Your privacy.

I’m Nihal. I build and run Wifaqa on my own, for Muslims anywhere in the world. It is not a registered company and not a registered charity.

Write to me at nihal@wifaqa.com. Questions about the service, your account or your information all reach the same inbox, and I answer them myself.

Nothing is collected before the stage it belongs to. You can stop at any stage and keep what you have.

Your account

Your name and email address, a password hash, whether your email is verified, your access role and your sessions. Where you came from when you signed up: the kind of place (for example Instagram or a search engine), a campaign name from one of my own links, and your answer to “How did you hear about Wifaqa?” if you gave one. A session record holds device and browser information and a network address. If you turn on an authenticator, its secret and your recovery codes are stored encrypted.

Your story

Ten chapters and around ninety questions: present circumstances, faith and practice, ethnic and cultural background, upbringing, languages, habits, height, weight, education, work and an approximate income band, support needs, family commitments, expectations and future plans. Some of that is sensitive information about you.

The review conversation

What Wifaqa Review asks and what you reply. Your replies are kept with your story. Nothing you say there edits your saved answers.

Matching

The requirements and preferences you confirm, and material derived from your answers: proposed matching facts, written passages and numeric representations of their meaning.

Photos

The private photos you upload. Embedded location information is removed and the image is re-encoded, so no original file or filename is kept.

The identity check

Your document, selfie and liveness check are handled by the verification provider on its own page. I keep the result, your verified date of birth, your consent record and the provider’s reference.

Introductions and conversations

The short profile you approve for a candidate, each person’s interest, photo permission and final acceptance, the messages in a supervised room, and how far each person has read.

Payments

Order references, captured-payment status, refund records and a minimal ledger of mutually accepted introductions. Card details are entered with the payment provider, not with me.

Help requests

What you write, and any messages you choose to attach as evidence. A private help request is shared only with you and me.

• To run your account, and to keep it secure.
• To prepare your private marriage profile from your story.
• To check both people’s requirements in both directions and rank who is worth introducing.
• To open supervised introductions once both people have agreed.
• To take a payment when one is due, and to reconcile it.
• To answer you when you ask for help, and to handle a report.
• To count page views and a few completed steps, such as a story being confirmed, so I can see where people stop. Those counts carry nothing you wrote.

Nothing here is used to build advertising audiences or a public profile of you.

Every consent is a separate box you tick yourself. None of them is ticked for you, and the version of the notice you agreed to is stored with your answer. This is what each one says, and how you take it back.

“I explicitly consent to Wifaqa storing and using my interview answers, including any sensitive information … that I choose to share, to prepare my private marriage profile.”

“Delete my story” removes the draft, the confirmed versions and the saved conversation, and keeps your account.

“I explicitly agree to external processing of my saved questionnaire and review replies, including sensitive personal information.”

Pause or withdraw it in review settings. That stops new requests; it cannot recall anything already sent.

“I explicitly agree to the use of my confirmed profile, including its sensitive information, to find introductions, as described.”

Withdraw it in your matching preferences. The material derived from your profile is removed from the active database, no new introductions are made, and your story stays.

“This is my photo. I agree to Wifaqa processing and storing it privately for marriage introductions until I remove it or delete my account.”

Remove a photo. Access ends immediately and the stored file is removed by the cleanup worker. The sentence reads in the plural when you choose several photos at once.

“I consent to this identity check and the handling of my information described below. I will use my own document and complete the selfie myself.”

“I want to withdraw this check and request removal of its verification records.” Your eligibility pauses; your story and preferences stay saved.

Each introduction asks separately for your interest, then your photo permission, then your final acceptance.

Either of you can stop at any stage, and closing an introduction ends the other person’s access.

These are the companies that receive some part of your information so that the service can run. None of them is used to advertise to you.

Railway

The application and the PostgreSQL database, so everything you save.Where it is processed: Europe region.

Google, through its paid Gemini API

Your story answers, your matching expectations, your review replies and the passages derived from them. The paid terms exclude that content from model improvement; limited safety retention still applies.Where it is processed: Outside your country.

Didit

Your identity document, your selfie and the liveness check. It returns the result and your date of birth.Where it is processed: Not established.

Cloudflare R2

Your private photos, with location information removed and the image re-encoded.Where it is processed: Not established.

Cloudflare Turnstile

Only when you create an account: a check that a person, not a script, is filling in the form. Cloudflare sees your network address and details about your browser and device for that check.Where it is processed: Cloudflare’s own network, which may be outside your country.

Zoho ZeptoMail

Your email address and the text of the email. Open and click tracking are switched off.Where it is processed: India endpoint.

Razorpay

Your payment. It runs in test mode only today, and card details are entered with the provider.Where it is processed: Not established.

PostHog

Page views from my own server: the page, where the visit came from, the device type and the country, with no cookie and nothing you wrote. Inside an account, a few completed steps under a scrambled reference in place of your account, and for a new account the kind of place it came from.Where it is processed: European Union.

Where a row says the place is not established, I have not confirmed it yet and I would rather say so than guess. Text you have written is not put into notification emails or routine application logs.

There is nothing to search and no catalogue of people. Your firm requirements and the other person’s are checked in both directions in code. Structured details are compared, the meaning of what you each wrote is compared, and a shortlisted pair is then assessed automatically.

That assessment is automated processing, not my approval of a person. A score is never a probability of a successful marriage, and no percentage is shown to anyone.

Nothing reaches the other person without both of you agreeing at that stage: interest, then photographs, then final acceptance.

If you want me to look at a recommendation or a decision, send a private help request from your account, or write to me. Only you and I can read it.

• A story is kept until you delete it or delete your account. Up to ten confirmed versions are kept while it is active.
• A closed introduction and its private cards are removed 30 days after it closes.
• A closed help request is removed after 30 days. An open one that has gone quiet is removed after 90 days.
• An expired supervisor invitation, and a supervision that has ended, are removed after 30 days.
• A record of an email I queued for you, once it is sent or cancelled, is removed 30 days after it was queued.
• Deleting your account removes the account, your credentials, your authenticator, your sessions, your story, your confirmed profiles and your private introduction rooms.
• Three things survive that deletion: minimal payment records, a pseudonymous key that stops a new account bypassing service limits, and a record that a pair was recommended with both names detached, so the same pair is not introduced twice.
• Each review request is recorded (counts, cost and status, never text) under a one-way fingerprint of your email address, so a new account cannot restart a story’s processing allowance. It survives deletion and stops being linked to you 24 months after your last request; the figures stay in the accounts.
• A private, one-way fingerprint of your email address is kept after deletion, against the people you have already been introduced to and anyone either of you blocked, so that a deleted and re-created account cannot bring back an introduction that is over or a block that was made.
• Emails already delivered are copies in an inbox. You delete those yourself. Providers keep their own delivery records and backups on their own settings.

These are the periods the service enforces today. I keep no backups of my own yet; when I do, this section will say how long each one is kept.

See and download it. Security in your account gives you a JSON file of your own data. It asks for your password. Photos download separately from your photo page. The file leaves out other members’ private profiles and contributions, and reports about you.

Correct it. Edit your story and your preferences and confirm a new version.

Delete it. “Delete my story” keeps your account. “Delete my account” removes the account itself.

Withdraw a consent. Each one is listed above with the place you take it back.

Object, or ask me to stop. Send a private help request from your account, or write to me.

Complain. You can complain to your local data protection authority. If you live in the UK that is the Information Commissioner’s Office, at ico.org.uk.

You must be 18 or over to use Wifaqa, and you confirm that when you create your account.

The questions ask you not to identify anyone else. In their own words: “Avoid names, addresses or identifying details about anyone else”, and, where children are involved, “Describe time, care and boundaries without children’s names, schools or exact ages”. The interview notice adds that you should not include contact details, documents, exact financial information, medical histories or identifying details about children or anyone else. If something like that does end up in your answers, ask me through a private help request.

A wali or another trusted Muslim adult takes part with their own account. The invitation shares your name with them. It does not give them your questionnaire answers or your private safety reports.

Signing in sets session cookies. They carry a wifaqa prefix, they are http-only, and a session lasts seven days.

Two things are kept in your browser’s session storage, which is cleared when you close the tab: a flag, so that signing in again takes you back to Security, and what first brought you to the site (the kind of place, such as Instagram, and a campaign name from one of my own links). The second leaves your browser only if you create an account.

If you choose a country for prices, or your browser’s time zone suggests one, a cookie remembers it for a year. It is used for nothing but showing prices in your currency.

That is everything. I use no advertising and nothing that follows you across other sites, and email open and click tracking are switched off. Page views are counted by my own server, which sets no cookie and loads no script in your browser; “Who receives your data” says what is sent. Two third-party scripts are loaded, each only where it is needed: Cloudflare’s check on the page where you create an account, and the payment checkout on the billing page.

This version is written for members anywhere in the world: you complain to your own data protection authority, and processing that happens outside your country is described as such. The analytics row says exactly what my server counts, a new account records where it came from, and the price cookie is listed. This version adds how long review usage records stay linked to you (24 months), says plainly that there are no backups yet, and quotes the matching agreement in its final words. It also adds Cloudflare’s check on the page where you create an account. If I change the policy again, the version and date below change with it.

Policy version: privacy-v10 · 24 September 2026

Each stage has its own notice, shown before you agree to it. They go further than this page does.

The account noticeThe interview noticeThe matching notice

Service termsThe accountsWrite to me