Privacy Policy

Nafza is built to collect as little data as possible. This page explains plainly what happens. It is an English translation of our Arabic privacy policy; if the two differ, the Arabic version applies.

What we don't do

• There are no accounts and no sign-in.
• We use no tracking tools of our own. Ads in the free plan come from Google and are described in the "Ads" section below.
• We don't sell your data or share it for marketing.

What is stored

• On your device: the screens you chose and their order, and the city you set for the weather.
• On the server: the pairing tokens needed to connect your phone to the screen, and the settings of the chosen screens and the city, so the display continues after a restart.
• TV version: we use the device identifier available on the TV platform to help recognise an earlier connection and restore pairing. The identifier is sent to our service and a digital fingerprint (hash) of it is stored; the identifier alone is never enough to grant control. Some TVs may send their local network address, device model and app version; this is stored with the room data to show the screen's status and make connecting easier.
• A TV without a phone: pairing a phone is optional. When the TV version runs without pairing, an anonymous room is created in the background to show the free screens. It stores a digital fingerprint of the TV identifier (not the identifier itself) and the screen settings, with no name, email, phone number or account. If no phone is ever paired with it, it is deleted automatically 30 days after the TV was last used.
• Display log: we may send technical information about a change of screen or look, the reason for the change and the time of the event, to diagnose problems; when the Holy Quran is shown it may include the surah number. This information is linked to the room number in the technical logs.

External data sources

Some screens fetch their content from public services, either directly from your device (the TV or the phone) or through our server. Only the content request is sent to them (for example the city or its coordinates for the weather); no personal identifier is sent. When your device connects to them directly they see its IP address, as with opening any website.

• Directly from your device: exchange rates from open.er-api; the Holy Quran and its recitation from Quran.com, EveryAyah and mp3quran; hadith from HadeethEnc; adhkar from Hisn al-Muslim; Quran radio streams from their stations; and film images and clips from TMDB and YouTube.
• Through our server: weather from Apple Weather (only the city's coordinates are sent); city search in GeoNames data stored on our server (nothing is sent to GeoNames); exchange rates (backup copy); film lists from TMDB and Movie of the Night; and YouTube search.

Voice control and AI

• Speech is turned into text by your phone system's speech recognition service (Google on Android, Apple on iPhone), which may process it on its servers. When the app is used from a browser, the browser's own speech recognition does this. The audio itself is never sent to our server, only the text.
• Simple fixed commands work on the device without sending anything.
• When the "photograph the menu" feature is available and you choose to use it, the chosen photo is shrunk on your phone and then sent through our server to Anthropic to read the items and prices. Your photo library and other photos are not sent; avoid choosing a photo that contains personal data the menu doesn't need.
• For AI commands (part of the paid subscription), the text of the command, together with a short description of your TV (its brand, apps and what it supports), is sent to our server and then to Anthropic to understand the command and turn it into actions. When you ask to play a YouTube video, our server searches for the query through the YouTube Data API of Google. When suggesting films, your description is sent to Anthropic along with a shortlist from Movie of the Night for you to choose from.
• We don't store the text of commands on the server and we don't sell it. We don't use it to train models, and under its terms Anthropic doesn't either through its API.
• We only keep usage counters per room (the monthly number of commands) to apply the plan's limits.
• The keys of these services are kept on our server only and are not inside the app.

Subscriptions and purchases

Subscriptions (monthly or yearly) and one-time purchases are bought only from Google Play on Android or the App Store on iPhone. Payment, renewal and cancellation happen through the store; we never receive your card or payment details.

• After a purchase, our server verifies it with the store directly using the purchase token (Google Play) or the transaction ID (App Store), then activates the plan.
• We keep, linked to your room: the subscription status (plan and expiry date) and the purchase transaction ID, so that one purchase cannot be used in more than one room. We don't keep your name or email.
• An identifier derived from your room code is sent to the store with the purchase; it contains no name or email.
• Refunds: we don't issue refunds ourselves. Refund requests go to Google or Apple and are decided under the store's policy alone.

Ads

In the phone app, usage ads may appear in the free plan. The paid plan removes these ads while it is active. After the quota of smart requests runs out, we may offer a non-trial subscriber the option to watch a rewarded ad for extra requests; watching it is optional and accepting it does not require you to keep the subscription. The ad data practices described below apply to it. The TV screen may show promotional material for Nafza depending on the plan and display settings.

To show ads we use the Google Mobile Ads SDK (Google AdMob). Google may collect and use the following data through the SDK:

• Your device's advertising ID. On iPhone the advertising identifier (IDFA) is used only after you agree to the tracking prompt (ATT); if you decline, we ask Google for non-personalised ads.
• Device and app information, such as model, system version and device language.
• Approximate location inferred from the IP address. We never ask for your precise location.
• Your interaction with the ad, such as views and taps.
• Diagnostic data about the SDK's performance and crashes.

Purpose: showing ads, measuring their performance, and preventing fraud and abuse. We don't sell this data, and we don't receive it on our servers.

Consent: in regions where the law requires it, such as the European Economic Area and the United Kingdom, a Google consent form (User Messaging Platform) appears the first time ads are shown, and no ad is shown before it is completed. There is currently no button in the app to reopen this form; to change your choice, clear the app's data or reinstall it, or use the options below.

How to opt out: turn off ad personalisation or reset the advertising ID in your device settings (Android: Settings > Google > Ads. iPhone: Settings > Privacy & Security > Tracking), or subscribe to a paid plan to remove usage ads while your subscription is active. You can ignore the rewarded-ad option after the smart requests run out.

How Google uses information from apps that use its services: How Google uses information from sites or apps that use our services. Ads policy: policies.google.com/technologies/ads.

Crash reports

When an error happens in the app or on the TV screen, a technical report is sent to the Sentry service so we can fix it: the type and place of the error, and the device type, system and app version. Before sending, we remove pairing tokens, room numbers, purchases and IP addresses from the report; it contains no name, email or advertising ID, and it is not used for ads or tracking. The app is set up so the report does not include your device's IP address. How long reports are kept depends on the Sentry service settings and our operating policies.

Hosting and technical logs

Every connection to our server and to the website passes through Cloudflare, which processes the public IP address and the approximate country inferred from it to deliver the request and protect it from abuse, and may keep technical and security logs for a limited time under its policy. The website's servers may also keep temporary access logs (IP address, time of request and browser type) for operation and security. We use the country to show the content available in your country; we may store the TV's local network address with the room data as explained above.

Data retention and deletion

• We keep room data, such as settings, pairing data, subscription status and the purchase transaction ID, to run the service and manage purchases. Rooms that never had a phone paired are deleted automatically 30 days after the TV was last used; for paired rooms the app sets no fixed automatic deletion period. Limited logs are used to rate-limit requests and may include the network address; old logs are cleaned up while the service is active, and the app has no confirmed maximum deletion period. Cloudflare's logs follow its policies and the service settings.
• To ask us to delete your room's data, email contact@mralikhalaf.com; we will explain what is needed to verify the request and any legal retention that applies. Don't send pairing tokens or passwords in the message. Deleting room data does not cancel your subscription; cancel it in Google Play or the App Store.
• Ad data is kept by Google under its policies, and you control it from your device settings as described above.

Third parties

• Cloudflare: hosting of the server and website; processes the IP address in its technical logs (see "Hosting and technical logs").
• Sentry: technical crash reports without your identity (see "Crash reports").
• Anthropic: understanding AI commands and suggesting films (text), and reading the menu photo you choose to send when that feature is available.
• YouTube (Google): searching for the video when you ask the smart command to play it (the search query only).
• Google Play and App Store: payment and purchase verification (see "Subscriptions and purchases").
• Movie of the Night and TMDB: film titles, posters and where to watch. No user data is sent to them; your device loads the images from them directly.
• Public content sources: Apple Weather (through our server), open.er-api, Quran.com, EveryAyah, mp3quran, HadeethEnc, Hisn al-Muslim and the radio stations (see "External data sources").
• Google AdMob: usage ads in the free plan and the rewarded ads the user chooses, including extra requests for a non-trial subscriber after the quota runs out. Google receives the data described in the "Ads" section.

Contact

For any privacy question: contact@mralikhalaf.com

Last updated: 2026-11-07