1. Who is responsible for your data

Responsible party: the Kawn Ad-Din project — the website kawnaddin.com, run by a private individual in the Republic of South Africa, who also acts as Information Officer. The full name and postal address of the responsible party are provided to data subjects on request. Personal data requests: privacy@kawnaddin.com.

2. What we collect

Without an account. All content is open without signing up. For the daily limits of guest features (calculators) we set a technical cookie kawn_gid (a random identifier, 1 year) and compute a hash of your IP address with a salt that changes every day — the address cannot be recovered from it. Searches made without an account are not linked to you.

Account. On registration: name, e-mail address, password (stored only as a hash), gender, country, madhhab and language. These fields drive the service: for example, the hayd tracker opens only for women, and fatwas are shown in your language.

What you create. Bookmarks, viewing history, diary, settings, questions to the mufti with attachments, saved AI research, plan requests.

Health data — the hayd tracker. Records of menstruation, nifas, pregnancy and iddah are special personal information under POPIA (section 26). We process them only with your explicit consent, which you give when you start using the tracker, and for one purpose only — calculating your Sharia status, missed prayers and fasts. These records are never shared, never sent to AI and never analysed in aggregate. You can delete them at any time in your account; when you delete the account they are deleted with it.

Sign-in security. When you sign in we record the IP address, device and browser type and time, and we look up the country and city from the IP via ipinfo.io — to show your device list and warn you by e-mail about a sign-in from a new device. For two-factor authentication we store the TOTP secret and backup codes (encrypted). Account actions (sign-in, e-mail change, subscription) are written to an audit log.

AI search and the sentence generator. The text of your question is sent to a language model operated by Anthropic (USA) to search and compose the answer. No name, e-mail or other account data is sent with it. Under its API terms Anthropic does not use submitted data to train its models. We keep questions, answers and the cost of requests in our logs for limits, quality control and statistics.

Payment. Payments are taken by a payment provider acting as the merchant of record. Card details are entered on its side and never reach us. We receive only the fact of payment, the plan, the amount and a payment identifier, kept for subscription records.

E-mail. E-mail confirmation, password reset, sign-in alerts and subscription notices are sent through Resend. We record delivery status (delivered, bounced) so as not to keep sending to dead addresses.

Errors. Technical errors are sent to Sentry without personal data (“no PII” mode): only the error message, page and browser version.

What we do not do. No advertising or analytics trackers (Google Analytics, Yandex Metrica and the like), no selling or sharing of data for marketing, no profiling.

3. Why, and on what basis

• Performance of a contract with you: account, subscription, payment, subscription notices, mufti answers.
• Your consent: the hayd tracker (special information), notifications, sending questions to AI. You can withdraw consent at any time by switching the feature off or writing to us; this does not affect processing done before.
• Legitimate interest: protecting accounts from takeover, protecting the site from automated scraping, limiting abuse, accounting for AI costs.
• Legal obligation: keeping payment records and responding to lawful requests.

4. Where data is stored and who receives it

The site and database are hosted by Hetzner Online GmbH in Helsinki, Finland (European Union). This is a transfer outside South Africa within the meaning of POPIA section 72: Finland is subject to the EU General Data Protection Regulation (GDPR), which provides protection substantially similar to POPIA.

Operators (processors) that receive limited data to provide services to us:

• Hetzner Online GmbH (Germany/Finland) — hosting;
• Anthropic PBC (USA) — the language model for AI search: the text of the question only;
• Resend (USA) — e-mail delivery: address and message content;
• Sentry (Functional Software, Inc., USA) — error monitoring, no personal data;
• ipinfo.io (USA) — country and city from the IP at sign-in;
• the payment provider — at payment; its own policy governs payment data.

All are bound by data processing agreements and apply industry safeguards. Other disclosures happen only where the law requires.

5. How long we keep data

• Your account and what you created — for as long as the account exists.
• Sign-in sessions — until sign-out or expiry; you can clear the device list yourself.
• AI search conversations — 30 days; those you mark “keep” — until you delete them.
• Daily AI usage totals — 90 days; request logs — up to 12 months.
• Audit log and e-mail delivery statuses — up to 12 months.
• Payment records — as long as tax law requires.

After account deletion, personal data is erased within 30 days, except payment records and what the law obliges us to keep. Backups are overwritten within 30 days.

6. Your rights

You can: ask what data we hold about you; correct it; delete your account and data; receive a copy of your data in a machine-readable form; object to processing based on legitimate interest; withdraw consent. Most of this is available in your account; for the rest, write to privacy@kawnaddin.com from the e-mail your account is registered with. We reply within 30 days.

If you believe we are in breach of POPIA, you may lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za.

7. Children

Accounts may be created by persons aged 18 and over. Persons under 18 may use the site without registering; registration is possible for them only with the consent of a parent or guardian sent to privacy@kawnaddin.com.

8. Cookies and local storage

We use only what is necessary: the session key and your settings (theme, language) in the browser's local storage; the kawn_gid cookie for the daily limits of guest features. There are no advertising or third-party cookies, so no consent banner is required.

9. Security

HTTPS only; passwords stored as hashes; two-factor authentication available; alerts on sign-in from a new device; server access restricted and logged. Report a vulnerability: security@kawnaddin.com.

10. Changes

The current version is always available at kawnaddin.com/privacy; the version date is in the heading. We will announce material changes in your account.