Sunnah Lock is made by Abdelazziz Fezani ("we", "us"). Questions, requests, or complaints: admin@sunnahlock.com
Sunnah Lock is available on iOS and Android. Our iPhone and Android apps are built differently, so what each one collects is different. Both use Google Firebase Analytics in a limited way, with no ads and no tracking across other apps. Jump to your platform below, or read both.
This page also covers this website.
Last updated: 8 October 2026. This section covers the Sunnah Lock iPhone app, version 1.3.2 and later.
The short version
Sunnah Lock helps you block apps and websites for yourself. Most of what makes that work never leaves your phone.
- We never learn which apps you block. Apple's Screen Time system doesn't tell us. It isn't that we choose not to look; the information simply isn't available to us.
- We never receive your location. Not the places you set for location blocks, and not the coordinates used for prayer times. (Our analytics provider estimates only a general region, such as a country or city, from a masked IP address. See Analytics.)
- What you tell us during setup stays on your phone. The name and age you enter are kept on your device only.
- We keep a small account on our servers: your email, your name from your sign-in provider, a user ID, your app version, your dhikr counts, and, if you entered one, the creator code you used.
- We use limited, anonymous analytics, and no tracking. No advertising identifier, no ads, no tracking across other companies' apps or websites.
- We don't sell your data, and we never will.
What stays on your phone
Almost everything Sunnah Lock does happens in a private storage area on your device that only Sunnah Lock and its own extensions can read. It is never uploaded.
That includes your blocks (names, schedules, daily limits and the apps or categories they cover), your Screen Time selections, your location-block places, your prayer-time settings and the coordinates used to calculate them, your own website list, your theme and notification preferences, and Sunnah Lock's own statistics (how often a shield stopped you, and your lock sessions), which are deleted automatically after 90 days.
The name and age you enter during setup also stay here. We use them to personalise the app on your phone, and they are never sent to us. You must be 13 or older to complete setup.
Deleting the app deletes all of it.
Screen Time data — the part worth reading
Sunnah Lock blocks apps using Apple's Screen Time framework, and the way that works is unusually private.
When you choose apps to block, iOS shows you Apple's own app picker. Sunnah Lock doesn't draw that screen and can't read it. What iOS hands back is not a list of app names but a set of opaque tokens that only iOS can understand. We store those tokens on your phone, hand them back to iOS to apply a shield, and that is all.
So Sunnah Lock genuinely doesn't know which apps you blocked: not on your phone, not on our servers, not anywhere.
The same is true of your usage figures. The usage charts in Insights are drawn by Apple inside a sealed view. We can show the chart, but we can't read the numbers in it, and they never reach our servers.
Sunnah Lock asks for Screen Time permission for the person using the device. You are locking your own phone, by your own choice.
Location
Location is optional and used for two features. Neither sends your location to us.
Location-based blocks
You drop a pin on a place (campus, work, the masjid) and your blocks switch on when you're there. Your phone watches that boundary itself. The coordinates stay on your device, and we keep no history of where you've been.
Prayer times
Sunnah Lock takes a single, city-level location fix to calculate prayer times for your area. It's stored on your phone and reused, not tracked continuously.
What goes to Apple
To be exact: when you search for a place, what you type is sent to Apple Maps to return results, and when you set a place, its coordinate is sent to Apple to look up a readable place name. Apple handles both under its own privacy policy. We receive nothing from either.
You can use Sunnah Lock without location at all. You lose location blocks and automatic prayer times; everything else works.
Account data — what is on our servers
Sunnah Lock uses Google Firebase for accounts and sync. This is everything it holds about you.
Your account. When you sign in with Apple, Google or an email address, Firebase Authentication stores your email address, your name if your sign-in provider shares it, and a user ID. If you use Sign in with Apple and hide your email, we only ever see Apple's private relay address.
Basic app details. The app version you're running and the date you first opened the app, so we can make sense of bug reports and apply your free-trial period correctly.
Your dhikr counts. If you use the dhikr counter while signed in, your daily counts sync to your account so they survive a reinstall.
A creator code, if you enter one. If you enter a creator's code, we record that your account used that code, so the creator can be credited a share of what your subscription earns. When a subscription payment is credited, the record holds the amount, the date and your user ID. Creators never see your name, email or any account details.
What is never on our servers: which apps or websites you block, your Screen Time usage, your location, your block schedules and limits, the name and age you entered during setup, your prayer settings, or your Sunnah Lock statistics.
One small note about older versions. Versions before 1.3.3 also saved a one-line note on our server if Screen Time permission was turned off while you were signed in: your user ID, the time, and the words "Screen Time authorization was revoked". It was intended for a feature that hasn't launched, and nobody is shown it. From version 1.3.3 it isn't sent, and deleting your account deletes any such notes.
Analytics
We use Google Firebase Analytics in a deliberately narrow way. While you go through first-time setup, the app sends a few anonymous events: that setup started, which step was reached, which path was chosen, and that setup finished. Firebase also records a few standard events on its own, such as the first time the app is opened, when a session starts, and when the app is updated, together with basic device details such as the device model, iOS version, app version and language. Firebase also automatically records in-app purchase events (which plan was bought and its price), and it estimates a general region, such as a country or city, from a masked version of your IP address. It never uses your phone's location services.
These events never include anything you type, the apps you block, your Screen Time data, your location, your name, your email or your account. We don't connect them to your account, we don't use the advertising identifier, and we don't use them for advertising or tracking.
Notifications
Sunnah Lock's reminders and notifications are scheduled on your phone. We don't collect a push notification token.
Subscriptions
Subscriptions are sold through the App Store, and Apple handles all payment. We use RevenueCat to know whether your subscription is active. RevenueCat receives your purchase and subscription details from Apple, linked to your Sunnah Lock user ID. It never receives your Screen Time data, the apps you block or your location.
The accountability partner feature
An accountability partner feature is being prepared but is not available yet, and nothing related to it is collected or sent. Before it launches, we will update this policy to explain exactly what it shares and with whom.
Age and children
Sunnah Lock is a self-control tool for adults and teenagers aged 13 and over. It isn't directed at children under 13, it isn't in the App Store's Kids category, and setup asks for your age and won't continue below 13. We don't knowingly collect information from children under 13 (or under 16 where local law sets that age).
If you believe a child has created an account, contact us at the address below and we will delete it.
How long we keep things
- On-device statistics: 90 days, then deleted automatically.
- Other on-device data: until you delete the block or the app.
- Your account, dhikr counts and creator-code record: until you delete your account.
- Subscription records held by RevenueCat and Apple: kept as Apple and financial record-keeping rules require, including after you delete your account.
Deleting your account
You can delete your account from inside the app: Settings → Account → Delete Account. It asks you to confirm, and then it genuinely deletes. There is no "contact support" step and no soft delete. If it has been a while since you signed in, you may be asked to sign in again first; that's a security requirement.
Deletion removes:
- your sign-in account itself;
- your user record on our servers, including your app version and first-launch date;
- all of your synced dhikr counts;
- your creator-code record;
- any older notes described under "Account data".
From version 1.3.3, if you use Sign in with Apple, deletion also revokes Sunnah Lock's access to your Apple ID.
What is kept, stated plainly. If you subscribed through a creator's code, the creator's earnings record for each payment is kept so their accounting stays correct, but your user ID is removed from it, so it no longer points to you. Subscription and purchase records held by RevenueCat and Apple are kept as Apple and financial rules require. The anonymous analytics described above were never linked to your account, so there is nothing in them to connect back to you.
Deleting your account doesn't delete data held on your phone. Delete the app for that. Deleting your account also doesn't cancel an App Store subscription; manage that in iOS Settings → your name → Subscriptions.
Third parties
We use as few as we can.
Google (Firebase). Provides sign-in (including Sign in with Google), the database that holds your account data, our server functions, and the anonymous analytics described above. Google processes this data on our instructions. We don't use Crashlytics, Performance Monitoring or any advertising product.
RevenueCat. Manages subscription status, as described under "Subscriptions".
Apple. Provides Screen Time, Sign in with Apple, maps and place search, and the App Store, under Apple's own privacy policy.
That's the complete list. No advertising network, no data broker, no attribution SDK.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Email us and we will act on it, normally within 30 days.
If you are in the EU, UK or EEA (GDPR). You have the right to access, correct, delete, restrict and object to our processing of your data, and to receive it in a portable form. Our legal bases are: performance of our contract with you (your account, sync and subscription), your consent (location and notifications, which you can withdraw at any time in iOS Settings), and our legitimate interest in keeping the service working, secure and improving, which is what the anonymous setup analytics serve. You can complain to your national data protection authority.
If you are in California (CCPA/CPRA). You have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We don't sell or share personal information, and we never have. We will never treat you differently for using these rights.
Everyone. In-app export (Settings → Data) gives you a machine-readable copy of your Sunnah Lock records. It leaves out your Screen Time selections and your coordinates, because those aren't in a form we could hand out.
Security
Everything in transit uses HTTPS. Our database rules let you read and write only your own records; nobody else can reach them. No system is perfect, but there is genuinely very little here to take.
Governing law
This policy is governed by the laws of the State of New Jersey, United States.
Changes to this policy
If we change what we collect, we will update this page and its date, and for anything significant we will tell you in the app before it takes effect.
Contact
Questions, requests or complaints: admin@sunnahlock.com
Sunnah Lock for Android is an Android application that helps you manage your screen time and block distracting or harmful apps, websites and content on your own device, or on a child's device you manage. This policy explains what data the App handles, what stays on your device, what is sent to the cloud, and why.
What you block, your schedules, your screen-time statistics and your PIN never leave your device — unless the phone is a linked child's phone, in which case the totals listed below are shared with the parent. We do not upload, track or sell your activity.
To sign in, the App creates an account using Firebase (a Google service). Your email address — and, if you use Google Sign-In, your name and profile photo — are stored on Google's servers so you can log in.
We collect anonymous usage statistics through Firebase Analytics so we can improve the App: which screens are opened, whether setup was finished, when a block is created, and whether a purchase was made. Never what you block, never your screen time, never anything about a linked child's phone. You can turn this off in Profile → Support.
We never sell your data, and we never share it with advertisers or other third parties.
Data stored locally on your device
The following is stored only on your device (encrypted) and is never transmitted to us or anyone else:
- Block configurations — the apps, websites, keywords and schedules you set up for blocking.
- Block event logs — a record of when a blocked app or website was intercepted, used to display your statistics on the Insights screen.
- Screen-time data — read from Android's Usage Stats API to display your usage patterns. It is shown to you only and is not copied off the device.
- PIN — if you set a PIN, only a one-way cryptographic hash (SHA-256) is stored. Your actual PIN is never saved in readable form.
On-device data is encrypted using Android's Jetpack Security library (EncryptedSharedPreferences) and SQLCipher for the local database.
Data stored in the cloud
To provide sign-in and optional features, the App uses Google's Firebase platform. The following data is sent to and stored on Google's servers.
Account information (Firebase Authentication)
- If you register with email, your email address and password are used to create your account. Passwords are handled and stored by Firebase Authentication; we never see or store your raw password.
- If you sign in with Google, your email address, display name and profile photo URL are received through Google Sign-In.
- Each account has a unique user ID and sign-in timestamps.
This information is used solely to let you sign in and stay signed in. It is not used for advertising, and it is not sold or shared.
Family link (Cloud Firestore) — optional
- The family link is set up with a 6-digit pairing code: your phone shows the code, and the child's phone types it in. A code expires after ten minutes and works only once. Your phone deletes it as soon as the child's phone links or as soon as you request a new one, and an automatic cleanup removes any code that nobody used. There is no shared login — you never give the child's phone your password.
- The child's phone signs in with an anonymous account — no email, no name, no password. Firebase gives it a random account ID, and that ID is what identifies the phone to your family.
- Once linked, the child's phone stores under your family: the name you gave the phone, the age band you chose, the phone's model and app version, when it last checked in, and whether its protections are switched on (Accessibility Service, display over other apps, Device Administrator, Lockdown, and whether a parent PIN has been set).
- If you use the parent controls, it also stores: the names of the apps installed on it; its screen time today and the five apps it spent the most time in, as totals only; how many times a block stepped in; the same two totals for each of the last seven days; a record of when the Accessibility Service was turned off, when Device Administrator was removed, when the phone started in safe mode, when Lockdown was turned off, when an emergency unlock was used, and when an app was installed or removed; and any request the child sends you to open or unblock an app.
- Websites, searches, messages, photos, location, anything typed and anything shown on the screen are never collected. The link carries device status, app names and totals only — never what was viewed, opened or typed, and never where the phone is.
- The child can see this exact list on their own phone, under "What your parent can see" in their profile.
- Retention: records of what happened are deleted thirty days after they happened, and requests are deleted thirty days after the child sent them, whether or not you answered. The app list and the activity totals are overwritten in place each time they change; they are not kept as a history beyond the seven days above.
- Either phone can end the link at any time. The child's phone then stops reporting its status.
- If you never link a phone, no such data is created.
Usage statistics (Firebase Analytics) — optional, on by default
- The App records which screens you open, how far you got through setup, when a block is created and which kind it is, whether the blocking permissions were granted, whether Lockdown was turned on or off, whether a child's phone was linked, and whether a purchase was made.
- Three labels are attached to those statistics so the numbers can be grouped: which audience you chose at setup (yourself, a child's phone, both, or nothing yet), whether this phone manages a child's phone or is unlinked, and which plan you are on. They are never your name, your email address, or anything else that identifies you.
- It never records what you block: no app names, no websites, no keywords, no schedules, no screen-time numbers and no location.
- Google assigns a random app-instance identifier. The advertising identifier and the Android device identifier are switched off in the App, and ad personalisation is switched off.
- A linked child's phone sends no usage statistics at all. Not reduced, none.
- You can turn this off at any time in Profile → Support. Turning it off also asks Google to delete the statistics already collected from this install.
Data sent to Firebase is transmitted over encrypted (HTTPS/TLS) connections. Access is restricted by server-side security rules: a family's devices can be read only by that family's parent account and by the linked phone itself.
Permissions
Sunnah Lock requests the following permissions, each essential to its core functionality:
Used to detect which app is currently in the foreground and to identify specific in-app content (such as YouTube Shorts or Instagram Reels). This is the only method Android provides for an app blocker to function. It is used exclusively for blocking and does not read, collect, store or transmit the content of your screen, your keystrokes, passwords, messages or any other personal information.
Used to retrieve your screen-time statistics from the Android operating system. This data is displayed on the Insights screen so you can review your usage patterns. It is not stored separately or transmitted.
Used to show the block overlay screen when you attempt to open a blocked app or website.
Used to prevent the App from being uninstalled while blocks are active, so that blocking cannot be bypassed by simply removing the App. You can always disable this in Android Settings.
Used to display the list of installed apps so you can choose which ones to block. If you link a child's phone and use the parent controls, the names of the apps installed on that phone are also shared with your account, as described under "Family link" above. Without this permission, the App cannot show you your installed apps.
Used only if you configure a location-based block, a location-scoped usage limit, a prayer-time block or an adhkar reminder. For location-based blocks and usage limits, your coordinates are never stored and never transmitted; the app stores only a daily minutes counter on your device, which contains no coordinates and never leaves your device. For prayer-time blocks and adhkar reminders, the app stores a coarse location (rounded to about 11 km) on your device only, to compute prayer times, sunrise and sunset offline; it is never transmitted. If you do not use location features, this permission is never accessed.
Used for sign-in and the Firebase services described above. Your blocking activity, schedules and screen-time statistics are not transmitted over the network.
Used to restart the blocking service after the device is rebooted, so your blocks remain active.
Used to display the foreground-service notification that keeps the blocking service running, to alert you about usage limits or block events, and — only if you turn them on — to remind you of the morning, evening or bedtime adhkar.
Third-party services
The App uses the following third-party services, all provided by Google:
- Firebase Authentication — account sign-in (email and Google), and the anonymous sign-in used by a linked child's phone.
- Cloud Firestore — stores the family-link data described above, if you link a child's phone.
- Firebase Analytics (Google Analytics for Firebase) — anonymous usage statistics, as described above, unless you turn them off in Profile → Support. A linked child's phone sends none.
- Google Sign-In / Google Play Services — authentication and related services.
- Google Play Billing — if you purchase a paid feature, the transaction is processed by Google Play. The App does not receive or store your payment-card details.
Each is subject to Google's Privacy Policy. Apart from the account, family-link and usage-statistics data described above, the App does not send your usage data, block configurations or other personal information to any server.
Data security
- On-device data is encrypted using EncryptedSharedPreferences (Jetpack Security) and SQLCipher.
- Your PIN is stored only as a one-way SHA-256 hash and cannot be reversed.
- Data sent to Firebase is transmitted over encrypted HTTPS/TLS connections.
Deleting your account and data
You can request deletion of your account and all associated cloud data — your Firebase account record, any family-link device records, and your usage statistics — at any time by emailing us at the address below. We will delete it within 30 days of your request. Turning off "Share Anonymous Usage Statistics" in Profile → Support deletes the usage statistics for that install immediately.
You can remove all on-device data at any time by uninstalling the App (after disabling Device Administrator in Android Settings).
Children's privacy
Sunnah Lock is designed to be set up by an adult — for example, a parent configuring a child's device, or an adult applying strict mode to themselves. Any account is created with the adult's credentials; a linked child's phone signs in anonymously and is never asked for a name, an email address or a password. The App does not knowingly collect personal information from children. A child's blocking configuration, browsing and message content stays on the device; if a parent links the phone to their family, only the device status, app names and usage totals described under "Family link" are stored, under the parent's account.
Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be reflected in the "Last updated" date at the top of this page.
Contact
If you have questions about this policy, or to request deletion of your data, contact us at:
Analytics on sunnahlock.com
This website can use Google Analytics to count visits and see which pages and links bring people here. It only runs if you tap Accept on the cookie banner. If you tap No thanks or ignore the banner, Google Analytics does not load and sets no cookies.
If you accept, Google Analytics records the pages you view, the site that sent you here, your device and browser type, your approximate location such as your country or city, and clicks on links that leave this site, such as the App Store and Google Play buttons. It stores cookies whose names start with _ga so it can tell when you come back.
We have turned off Google signals and advertising features for this website, and we do not connect this data to your Sunnah Lock account. Google explains how it handles the data in its privacy policy.
Changing your choice
Tap Cookie settings at the bottom of any page to change your answer. Choosing No thanks deletes the Google Analytics cookies this site set.