Privacy Policy

Last updated: 27 Rabiʻ al-Awwal 1448 · 9 September 2026

Your calendar is stored local-first. The short version: it lives on your device, nothing leaves it unless you switch something on, and we don't sell data — there's nothing to sell. An account is free and optional — it is the one thing that puts your calendar on our server, and this page says exactly what that means. Without one the app works in full, and your calendar stays on your device.

What we store, and where

Your events, tasks, settings (location, calendar authority, preferences), and connection tokens are stored locally on your device — in your browser's storage on the web app, in the app's own database on a phone. Before you sign in, they are not transmitted to or held on Hijri First servers — they stay on your device, and they stay there between sessions: an account is not required to keep what you add. Clearing your browser data (or deleting the app) deletes them; exporting (.ics) is always available in Settings.

If you enter a city for prayer times, the lookup resolves coordinates and timezone; your device location is used only if you explicitly grant it. The place it resolves to is saved with your settings, so if you have an account it syncs to your other devices through our server like the rest of your settings; without an account it never leaves this device. It is never shared with anyone else.

One honest detail about sharing: when you share an event, the link itself encodes the event's title, its Hijri/Gregorian date, and the cities involved — that's how the recipient's view works without a server holding your data. Anyone you give the link to can read those details, so treat share links like the information they carry.

If you sign in — the account and the sync server

An account does one thing: it keeps the same calendar on every device you use, and keeps it when a device is lost or replaced. It is optional — without one, Hijri First keeps your calendar on your device and never puts it on our server.

Signing in is an email address and a six-digit code — no password. If you use it, this is what sits on our servers, and nowhere else:

• Your email address, so a later sign-in reaches the same calendar. It is the only thing about you we hold.
• Your calendar itself — events, tasks and settings — as the shared document your devices merge into. This is the part the local-first description above does not cover, and we would rather say so than let you find out.
• Short-lived sign-in machinery: the one-time code (stored hashed, valid for minutes) and your session tokens (also stored hashed).

It runs on Cloudflare, in their network. Everything is encrypted in transit. It is not end-to-end encrypted today, which means we could technically read what is stored — we don't, there is no tooling that does, and end-to-end encryption is on the roadmap. You should know which of those two statements is a guarantee and which is a promise.

You can delete all of it from inside the app: Settings → Account & sync → Delete account. That removes the account, the email address, every session, and the synced calendar itself — from our servers, not just from the device you pressed it on. It cannot be undone, so export a backup first if you want to keep a copy. If you would rather we did it, email [email protected] from the address you signed up with.

Signing out is the smaller action: it clears that device's copy of the account data and leaves the account, and your other devices, alone.

Google user data — Calendar integration

Connecting Google is optional and separate from signing in — you can use Hijri First without ever connecting it. When you do connect it, we request the minimum scopes needed for these things:

Read-only mirroring

We read your Google events so they can appear inside Hijri First, alongside your Hijri dates and prayer times.

Publishing to a separate calendar

Events you choose to publish are written to a dedicated “Hijri First” calendar that the app creates in your Google account — never to your primary calendar. Disconnecting stops all access; you can also delete that calendar in Google at any time.

Editing your existing events, when you ask us to

So that a change you make in Hijri First reaches Google — moving a meeting that clashes with a prayer time, for example — we can edit events on the calendars you already keep. This happens only for a change you make yourself; we do not alter your events on our own, and a Google event you never touch is never written to. If an event has guests, we ask whether to notify them before sending the change.

Google Tasks

We read and write your Google Tasks so they appear and can be ticked off in the same list as your calendar items.

Your Google refresh token is held encrypted on our sync server, not in your browser — that is what lets your session survive without asking you to sign in to Google again, and it is why our server, rather than the app, is what talks to Google on your behalf. It is deleted when you disconnect Google or delete your account. Google Calendar data obtained through these scopes is used solely to provide the features above, is not stored on our servers, and is never shared with or sold to third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use data obtained through Google APIs to develop, improve or train generalised artificial-intelligence or machine-learning models, and we do not transfer it to anyone who does.

Anonymous usage analytics

To understand whether the app is useful and where it needs work, Hijri First records anonymous, aggregate usage events through PostHog and Aptabase, two analytics services acting only as processors on our behalf. This is the only thing the app reports beyond your device, and it is deliberately minimal.

What is sent: anonymous events like “the app was opened”, “an event was created”, or “the theme was changed” — counts and simple flags only, plus which page was opened and which site you arrived from (the address is cut to its path, with invite links and anything after a “?” removed, and a referring site to its name alone). What is never sent: your event titles, notes, tasks, contacts, prayer or location details, email, or anything you type. There are no cookies, no advertising identifiers, and no profile linking activity to you — we can see that something happened, never what it was or who did it.

The same minimal, anonymous events cover our public surfaces too. On our website (hijrifirst.com) the only thing recorded is an anonymous “open-the-app button was clicked” event — no page-load tracking there; general traffic (page counts, referrers) is measured by Cloudflare Web Analytics, which is cookieless and stores no personal data. On the free public tool pages (for example the date converter or Hijri age calculator) we record only that a tool page was viewed, identified by its public name — never anything you type into the tool, which is computed entirely on your device.

Analytics respects your browser’s Do-Not-Track / Global Privacy Control signal on every surface, and turning it off in Settings → General applies everywhere — the website and tool pages read the same opt-out. Both services process this data in the European Union, and neither is given an identifier that would let it recognise your device: the identifier PostHog would normally persist is deliberately kept in memory only, so it is discarded the moment you close the page and every session counts as a new one.

What we don't do

We don't sell or share personal data. We don't show ads. We don't use your calendar content for advertising, profiling, or training models. We don't ask for anything the app does not need — an account is an email address, and that is the whole of it.

Your choices

Disconnect Google at any time in Settings → Import & export, or revoke access from your Google account's security page. Delete all local data by clearing site data in your browser, or by deleting the app. Delete your account and everything synced with it from Settings → Account & sync → Delete account — see the account section. Export your calendar as .ics whenever you like.

Terms of use

Hijri First is provided as-is during the beta. Hijri dates, prayer times, and provisional month boundaries are computed from the authority and location you choose and may differ from your local community's announcements — always follow your local authority for acts of worship. See the full Terms of Use. We may update these terms and this policy; material changes will be announced in the app.

Contact

Questions about privacy or your data: [email protected]

Google Calendar and Google are trademarks of Google LLC. Hijri First is an independent app and is not affiliated with, endorsed by, or sponsored by Google.