Ajwa logo Ajwa
FAQ Support Open Web App

Privacy Policy

Last updated: July 2026

Ajwa ("we", "us", or "our") is committed to protecting your privacy. This policy explains what information we collect when you use the Ajwa app or website, how we use it, and the choices you have.

1. Information we collect

We collect information you provide directly when you create or update your account:

  • Account details: email address, password (stored as a salted hash — never in plaintext), username.
  • Profile information: display name, age, gender, religion, location (city, state/province, country), profile text (About me, Looking for, Anything else), and keywords/chips.
  • Photos: images you upload are stored in a private, access-controlled cloud bucket. They are only accessible to users you have sent or accepted an interest request from.
  • Messages: the content of messages you send and receive within the app.
  • Device information: device push notification tokens (for sending notifications) and the platform (iOS or Android).
  • Activity data: the time you were last active in the app, used to show your online status and order search results.

2. How we use your information

  • To operate and provide the Ajwa service — matching, messaging, and profile discovery.
  • To send push notifications about new messages and connection activity (you can disable these in Settings).
  • To send transactional emails such as email verification and password resets.
  • To respond to support requests and feedback you send us.
  • To maintain the security and integrity of the platform, including investigating reports and removing users who violate our Terms of Use.
  • To notify users when someone they were connected with has been removed from the platform for a Terms of Use violation. We do this to protect your safety. The notification does not identify the removed user by name.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

3. How we store your information

Your data is stored on servers within our infrastructure:

  • Account and profile data is stored in a PostgreSQL database hosted on a dedicated server.
  • Photos are stored in a private Supabase storage bucket. Signed, time-limited URLs are used to serve your photos — they are never publicly accessible without authorisation.
  • Session data is stored server-side and tied to a secure cookie on your device.

4. Information shared with other users

Profile information (name, bio, gender, keywords) is visible to other users on the platform.

Photos are private by design — they are only made visible to users you have sent an interest request to, or users whose interest request you have accepted. No one else can see your photos.

Messages are shared only with the user you are in conversation with.

We do not share your email address or device token with other users.

5. Third-party services

We use the following third-party services to operate the platform and measure our marketing:

  • Supabase — private photo storage.
  • Firebase Cloud Messaging (Google) — push notifications delivered to your device. Only a device token and message content are transmitted.
  • PurelyMail — transactional email delivery (verification emails, password resets).
  • Google Analytics — we use Google Analytics on our marketing website (ajwaapp.com) and web app (web.ajwaapp.com) to understand aggregate usage patterns such as pages visited and session duration. You can opt out using the Google Analytics Opt-out Browser Add-on.
  • Firebase Analytics (Google) — used in the iOS and Android apps to collect anonymised, aggregated app usage data such as feature adoption and session counts.
  • Meta (Facebook) Pixel and App Events — we use the Meta Pixel on our marketing website and web app, and Facebook App Events in our iOS and Android apps, to measure the effectiveness of our advertising on Facebook and Instagram. Meta may associate this data with your Facebook account for ad measurement and personalisation. You can manage your ad preferences at facebook.com/ads/preferences.
  • TikTok Pixel — we use the TikTok Pixel on our marketing website and web app to measure the effectiveness of our TikTok advertising campaigns. When you are signed into the Ajwa web app, we may share a hashed (SHA-256) version of your email address and an anonymised user identifier with TikTok to improve measurement accuracy. This data is irreversibly hashed before transmission and cannot be used to identify you directly. You can manage your ad preferences in your TikTok account settings.

Each of these services is governed by its own privacy policy. We share only the minimum data necessary for each service to perform its function.

6. Analytics and advertising measurement

We use analytics tools (Google Analytics, Firebase Analytics) to understand how our website and apps are used in aggregate. We use advertising measurement tools (Meta Pixel, TikTok Pixel, Facebook App Events) to measure the effectiveness of our marketing campaigns — for example, to understand whether an ad led to someone creating an account.

These third-party tools may use cookies and similar technologies on our websites. We do not sell your personal information to advertisers. Data shared with Meta and TikTok through our pixels relates to actions taken on Ajwa (such as creating an account or viewing a profile) and is used solely for measuring ad performance.

To limit advertising measurement:

  • Adjust cookie or tracking preferences in your browser settings or use a private/incognito window.
  • Opt out of Meta ad personalisation at facebook.com/ads/preferences.
  • Opt out of TikTok personalised advertising in your TikTok account settings under Privacy → Ads.
  • Use the Google Analytics Opt-out Browser Add-on to prevent Google Analytics tracking.
  • On iOS, use the "Allow Apps to Request to Track" system setting to control cross-app tracking by advertising SDKs.

7. Security

  • Passwords are stored using salted cryptographic hashes — your plain-text password is never stored.
  • Photos are stored in a private bucket with no public access; signed URLs expire after one hour.
  • Communication between the app and our servers uses encrypted connections (HTTPS/WSS).

No system is completely secure. While we work hard to protect your data, we cannot guarantee its absolute security. Please use a strong, unique password and keep your credentials private.

8. Your rights and choices

  • Access: you can view all profile information stored about you at any time within the app.
  • Update: you can edit your profile, photos, and preferences from within the app.
  • Delete: you can permanently delete your account from Settings → Delete Account. This removes all your data — profile, photos, messages, and connections — from our systems.
  • Notifications: you can manage push and email notification preferences from Settings → Notifications.
  • Hidden mode: you can hide your profile from discovery at any time from Settings without deleting your account.

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: you may request information about the categories and specific pieces of personal information we have collected about you, the sources, our business purposes for collecting it, and any third parties we share it with.
  • Right to Delete: you may request deletion of your personal information. Use "Delete Account" in Settings to permanently remove all your data immediately.
  • Right to Correct: you may correct inaccurate information at any time through the Edit Profile screen.
  • Right to Opt-Out of Sale or Sharing: we do not sell or share your personal information for cross-context behavioural advertising. There is nothing to opt out of, but you may contact us to confirm this at any time.
  • Right to Limit Use of Sensitive Personal Information: some information we collect (religion, interests that may reflect sexual orientation, location) is classified as Sensitive Personal Information under California law. You may request that we limit our use of this information to what is strictly necessary to provide the service. To exercise this right, contact us at [email protected].
  • Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.

To exercise these rights, use the controls in the app or contact us at [email protected]. We respond to verifiable requests within 45 days.

10. Legal basis for processing (EEA & UK users)

If you are located in the European Economic Area (EEA) or the United Kingdom, the following legal bases apply to our processing of your personal data:

  • Contract fulfillment: we process your account information, profile data, and messages because it is necessary to provide the Ajwa service you have agreed to use.
  • Legitimate interests: we process activity data (last seen, online status) for security and abuse prevention, where our legitimate interests are not overridden by your rights.
  • Consent: where we process Sensitive Personal Information (religion, interests that may reflect sexual orientation, location), we rely on your explicit consent given when you choose to provide this information. You may withdraw consent at any time by removing the relevant data from your profile or deleting your account.

If you are in the EEA or UK, your data may be stored on servers outside the EEA/UK. Where this occurs, we ensure appropriate safeguards are in place consistent with applicable law (including standard contractual clauses where required).

11. Data retention

We retain your data for as long as your account is active. Specific retention periods:

  • Account and profile data: retained until you delete your account.
  • Messages: retained for up to 2 years from the date sent, then automatically deleted.
  • Notifications: retained for 90 days from the date received, then automatically deleted.
  • Session data and authentication tokens: expire automatically (email verification tokens within 24 hours, password reset tokens within 1 hour).
  • Photos: retained until you delete them or your account is deleted.

When you delete your account, all your personal data is permanently removed from our systems. Anonymised, aggregated data that cannot identify you may be retained for service improvement.

12. Children's privacy

Ajwa is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, their account will be removed immediately.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Ajwa after changes are posted constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this Privacy Policy or how your data is handled, please contact us at [email protected].