Privacy policy
Last updated: 11 October 2026
Ketabuk has no account, no server and no analytics. What you write in the app is stored on your device and is not sent to me or to anyone else.
This page covers the Ketabuk app for Android and this website, ketabuk.app. The Arabic version is a translation; if the two differ, the English version applies.
Who is responsible
Ketabuk is made by an individual developer. For anything about this policy or your data, write to support@ketabuk.app.
Responsible:
Mohanad Gouda
Nürnbergerstr. 98
95448 Bayreuth
Germany
The app
Everything you enter in Ketabuk stays in the app's own storage on your device: your habits and mistakes, what you log, notes, reflections, repentance entries, your dhikr phrases and your settings.
- There is no account and no sign-in. The app never asks for your name, email address or phone number.
- The app does not send your entries, or any information about you or about how you use the app, to me or to anyone else.
- The app contains no advertising, no analytics and no tracking.
- The app does not use your location, contacts, camera, microphone or photos.
- Android's automatic backup to your Google account is switched off for Ketabuk, so your journal is not copied to Google's servers.
How your entries are protected on the device
Your journal is protected by Android itself in two ways. Android encrypts the storage of current phones, with keys tied to the device and to your screen lock, so the journal cannot be read from a phone that is locked or switched off. And the journal sits in the app's private storage, which Android keeps closed to every other app.
On top of that you can set a 6-digit PIN that Ketabuk asks for when it opens. The app keeps only a salted hash of the PIN (Argon2id), in Android's protected credential storage.
Ketabuk does not add a second layer of encryption of its own to the journal on the device. This matters in one case: someone who has the phone unlocked and also has root access to it could read the journal without the PIN. A strong screen lock is the best protection. Backups are different: Ketabuk encrypts those itself, as described next.
Backups
The app makes a backup only when you ask for one. The backup file contains your journal and is encrypted with a password you choose (XChaCha20-Poly1305, with the key derived from your password by Argon2id). The password is not stored anywhere, and without it the backup cannot be opened, by me or by anyone else.
The app hands the backup to Android's share menu, and you choose where it goes. The app never uploads it itself. If you put it in a cloud service, that service's own privacy policy applies to it.
Reminders
Reminders are off until you turn them on, and Android will ask for your permission to show notifications. They are scheduled on your device by the app itself. Ketabuk does not use a push notification service, so nothing about your reminders leaves the device.
Deleting your data
You can delete individual entries, habits and mistakes in the app. Uninstalling Ketabuk, or clearing its storage in Android's settings, deletes everything the app has stored. Backup files you have saved elsewhere are yours to delete. I hold no copy of your data, so there is nothing for me to delete or to hand over.
Google Play
If you install Ketabuk from Google Play, Google processes data about the download and about your Google account under its own privacy policy. Ketabuk receives none of your personal data from Google.
This website
This website is a set of static pages. It sets no cookies, uses no analytics and loads nothing from other websites.
It is hosted by Cloudflare, Inc. When you open a page, Cloudflare processes your IP address, the page requested, the time, and the browser and device details your browser sends. This is needed to deliver the page and to protect the site against abuse (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Cloudflare may process this data in countries outside the EU, including the United States, where it is certified under the EU-U.S. Data Privacy Framework.
If you write to support@ketabuk.app, I receive your email address and whatever you put in the message, and use them only to answer you (legal basis: legitimate interest, Art. 6(1)(f) GDPR). The mailbox is hosted by Zoho Mail in its EU data centre. Messages are kept only as long as they are needed to deal with your request.
Please do not send journal entries or other private details by email. They are not needed to get help.
Your rights
Under the GDPR you have the right to ask what personal data is held about you, and to have it corrected, deleted or restricted, to object to its processing, and to receive a copy of it. In practice the only such data I could hold is an email you sent. Write to support@ketabuk.app to use any of these rights. You also have the right to complain to a data protection authority.
Children
The app collects no personal data from anyone, of any age.
Changes to this policy
If the app or this website changes in a way that affects your data, this page will be updated before the change is released, and the date at the top will change with it.