential information, account credentials, medical records, or other information that is unnecessary for receiving general spiritual guidance.

If you use voice input, your device or operating-system speech-recognition service converts speech into text. If you use text-to-speech, your device or operating-system service produces spoken audio. Those services may process audio or text according to their own privacy terms. Peacebox Studio does not operate a separate remote audio-recording service for Amalify.

F. Community and social information

If you use community features, Amalify may process:

• Posts and comments;
• Author identifier, name, and profile image;
• Likes and associated account identifiers;
• Post or comment timestamps;
• Community-terms acceptance and policy version;
• Reports, report reasons, and moderation status; and
• Users you choose to block.

Community posts, comments, author names, profile images, and like information may be visible to other authenticated Amalify users. Do not post private or sensitive information that you do not want other community members to see.

Reports and block lists are restricted according to Amalify’s access controls. Reports may be reviewed by authorized moderators.

G. Family-circle and leaderboard information

Family-circle features may process:

• Group name, identifier, administrator, invite code, and membership;
• Member display names and profile images;
• Experience points, level, and completed-activity summaries;
• Challenge titles, targets, progress, and participation; and
• Detailed-progress sharing preferences.

Family-circle information is available to authorized members of the relevant circle. Invite codes should be shared only with people you intend to invite.

If you opt into a leaderboard, your display information and progress statistics may be visible to authenticated Amalify users. You may change available visibility or progress-sharing settings within the app.

H. Subscription and transaction information

Google Play processes payments for Amalify subscriptions. Amalify may process:

• Product and plan identifier;
• Purchase token;
• Cryptographic hash of the purchase token;
• Obfuscated account identifier;
• Google order identifier;
• Subscription status and acknowledgement state;
• Purchase, verification, and expiry timestamps;
• Entitlement status; and
• Subscription lifecycle notifications received from Google Play.

The raw purchase token is transmitted securely to Amalify’s Firebase backend and Google Play for verification. Amalify stores a token hash and related entitlement records to prevent misuse and restore access. Peacebox Studio does not receive your full payment-card number or security code.

Deleting an Amalify account does not automatically cancel a Google Play subscription or create a refund. Manage cancellation and refunds through Google Play.

I. Device, usage, security, and diagnostic information

Amalify and its service providers may automatically process:

• IP address and user-agent information;
• Firebase installation and application identifiers;
• App version, package name, and operating-system version;
• Device model, architecture, memory, storage, and security state;
• Session and event timestamps;
• Feature interactions and usage events;
• Crash reports, stack traces, error messages, and diagnostic logs;
• Notification-delivery identifiers and message metadata;
• App Check and Play Integrity or DeviceCheck signals; and
• Network request information.

Amalify uses Firebase Analytics and Crashlytics to understand feature usage, diagnose faults, and improve reliability. Diagnostic reports could contain information present in an error message or technical context. Users should avoid entering confidential information where it could become part of an error report.

Amalify does not display third-party advertising, does not use information for targeted advertising, and removes Android advertising-ID permissions from its build.

J. Photos, sensors, notifications, and alarms

If you select a custom profile image, Amalify may use the operating system’s photo picker to access the image you choose. The current custom image is stored in Amalify’s local profile cache unless another feature expressly indicates that it is being uploaded.

Amalify may use the device magnetometer to calculate compass heading for Qibla direction. Raw magnetometer readings are used during the feature and are not intended to be stored as an account record.

If enabled, Amalify may use notifications, vibration, boot-completed events, background scheduling, and Android exact alarms to deliver prayer, Azan, streak, achievement, and companion reminders. Notification content may appear on your lock screen according to your device settings.

Amalify uses local storage technologies, including Hive, SharedPreferences, secure storage, downloaded files, and Firebase offline persistence.

Local data may include:

• Cached account and profile information;
• Last-known location and prayer-calculation settings;
• Prayer times and Qibla calculations;
• Pending synchronization records;
• Quran sessions, bookmarks, notes, audio, and reading preferences;
• Hadith bookmarks and Dua favorites;
• Prayer and habit records;
• Quest and achievement state;
• Notification history;
• Coach messages;
• App configuration, theme, and language choices;
• Subscription-related state; and
• Authentication or security tokens managed by platform services.

Local caches can remain after signing out unless the relevant feature clears them. Clearing the app’s storage or uninstalling Amalify removes ordinary device-only data, subject to operating-system behavior. Some synchronized data will return after you sign in again unless it has also been deleted from the server.

We use information to:

• Create, authenticate, secure, and manage accounts;
• Synchronize information across devices;
• Provide guest access;
• Calculate prayer times and Qibla direction;
• Provide Quran, Dhikr, Dua, fasting, Zakat, and other requested tools;
• Store logs, notes, reflections, goals, and preferences;
• Personalize reminders, language, themes, and app content;
• Operate Spiritual Coach features;
• Maintain streaks, quests, rewards, achievements, and analytics;
• Provide community, moderation, blocking, reporting, family-circle, and leaderboard features;
• Deliver local and remote notifications;
• Verify purchases, restore subscriptions, and prevent entitlement fraud;
• Diagnose crashes and technical problems;
• Protect Amalify, its users, and service providers from misuse;
• Respond to support, privacy, and deletion requests;
• Enforce applicable terms and community rules; and
• Comply with legal obligations.

Where applicable law requires a legal basis, we rely on one or more of the following:

You may withdraw consent by disabling a permission or feature. Withdrawal does not affect processing already performed and may prevent the affected feature from working.

Service providers

We use service providers to operate Amalify, including:

• Google Firebase for Authentication, Cloud Firestore, Cloud Functions, App Check, Cloud Messaging, Analytics, Crashlytics, and Hosting;
• Google Play for subscription payments, purchase verification, and subscription lifecycle events;
• Google and Apple for optional account sign-in;
• Device and operating-system providers for speech recognition, text-to-speech, notifications, photo selection, location, and security functions;
• OpenStreetMap Nominatim for reverse geocoding; and
• External Islamic-content and media providers for Quran audio, Tafsir, Azan audio, and related content.

Service providers may receive IP addresses, request details, identifiers, device information, or data necessary to perform their services. Google publishes additional Firebase processing and retention information in its Firebase Privacy and Security documentation. Nominatim use is governed by the OpenStreetMap Foundation’s policies.

Other users

Information you post in the community may be visible to authenticated users. Family-circle information is shared with authorized circle members. Leaderboard information is shared according to applicable participation and visibility settings.

Legal and safety disclosures

We may disclose information when reasonably necessary to:

• Comply with law, court orders, or lawful government requests;
• Detect, investigate, or prevent fraud, abuse, or security incidents;
• Enforce our terms or community rules;
• Protect the rights, safety, or property of users, Peacebox Studio, or others; or
• Establish, exercise, or defend legal claims.

Business changes

If Peacebox Studio or Amalify is involved in a merger, acquisition, financing, reorganization, or transfer of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality and privacy protections.

Amalify may request content from services such as Quran.com, AlQuran Cloud, Islamic Network, jsDelivr/GitHub-hosted resources, EveryAyah, QuranicAudio, MP3Quran, IslamCan, and similar public content networks.

The Zakat feature may contact ipapi.co to infer an appropriate currency from your public IP address. This request reveals your IP address and ordinary network metadata to that service.

External services receive your IP address and request details and may set or process their own identifiers. Their policies govern their independent processing. Availability and provider selection may change when content sources become unavailable.

Peacebox Studio is based in Pakistan. Google, Apple, OpenStreetMap, content providers, and other service providers may process information in the United States, Pakistan, or other countries where they or their processors operate.

Those countries may have data-protection laws different from the laws where you live. Where required, we rely on contractual protections, service-provider data-processing terms, consent, or other legally recognized transfer mechanisms.

Firebase Authentication operates through United States infrastructure, while other Firebase services may use global or region-selected infrastructure, as explained in Firebase’s privacy documentation.

We retain information only for as long as reasonably necessary for the purposes described in this policy, including providing the service, maintaining security, resolving disputes, and meeting legal obligations.

Generally:

• Account and synchronized activity data remain while your account is active and until deleted;
• Community posts and comments remain until deleted, moderated, or removed through account deletion;
• Reports and moderation records may remain while needed to investigate abuse, maintain community safety, or establish a record of enforcement;
• Family-circle and leaderboard records remain while required to operate those features or until membership, participation, or the associated account is removed;
• Purchase and entitlement records may remain while required to provide access, prevent fraud, resolve disputes, or meet tax, accounting, and legal obligations;
• Device-only caches remain until cleared by Amalify, cleared through device settings, or removed by uninstalling the app;
• Backups and provider-controlled records may take additional time to expire through routine backup cycles; and
• Google controls the retention of Google Play payment records and other provider-controlled information.

Firebase currently states that Crashlytics retains crash information and associated identifiers for 90 days before beginning removal from live and backup systems. Other Firebase identifiers and service data follow Google’s service-specific retention practices.

After account deletion, Amalify retains a minimal security record containing the former Firebase account identifier and deletion timestamps. This record prevents cached or stale authentication sessions from recreating a deleted account. It does not contain your name, email address, coach messages, or purchase token and is retained only for as long as reasonably necessary for that security purpose.

For security, Amalify may require a recent sign-in before completing deletion.

If you cannot access the app, email admin@peaceboxstudio.com from the email address associated with your account and use the subject “Account Deletion.” We may request reasonable verification before acting on the request.

The deletion process is designed to remove:

• Your Firebase Authentication identity;
• Amalify profile and account information;
• Private prayer, habit, Quran, Hifz, Tasbeeh, Ramadan, Zakat, coach, and progress records stored under your account;
• Notifications and achievement records;
• Quest completions and leaderboard entries associated with your account;
• Community posts, comments, and likes associated with your account;
• Family-circle membership and personal challenge progress;
• Subscription-token ownership mappings; and
• Other Amalify records directly associated with the deleted account.

Deleting an account does not automatically:

• Cancel a Google Play subscription;
• Issue a refund;
• Delete Google or Apple account information;
• Delete Google Play’s transaction history;
• Remove information independently retained by third-party providers;
• Delete content that another user copied outside Amalify; or
• Clear local data from every device.

Cancel subscriptions through Google Play. Clear device-only data by clearing Amalify’s app storage or uninstalling the app.

Limited security, fraud-prevention, transaction, backup, or legal records may remain where reasonably necessary or legally required. Google Play requires apps offering accounts to provide both in-app and external deletion pathways, as described in its account-deletion requirements.

You may:

• Decline or revoke location permission;
• Decline or revoke microphone permission;
• Disable notifications, vibration, or exact alarms;
• Choose a manual location;
• Change prayer, Quran, language, theme, and reminder settings;
• Remove a selected profile image;
• Clear available coach history;
• Delete individual records where the feature provides that control;
• Leave a family circle;
• Change family progress-sharing settings;
• Disable available leaderboard participation;
• Block or report community users or content;
• Cancel a subscription through Google Play;
• Sign out; or
• Delete your Amalify account.

Permissions can be managed through your device settings. Some features will not work without their required permissions or information.

Depending on where you live, you may have the right to:

• Know whether we process your personal information;
• Request access to that information;
• Correct inaccurate information;
• Request deletion;
• Obtain a portable copy;
• Restrict or object to certain processing;
• Withdraw consent;
• Appeal a decision concerning a privacy request; and
• Complain to an appropriate data-protection authority.

To submit a request, email admin@peaceboxstudio.com. Describe your request and identify the Amalify account involved. We may verify your identity and account ownership before providing access or making changes.

We will not discriminate against you for exercising applicable privacy rights. Certain requests may be limited where information must be retained for security, fraud prevention, legal compliance, or the rights of others.

Amalify does not sell personal information and does not process personal information for targeted advertising.

Amalify uses safeguards intended to protect information, including:

• Encrypted network transport;
• Firebase Authentication;
• Firestore access rules;
• Firebase App Check;
• Server-side purchase verification;
• Access controls separating private, member-only, moderator, and community data;
• Restricted backend functions;
• Token hashing for stored purchase ownership records;
• Closed Firebase Storage rules while uploads are not implemented; and
• Android settings that disable ordinary app backup and cleartext network traffic.

No system is completely secure. You are responsible for protecting your device, login credentials, family invite codes, and information you choose to post publicly or share with other users.

Amalify automatically calculates prayer times, Qibla direction, streaks, achievements, quests, rewards, challenge progress, and subscription entitlement.

These calculations are used to operate app features and are not intended to make decisions that produce legal or similarly significant effects. Prayer times and Zakat calculations are estimates. Verify important religious, financial, and local-timetable questions with an appropriately qualified person.

Amalify is not intended to collect personal information from children without parent or guardian involvement where required by law.

Children should not create accounts, share community content, purchase subscriptions, or provide personal information unless permitted by applicable law and supervised by a parent or guardian.

If you believe a child provided personal information without required authorization, contact admin@peaceboxstudio.com. We will review the request and delete the information where required.

We may update this Privacy Policy when Amalify’s features, providers, security practices, or legal obligations change.

The revised policy will display a new “Last updated” date. Where required, we will provide additional notice or request consent before materially changing how previously collected information is used.