Contents
1. Welcome to Heed
Welcome to Heed. This Privacy Policy explains how we collect, use, and protect your information when you use the Heed mobile application and website at heed.app (collectively, the "Service"). By using Heed, you acknowledge that you have read and understood these terms.
We designed Heed with privacy as a core principle. The most sensitive data — your journal reflections, your screen time choices, your spiritual practice — stays on your device. We do not sell your data. We do not serve advertisements.
2. Who We Are
26 Labs Ltd is the data controller for this Service — a private limited company incorporated in England and Wales.
- Company: 26 Labs Ltd
- Registered: England and Wales
- Email: [email protected]
- Website: heed.app
3. What Information We Collect
3.1 Information You Provide Directly
Your name: Entered during onboarding to personalise your experience (e.g. "Assalamu alaykum, Hamza"). Stored locally on your device only.
Practice preferences: Your chosen dhikr types, intensity settings, and ritual preferences — configured during onboarding and stored locally on your device.
3.2 Usage and Practice Data
Your dhikr counts, day streaks, prayer logs, time earned, and session statistics are stored locally on your device. If you have iCloud enabled, this data is backed up through your personal iCloud account — which we cannot access.
Journal entries: Any reflections or thoughts you write in Heed's journal are stored exclusively on your device. They are never transmitted to our servers or any third party under any circumstances.
3.3 App Restriction Data
Your app restriction choices never leave your device. The apps you choose to limit are managed entirely through Apple's Family Controls, Managed Settings and Device Activity frameworks — as a personal self-control tool on your own device. This information is handled by Apple's operating system and is never transmitted to, stored by, or accessible to 26 Labs Ltd. We do not monitor, receive, or store any information about your app usage.
3.4 Location Data (Qibla)
The Qibla feature uses your device's live location to calculate the direction of prayer toward Makkah. This calculation is performed entirely on your device in real time. Your location is not stored, logged, or transmitted to any server. You can revoke location access at any time in your iPhone Settings.
3.5 Purchase Information
Heed subscriptions are processed entirely by Apple through the App Store. We do not collect or store your payment details, card information, or billing address. Please refer to Apple's Privacy Policy for information on how Apple handles payment data.
3.6 Subscription Analytics Data (RevenueCat)
We use RevenueCat, a third-party subscription management and analytics platform, to manage and analyse subscription activity within Heed. When you subscribe, cancel, or interact with an offer code, RevenueCat receives and processes the following data from Apple's servers on our behalf:
- An anonymous RevenueCat user identifier (randomly generated, not linked to your name or email)
- Subscription status and lifecycle events — start, renewal, cancellation, refund, and expiry
- Transaction receipt data provided by Apple's StoreKit framework
- Offer code reference names (for example, the campaign name associated with a promotional code)
- Platform and device information — iOS version, app version, and device type
RevenueCat does not receive your Apple ID, name, email address, payment details, or any personally identifying information. All data passed to RevenueCat is either anonymised or derived from Apple's transaction records. RevenueCat acts as a data processor on our behalf and is contractually obligated to process this data only as instructed by 26 Labs Ltd.
4. How We Use Your Data
We use the information we collect to:
- Provide, maintain, and improve the Heed application
- Personalise your experience using your name and preferences stored on your device
- Manage and analyse subscription activity — including tracking active subscribers, renewals, cancellations, and refunds — through RevenueCat
- Measure the performance of promotional offer code campaigns, including tracking redemption counts and conversion rates per campaign
- Comply with our legal obligations as a UK company
We do not use your data for advertising, profiling, or any form of automated decision-making that produces legal or similarly significant effects on you.
5. Data Storage and Security
The vast majority of data in Heed is stored locally on your iPhone using Apple's secure on-device storage mechanisms (SwiftData). This data is protected by your device's encryption and, where applicable, your biometric security.
Subscription analytics data — including anonymous transaction events and offer code redemption data — is stored on RevenueCat's servers in accordance with their security practices and data retention policies. This data is anonymised and does not include your name, email, or payment information.
We retain personal information only as long as necessary for the purposes described in this policy or as required by applicable law.
Removing your data: Because Heed does not require account creation, there is no server-side account to delete. Uninstalling the app removes all locally stored data from your device. To request deletion of any anonymised subscription analytics data held by RevenueCat on our behalf, contact us at [email protected]. iCloud backups can be managed through your iCloud settings.
6. Third Parties
We work with the following third-party services:
- Apple Inc. — iOS platform, App Store, StoreKit (subscriptions and offer codes), FamilyControls (screen time), and iCloud backup. Subject to Apple's Privacy Policy.
- RevenueCat Inc. — Subscription management and analytics platform. RevenueCat receives anonymised transaction and subscription lifecycle data from Apple's servers on our behalf. This includes subscription status, offer code campaign performance (by reference name only), renewal and cancellation events, and anonymous device identifiers. RevenueCat does not receive your name, email, Apple ID, or payment details. RevenueCat is based in the United States and is GDPR compliant. Subject to RevenueCat's Privacy Policy.
We do not use advertising networks or sell your personal information to any third party. We do not share your data with any third party for marketing purposes.
We may disclose information if required by law or a valid court order.
7. Children's Privacy
Heed is not directed to individuals under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, please contact us at [email protected] and we will take prompt steps to remove that information.
8. Your Rights Under UK GDPR
As a UK resident, you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of any inaccurate data we hold.
- Right to erasure: Request deletion of your personal data where there is no legitimate reason for us to continue processing it.
- Right to restriction: Request that we restrict how we process your data in certain circumstances.
- Right to object: Object to processing based on our legitimate interests.
- Right to data portability: Where applicable, request your data in a machine-readable format.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. International Data Transfers
Heed is built and operated in the United Kingdom. As most data is stored locally on your device, international data transfers are limited to two services:
- Apple Inc. (USA) — processes subscription transactions globally. Apple applies appropriate safeguards in accordance with applicable data protection law.
- RevenueCat Inc. (USA) — processes anonymised subscription analytics data. RevenueCat is GDPR compliant and applies standard contractual clauses and other appropriate safeguards for transfers of data from the UK to the United States.
In both cases, only anonymised or non-personally identifying data is transferred. No data that directly identifies you — such as your name, email, or payment details — is transmitted to servers outside your device.
10. Updates and Contact
We may update this Privacy Policy from time to time. Any material changes will be communicated within the app or on this page. The "Last updated" date at the top indicates when the most recent revision was made.
- Email: [email protected]
- Company: 26 Labs Ltd, registered in England and Wales