Privacy Policy

Last updated: 13 Rabiʻ al-Akhir 1448 · 24 September 2026

Your calendar is stored local-first. The short version: it lives on your device, nothing leaves it unless you switch something on, and we don't sell data — there's nothing to sell. An account is free and optional — it is the one thing that puts your calendar on our server, and this page says exactly what that means. Without one the app works in full, and your calendar stays on your device.

What we store, and where

Your events, tasks, settings (location, calendar authority, preferences), and connection tokens are stored locally on your device — in your browser's storage on the web app, in the app's own database on a phone. Before you sign in, they are not transmitted to or held on Hijri First servers — they stay on your device, and they stay there between sessions: an account is not required to keep what you add. Clearing your browser data (or deleting the app) deletes them; exporting (.ics) is always available in Settings.

If you enter a city for prayer times, the lookup resolves coordinates and timezone; your device location is used only if you explicitly grant it. The place it resolves to is saved with your settings, so if you have an account it syncs to your other devices through our server like the rest of your settings; without an account it never leaves this device. It is never shared with anyone else.

One honest detail about sharing: when you share an event, the link itself encodes the event's title, its Hijri/Gregorian date, and the cities involved — that's how the recipient's view works without a server holding your data. Anyone you give the link to can read those details, so treat share links like the information they carry.

If you sign in — the account and the sync server

An account does one thing: it keeps the same calendar on every device you use, and keeps it when a device is lost or replaced. It is optional — without one, Hijri First keeps your calendar on your device and never puts it on our server.

Signing in is an email address and a six-digit code — no password. If you use it, this is what sits on our servers, and nowhere else:

• Your email address, so a later sign-in reaches the same calendar. It is the only thing about you we hold.
• Your calendar itself — events, tasks and settings — as the shared document your devices merge into. This is the part the local-first description above does not cover, and we would rather say so than let you find out.
• Short-lived sign-in machinery: the one-time code (stored hashed, valid for minutes) and your session tokens (also stored hashed).

It runs on Cloudflare, in their network. Everything is encrypted in transit. It is not end-to-end encrypted today, which means we could technically read what is stored — we don't, there is no tooling that does, and end-to-end encryption is on the roadmap. You should know which of those two statements is a guarantee and which is a promise.

You can delete all of it from inside the app: Settings → Account & sync → Delete account. That removes the account, the email address, every session, and the synced calendar itself — from our servers, not just from the device you pressed it on. It cannot be undone, so export a backup first if you want to keep a copy. If you would rather we did it, email [email protected] from the address you signed up with.

Signing out is the smaller action: it clears that device's copy of the account data and leaves the account, and your other devices, alone.

Google user data — Calendar integration

Connecting Google is optional and separate from signing in — you can use Hijri First without ever connecting it. When you do connect it, we request the minimum scopes needed for these things:

Read-only mirroring

We read your Google events so they can appear inside Hijri First, alongside your Hijri dates and prayer times.

Publishing to a separate calendar

Events you choose to publish are written to a dedicated “Hijri First” calendar that the app creates in your Google account — never to your primary calendar. That calendar works both ways: if you move, edit, add or delete an event in it from Google, the change is brought back into Hijri First on the next sync, so the two stay the same. An event deleted there goes to Hijri First's Trash, where you can restore it for 30 days. Disconnecting stops all access; you can also delete that calendar in Google at any time.

Editing your existing events, when you ask us to

So that a change you make in Hijri First reaches Google — moving a meeting that clashes with a prayer time, for example — we can edit events on the calendars you already keep. This happens only for a change you make yourself; we do not alter your events on our own, and a Google event you never touch is never written to. If an event has guests, we ask whether to notify them before sending the change.

Google Tasks

We read and write your Google Tasks so they appear and can be ticked off in the same list as your calendar items.

Your Google refresh token is held encrypted on our sync server, not in your browser — that is what lets your session survive without asking you to sign in to Google again, and it is why our server, rather than the app, is what talks to Google on your behalf. It is deleted when you disconnect Google or delete your account. Google Calendar data obtained through these scopes is used solely to provide the features above, is not stored on our servers except as described for the “Hijri First” calendar below, and is never shared with or sold to third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use data obtained through Google APIs to develop, improve or train generalised artificial-intelligence or machine-learning models, and we do not transfer it to anyone who does.

How Google user data is protected

Google asks every app that touches calendar data to say, plainly, how that data is kept safe. This is how Hijri First does it:

• Calendar and task contents are not stored on our servers. Your Google events and tasks are fetched by our sync server on your behalf and passed straight to the device you are using, where they are held in the app's local storage alongside the rest of your calendar. Nothing from your Google calendars is written to our database or kept in server logs. One exception, and only for the “Hijri First” calendar the app created: a change you make to it in Google — an event moved, edited or added there — becomes part of your Hijri First calendar. If you have a Hijri First account, your calendar is kept on our server so it reaches your other devices (see the account section), and those events are kept there with it, exactly like an event you made in the app. Deleting your account deletes them. Events in your other Google calendars are never stored on our server.
• The one Google credential we hold is encrypted at rest. Your refresh token is sealed with AES-256-GCM before it is written to our database, under a key that lives only as a secret of the sync server itself — never beside the data it protects, never in the app, never in source control. A copy of the database alone cannot be used to reach your calendar.
• Everything is encrypted in transit. Traffic between the app, our sync server and Google's APIs uses HTTPS (TLS) throughout; the sync server is reachable over HTTPS only.
• Access is restricted. Our sync server runs on Cloudflare's network, whose storage is encrypted at rest. Only the developer holds the deployment secrets; there is no administrative interface for reading anyone's calendar, and the server never returns another account's data to a request — every request is checked against a signed-in session, which is stored as a hash.
• Retention is as short as the feature needs. The short-lived access token Google issues is cached sealed the same way and expires within the hour. The encrypted refresh token, and that cache with it, is deleted the moment you disconnect Google or delete your account. If you revoke access from your Google account's security page instead, the next request fails, the app tells you the connection is gone, and nothing we hold can reach your calendar any more.
• If something goes wrong, you hear about it. If we ever learn of unauthorised access to the data we hold for you, we will tell you by email at the address on your account, promptly and with what we know, and we will notify Google as their policies require.

Anonymous usage analytics

To understand whether the app is useful and where it needs work, Hijri First records anonymous, aggregate usage events through PostHog and Aptabase, two analytics services acting only as processors on our behalf. This is the only thing the app reports beyond your device, and it is deliberately minimal.

What is sent: anonymous events like “the app was opened”, “an event was created”, or “the theme was changed” — counts and simple flags only, plus which page was opened and which site you arrived from (the address is cut to its path, with invite links and anything after a “?” removed, and a referring site to its name alone). What is never sent: your event titles, notes, tasks, contacts, prayer or location details, email, or anything you type. There are no cookies, no advertising identifiers, and no profile linking activity to you — we can see that something happened, never what it was or who did it.

The same minimal, anonymous events cover our public surfaces too. On our website (hijrifirst.com) the only thing recorded is an anonymous “open-the-app button was clicked” event — no page-load tracking there; general traffic (page counts, referrers) is measured by Cloudflare Web Analytics, which is cookieless and stores no personal data. On the free public tool pages (for example the date converter or Hijri age calculator) we record only that a tool page was viewed, identified by its public name — never anything you type into the tool, which is computed entirely on your device.

Analytics respects your browser’s Do-Not-Track / Global Privacy Control signal on every surface, and turning it off in Settings → General applies everywhere — the website and tool pages read the same opt-out. Both services process this data in the European Union, and neither is given an identifier that would let it recognise your device: the identifier PostHog would normally persist is deliberately kept in memory only, so it is discarded the moment you close the page and every session counts as a new one.

What we don't do

We don't sell or share personal data. We don't show ads. We don't use your calendar content for advertising, profiling, or training models. We don't ask for anything the app does not need — an account is an email address, and that is the whole of it.

Your choices

Disconnect Google at any time in Settings → Import & export, or revoke access from your Google account's security page. Delete all local data by clearing site data in your browser, or by deleting the app. Delete your account and everything synced with it from Settings → Account & sync → Delete account — see the account section. Export your calendar as .ics whenever you like.

Terms of use

Hijri First is provided as-is during the beta. Hijri dates, prayer times, and provisional month boundaries are computed from the authority and location you choose and may differ from your local community's announcements — always follow your local authority for acts of worship. See the full Terms of Use. We may update these terms and this policy; material changes will be announced in the app.

Contact

Questions about privacy or your data: [email protected]

Google Calendar and Google are trademarks of Google LLC. Hijri First is an independent app and is not affiliated with, endorsed by, or sponsored by Google.