Privacy, without the fog.

Who is responsible

Sameer Aqdas Ali, a UK sole trader trading as Khulq, is the controller for personal information handled by the Khulq service. Privacy and data-rights requests can be sent to support@khulq.app.

A lawful service address and professional review remain release requirements before paid subscriptions open. Khulq does not represent that incomplete paid-business gate as approved.

Your private Journey

Your Journey, reflections, prayer records, follow-ups, memory and conversations are written to this browser first and remain available offline.

When encrypted Sync is active for a verified account, those categories are encrypted in the browser before the encrypted copy is stored through Supabase. Khulq’s running service can technically unlock the account copy after a verified sign-in so Sync can work on another device. Supabase alone does not receive the reflective plaintext.

If you use prayer-time location, rounded coordinates are stored with the local Journey and are not included in AI requests. You can remove them from Prayer-time settings.

Account and sign-in

Supabase handles your email address, sign-in session, email verification and password recovery. Khulq does not receive your plaintext password.

If you continue with Google, Google provides Supabase with your email and available basic profile details for sign-in. Khulq does not request access to Drive, contacts, messages or other Google content.

If you join the Pro early list, Khulq stores only your verified account identifier and join time for up to one year. Leaving the list or deleting the account removes that record.

AI only when you choose it

When you deliberately use an AI feature, Khulq sends the words needed for the reply, relevant user-controlled memory and a bounded language instruction through its own gateway to DeepSeek. DeepSeek processes that text in China. Reflections can reveal religious beliefs, so Khulq asks for explicit agreement before the first cloud-AI request and lets you withdraw it in Settings.

A successful Companion turn may make two smaller supporting calls to decide whether a check-in belongs and to update memory on this device. Khulq never starts a new AI request without an action from you.

If you leave while Companion is replying, the reply you already requested may finish in the background. Khulq encrypts the request and finished reply before temporarily storing them in Upstash for no more than 24 hours. Vercel’s work queue receives only a random job ID, not the request. For a signed-in request, the temporary Upstash record also contains the Supabase account ID so another account cannot collect the reply.

Where protected voice transcription is available, a recording of no more than 45 seconds is sent through Khulq to OpenAI, is not stored by Khulq, and returns as an unsent draft for you to review.

Why information is used

• To provide the service: account access, local records, encrypted Sync and the AI feature you requested.
• With explicit consent: cloud AI processing of reflective content and the disclosed international transfer. Consent can be withdrawn in Settings.
• For legitimate security and reliability interests: short-lived abuse controls, fixed error codes and aggregate technical totals that do not contain your messages.
• For legal obligations: records that must be retained if paid billing is opened in the future. Khulq currently accepts no public subscription payment.

Processors and transfers

Khulq uses Supabase for accounts and encrypted Sync; Upstash for short-lived protection, aggregate counters and encrypted background-reply records; Vercel for hosting, gateway execution and a queue carrying only random job IDs; DeepSeek for requested AI replies; OpenAI for protected transcription where enabled; and Stripe only for dormant payment preparation and later billing if Checkout is lawfully opened.

DeepSeek’s China processing is the material restricted transfer disclosed at the point of AI consent. The provider, retention, transfer and professional-review gate remains open and Checkout stays closed while that evidence is incomplete.

How long information remains

• Journey content remains on the device until you clear it, and in encrypted Sync until you remove the cloud copy or account.
• Ordinary rate and action counters last from minutes to one day.
• An encrypted background Companion request and finished reply expire automatically within 24 hours. Khulq removes the request envelope sooner after terminal worker processing, and removes it immediately if the work queue rejects the handoff.
• Content-free monthly usage totals may remain for up to 120 days while launch economics are measured.
• Aggregate AI and payment totals expire after 90 days.
• Local content-free error reports expire after seven days and are never sent automatically.
• The Pro early-interest record expires after one year or sooner when you leave or delete the account.

Your choices and rights

Settings lets you export, restore or clear local Journey data; shape or clear memory; remove prayer-time location; withdraw AI agreement; and manage encrypted Sync. Account deletion removes the sign-in identity, its encrypted vault and any temporary background-reply records owned by that account, while leaving private records already stored in that browser unless you clear them separately.

Depending on the information and lawful basis, UK data-protection rights may include access, correction, deletion, restriction, objection and portability. Email support@khulq.app to exercise a right. Where Khulq never received local-only content, the app’s own export and deletion controls are the direct way to act on it.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.