Legal
Privacy Policy
Last updated: July 2026
The short version
We collect as little as possible, store it securely, never sell it, and never use it to advertise to you. What you write in your journal is private. Always. This policy should be read alongside our Terms & Conditions, which explain that myhidayah is an educational resource and not professional advice.
1. What we collect
When you create an account, we collect your email address — that's it, there's no password, since you sign in via a magic link sent to your email. Journal entries, mood entries, and dhikr counts are stored against your account and are never read by us, shared with anyone, or used to train AI models. If you accept analytics cookies (see Cookies below), Google Analytics collects anonymous, aggregated usage data — no personally identifying information.
2. AI features (Companion, search insights)
If you use the Companion feature or trigger an AI-generated search insight, the text you enter is sent to our AI provider (Anthropic) solely to generate a real-time response. What you actually typed is never stored by us, unless you separately choose to save something to your journal. Companion can draw on real passages from Islamic books we've added to the site; to understand whether this is working well, we keep an anonymous log of which general topics your message touched on (e.g. "grief", "patience") and whether a relevant passage was found — never the message itself. This log is deleted automatically after 90 days.
3. Legal basis for processing (UK GDPR)
We process your account data to provide the service you've signed up for (contract), and essential cookies on the basis of our legitimate interest in keeping the site running and secure. Analytics cookies (Google Analytics) are used only with your consent, given via the cookie banner — see Cookies below. We do not rely on consent for anything else beyond the optional newsletter, which you opt into separately.
4. What we never do
We never sell your data. We never show targeted advertising or use analytics data for advertising. We never share your journal entries. We never use your data to train AI models. We never send emails you did not ask for.
5. Newsletter
If you subscribe to our newsletter, we store your email address to send the newsletter only, via our email provider (Resend). You can unsubscribe at any time using the link in any email.
6. Cookies
We use essential cookies — the minimum required to keep you logged in — always, since core features like sign-in and journaling can't work without them. With your consent (given via the cookie banner), we also use Google Analytics, which sets its own cookies to help us understand how the site is used, in aggregate. Analytics cookies never run before you accept them, and you can decline them and still use every feature of the site. We do not use advertising cookies or third-party tracking cookies of any kind. See our Terms & Conditions for more.
7. Who we share data with
We use a small number of trusted service providers to run myhidayah: Neon (database hosting), Vercel (site hosting), Resend (transactional email, newsletter, and magic link sign-in), Anthropic (AI features, as above), and — only with your consent — Google Analytics for aggregated usage data. We also use Google Search Console to monitor how the site appears in Google Search results; this only involves data about the site itself, not data collected from your browser. Each provider only receives the minimum data needed to perform its function, and none are permitted to use your data for their own purposes.
8. International transfers
Our hosting and service providers may process data outside the UK/EU (for example, in the United States). Where that happens, we rely on providers with appropriate safeguards in place, such as Standard Contractual Clauses.
9. Data retention
We keep your account data for as long as your account is active. If you delete your account, we delete your personal data and journal entries within 30 days, except where we're required to keep something longer for legal reasons.
10. Children's privacy
myhidayah is intended for users aged 13 and over — see our Terms & Conditions. We don't knowingly collect data from children under 13.
11. Data storage & security
Your data is stored on servers in the European Union. All data is encrypted in transit (HTTPS) and at rest.
12. Your rights
Under UK GDPR, you have the right to access the data we hold about you, correct inaccuracies, download your data, request erasure, restrict or object to processing, and delete your account at any time. To exercise any of these, contact privacy@myhidayah.co.uk. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ico.org.uk).
13. Changes to this policy
We may update this Privacy Policy from time to time. If we make significant changes, we'll update the date below.
14. Contact
For any privacy questions: privacy@myhidayah.co.uk