Privacy Policy

Effective 25 October 2026. Updated to add Google Analytics, and emails about Sitaray.

Sitaray is a family app: parents set tasks, children earn stars for doing them, and spend the stars on rewards the parents choose. This policy explains what Sitaray collects, why, who it is shared with, and the choices you have. Sitaray is run by Waqqas Jabbar ("we", "us"). Questions go to hello@sitaray.app.

The short version

We collect only what the app needs to work: your family's accounts, tasks, rewards and stars.
No ads, and we never sell your data. We use Google Analytics to count which screens parents and visitors open, never on children's screens.
Parents set up children's accounts. Children never give us an email address.
A few services help run the app, such as email and the optional AI assistant. Each one is listed below with what it receives.
You can ask us to give you a copy of your family's data, correct it, or delete it.

What we collect

Parents

Account: your name, email address and password. We store only a scrambled form (a hash) of your password, never the password itself.
Sign in with Google (if you use it): your name, email address and Google's ID for your account.
Face ID or fingerprint sign-in (if you turn it on): a public key from your phone and the device name. Your face or fingerprint never leaves your phone, and we never see it.

Children

A parent adds each child. For each one we keep the name, avatar and PIN you give them (the PIN as a hash), and optionally a birth year, which helps suggest age-appropriate tasks. If you use the Nayatel Guardian integration, we also keep the names of their devices. We don't ask children for an email address, phone number, photo or location.

Your family's activity

The family name and time zone, the tasks and rewards you create, completed tasks and approvals, the stars each child earns and spends, savings goals, and reward requests.

Optional features

Prayer times: the city you pick, and its map coordinates, so we can work out prayer times. We don't use your device's location.
Notifications: if you allow them, your browser gives us an address for sending notifications to that device.
Family assistant: the messages you exchange with it, and the changes it suggests.
Shared library: if you publish a task or reward, other families can see it along with your family name, for example "Khan family".
Emails from Sitaray: which kinds of email you've chosen to get (see below), and for each email we send you, whether it was delivered, opened and which of its links you clicked. Opens are counted when the email's images load, so they're approximate.

Collected automatically

When each person last used the app, and the server's standard logs (IP address, time and page requested), which are used to keep the service running and secure.

Google Analytics records which screens parents and visitors open, such as the log-in page or Tasks, with the kind of device and browser and the rough location (country or city) it works out from the IP address. It does not receive names, email addresses, account numbers or anything you type. It never runs on a child's screens.

How we use it

To run the app: signing in, tracking stars, sending reminders and notifications.
To send account emails, such as password reset links.
To email parents about Sitaray, in the kinds of email they've chosen: service notices (such as changes to these terms, which go to every parent), product updates, tips and ideas, and offers and news. Offers and news are off until you turn them on. Every email says why you got it and has a link to stop that kind.
To answer and improve the family assistant's suggestions, when you use it.
To keep Sitaray secure, for example by blocking repeated wrong passwords.
To understand how the app is used, as overall counts such as how many families are active and which screens are used most, on our own admin site and in Google Analytics.
To reply when you contact us.

We don't use your data for advertising, and we don't build profiles of children.

Who we share it with

We share data only with these services that help run Sitaray, and only what each one needs.

Oracle Cloud hosts the server and database. The server may be in a different country from you.
Anthropic (Claude) runs the family assistant, only when a parent uses it. It receives the parent's messages and the family details the assistant needs to answer: children's first names, ages, star balances and goals, and the family's tasks and rewards. Under Anthropic's commercial terms, it may not use this data to train its models.
Resend sends emails, such as password reset links and emails about Sitaray. It receives your email address and the email.
Google, if you choose "Continue with Google", to sign you in. Your browser also loads the app's font from Google Fonts, which sees your IP address.
Google Analytics receives the page views described above, from parents' and visitors' screens only. Its advertising features are turned off, and Google doesn't use this data to show you ads. You can block it with your browser's privacy settings or Google's opt-out add-on, and Sitaray still works.
Nayatel Guardian, only if a parent connects it: the device names and the internet time to allow.
Notification services run by browser makers (Google, Apple, Mozilla, Microsoft) deliver notifications. Messages are encrypted so that only your device can read them.

We may also disclose data if the law requires it, or to protect the safety of a child or anyone else. If Sitaray is ever passed to someone else to run, this policy goes with it, and we'll tell you first.

Children's privacy

Sitaray is used by children, but only under a parent's account. Children can't sign up themselves. Google Analytics is switched off while a child is logged in. The parent who adds a child gives consent for that child's data to be used as this policy describes, and can view, change or remove it at any time in the app. Children don't see ads, and can't contact anyone outside their family through Sitaray. If you think a child's data is in Sitaray without a parent's consent, email us and we'll delete it.

Cookies and storage on your device

Sitaray uses one cookie of its own, which keeps you signed in. It also saves a few settings in your browser, such as your family code and which log-in tab you used last. Google Analytics sets its own cookies (named _ga) to tell visits apart, on parents' and visitors' screens only. There are no advertising cookies.

How long we keep it

We keep your family's data while your account is in use. If you ask us to delete your family, we delete it within 30 days. Copies in our backups are replaced as new backups are made, usually within a few weeks. Server logs are kept for a short time and then deleted.

Security

Connections to Sitaray are encrypted (HTTPS). Passwords, PINs and reset links are stored only as hashes. Repeated wrong passwords and PINs are blocked for a while. No system is completely secure, so please use a strong password. If there's ever a breach that affects your data, we'll tell you.

Your choices and rights

See and change: parents can view and edit their family's data in the app at any time.
Remove a child: on the Kids page. This stops them signing in, and their history stays visible to you. To delete a child's data completely, email us.
Get a copy, or delete everything: email us from the address on your account and we'll reply within 30 days.
Turn things off: notifications, prayer reminders, assistant check-ins and integrations can all be turned off in Settings.
Choose your emails: turn each kind of email on or off in Settings, or with the link at the bottom of any email, which works without logging in. Only service notices can't be turned off.

Depending on where you live, you may have further rights under your local data protection law. To use them, email us.

Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, we'll also tell parents in the app or by email before it takes effect.

Contact

Waqqas Jabbar, hello@sitaray.app