Sunnah Lock is made by Abdelazziz Fezani ("we", "us"). Questions, requests, or complaints: admin@sunnahlock.com
Sunnah Lock is available on iOS and Android. They're built differently under the hood, so what each one collects is genuinely different — most notably, the iOS app has no analytics of any kind, while the Android app uses Firebase Analytics. Jump to your platform below, or read both.
This page also covers this website.
The short version
Sunnah Lock for iOS helps you block apps and websites for yourself. Most of what makes that work never leaves your phone.
We never learn which apps you block. Apple's Screen Time system does not tell us. It is not that we choose not to look — the information is not available to us. See "Screen Time" below, because this is the part most people want to understand.
We never receive your location. Not the places you set for location blocks, not the coordinates used for prayer times.
We have no analytics, no ad SDK, no tracking of any kind. There is no Google Analytics, no Firebase Analytics, no Crashlytics, no Mixpanel, no advertising identifier, no third-party tracker in this app.
We do not sell your data, and we never will. There is no advertising business here to sell it to.
What we do hold: your account (email, name, a user ID) and your synced dhikr counts.
What stays on your phone
Almost everything Sunnah Lock does happens in a private storage area on your device that only Sunnah Lock and its own extensions can read. It is never uploaded.
That includes:
- Your blocks — their names, schedules, daily limits, and which apps or categories they cover.
- Your Screen Time selections — see the next section.
- Your location settings for location-based blocks — the coordinates and radius of each place.
- Your prayer-time settings — including the coordinates used to calculate prayer times, your calculation method, and your madhab.
- Your own website list for the Block Haram Content feature.
- Your dhikr counts for the day.
- Sunnah Lock's own statistics — how often a shield stopped you, and the history of your lock sessions. These are our own numbers, not Apple's usage figures. They are automatically deleted after 90 days.
- Your theme, haptics setting, notification preferences, and insight goal.
Deleting the app deletes all of it. iOS removes the container with the app.
There is one thing here that syncs: your dhikr counts (see "Account data"). Nothing else in this list ever goes anywhere.
Screen Time data — the part worth reading
Sunnah Lock blocks apps using Apple's Screen Time (Family Controls) framework. It is worth explaining how that works, because it is unusually private and the reason is not obvious.
When you pick apps to block, iOS shows you Apple's own app picker. Sunnah Lock does not draw that screen and cannot read it. What iOS hands back is not a list of app names or bundle IDs — it is a set of opaque tokens. A token is a meaningless identifier that only iOS can resolve. We store the tokens, hand them back to iOS to apply a shield, and that is the whole transaction.
The practical result: Sunnah Lock genuinely does not know which apps you blocked. Not on your phone, and not on our servers. If you blocked something you would rather nobody knew about, nobody does — including us.
The same applies to your usage figures. The weekly and daily usage charts you see in Insights are drawn by Apple inside a sealed view that we are not allowed to read the contents of. We can render the chart; we cannot see the numbers in it. Those numbers never reach our code and never reach our servers.
Sunnah Lock asks for Screen Time permission for the person using the device — you are locking your own phone, by your own choice. It is not a parental monitoring tool and it is not set up to let one person supervise another's device.
Turning Screen Time permission off removes our ability to block anything.
Location
Sunnah Lock asks for location for two features. Both are optional, and neither sends your location to us.
Location-based blocks
You drop a pin on a place — campus, work, the masjid — and your blocks switch on when you are there. Your phone watches for that boundary itself, using iOS geofencing. The coordinates stay on your device. When you cross a boundary, the only thing recorded is an internal ID meaning "you are inside region X" — never a coordinate, never a place name, never a history of where you have been. There is no location log.
Background monitoring needs "Always" permission. Without it the block still saves; it just will not switch on while the app is closed.
Prayer times
Sunnah Lock takes a single, low-accuracy (city-level) fix to calculate prayer times for your area. That coordinate is stored on your device and reused; it is not tracked continuously.
What goes to Apple
To be exact rather than reassuring: two things do leave your device, and they go to Apple, not to us.
- When you drop a pin or set your prayer-time location, we ask Apple's geocoder to turn that coordinate into a city or place name so the app can show you something readable. That request contains the coordinate.
- When you type into the place search box, what you type is sent to Apple Maps to return search results.
This is the standard iOS way to show a map and a place name, and it is Apple handling it under Apple's own privacy policy. We receive nothing from it. No coordinate you enter ever reaches a Sunnah Lock server, and coordinates are structurally excluded from the data export — the export format has no field that can hold one.
You can use Sunnah Lock without granting location at all. You lose location-based blocks and automatic prayer times; everything else works.
Account data — what is on our servers
Sunnah Lock uses Google Firebase for accounts and sync. Here is everything stored there.
Your account. When you sign up with an email address, Google, or Sign in with Apple, Firebase Authentication stores your email address, your display name if the provider supplied one, and a user ID. If you use Sign in with Apple and choose to hide your email, we only ever see Apple's private relay address — we never learn your real one.
We also record which version of the app you are running, so we can make sense of a bug report.
Your dhikr counts. If you use the dhikr counter while signed in, the day's counts and total sync to your account so they survive a reinstall. Nothing else from your on-device data syncs.
A notification token. So we can send you a push notification (for example, the nudge back into the app after you tap through a shield). It identifies your device installation, not you personally.
What is never on our servers: which apps or websites you blocked, the names you gave your blocks, your Screen Time usage figures, your location, your block schedules and limits, your own added website list, your Sunnah Lock statistics, or your prayer settings.
Age and children
Sunnah Lock is a self-control tool for adults and older teenagers. It is not designed for young children, it is not offered in the App Store's Kids Category, and it does not knowingly collect information from children under 13 (or under 16 where local law sets that age).
Sunnah Lock does not ask your age. Signing in requires an email address or an Apple or Google account, which those providers already gate by age.
If you believe a child has created an account, contact us at the address above and we will delete it.
How long we keep things
- On-device statistics — 90 days, then deleted automatically.
- Your account and dhikr counts — until you delete your account.
- On-device data generally — until you delete the app or the block.
Deleting your account
You can delete your account from inside the app: Settings → Account → Delete Account. It asks you to confirm, and then it genuinely deletes. There is no "contact support to delete" step and no soft-delete.
If it has been a while since you signed in, iOS may ask you to sign in again first — that is a security requirement, not a stall.
What deletion removes:
- Your notification token.
- All of your synced dhikr counts.
- Your entire user record on our servers, deleted server-side so that nothing hidden in it survives.
- Your sign-in account itself, so the identity is gone and not just the data.
Deleting your account does not delete data held on your phone. Delete the app for that.
Third parties
We use as few as we can. There are two.
Google (Firebase). Provides sign-in, the database holding your account data, our server functions, and push notification delivery. Google processes this data on our instructions. We use only Firebase Authentication, Firestore, Cloud Functions, and Cloud Messaging — we do not use Firebase Analytics, Google Analytics, Crashlytics, Performance Monitoring, or any advertising product.
Apple. Provides Screen Time, Sign in with Apple, push delivery, maps and place search, and the App Store. Handled under Apple's privacy policy. Apple never tells us which apps you blocked, and we never send Apple anything about you beyond the map and geocoding requests described earlier.
That is the complete list. No analytics provider, no advertising network, no data broker, no attribution SDK, no crash reporter.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Email us and we will act on it, normally within 30 days.
If you are in the EU, UK, or EEA (GDPR). You have the right to access, correct, delete, restrict, and object to our processing of your data, and the right to receive it in a portable form. Our legal basis is: performance of the contract (running your account and syncing your dhikr counts), your consent (location and notifications — each of which you can withdraw at any time in iOS Settings or in the app), and our legitimate interest in keeping the service working and secure. You can complain to your national data protection authority.
If you are in California (CCPA/CPRA). You have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information, and we never have. We will not discriminate against you for exercising any of these rights.
Everyone. In-app export (Settings → Data) gives you a machine-readable copy of your Sunnah Lock records — your blocks, dhikr days, statistics, prayer settings, and theme. It deliberately excludes your Screen Time selections and your coordinates, because those are not ours to hand out and are not in a form we could hand out.
Security
Everything in transit uses HTTPS. Your account data on our servers is protected by rules that let you read and write only your own records. Nobody else can reach your data. No system is perfect, but there is genuinely very little here to steal.
Governing law
This policy is governed by the laws of the State of New Jersey, United States.
Changes to this policy
If we change what we collect, we will update this page and the "Last updated" date, and — for anything material — tell you in the app before it takes effect.
Contact
Sunnah Lock for Android is an Android application that helps you manage your screen time and block distracting or harmful apps, websites and content on your own device, or on a child's device you manage. This policy explains what data the App handles, what stays on your device, what is sent to the cloud, and why.
What you block, your schedules, your screen-time statistics and your PIN never leave your device — unless the phone is a linked child's phone, in which case the totals listed below are shared with the parent. We do not upload, track or sell your activity.
To sign in, the App creates an account using Firebase (a Google service). Your email address — and, if you use Google Sign-In, your name and profile photo — are stored on Google's servers so you can log in.
We collect anonymous usage statistics through Firebase Analytics so we can improve the App: which screens are opened, whether setup was finished, when a block is created, and whether a purchase was made. Never what you block, never your screen time, never anything about a linked child's phone. You can turn this off in Profile → Support.
We never sell your data, and we never share it with advertisers or other third parties.
Data stored locally on your device
The following is stored only on your device (encrypted) and is never transmitted to us or anyone else:
- Block configurations — the apps, websites, keywords and schedules you set up for blocking.
- Block event logs — a record of when a blocked app or website was intercepted, used to display your statistics on the Insights screen.
- Screen-time data — read from Android's Usage Stats API to display your usage patterns. It is shown to you only and is not copied off the device.
- PIN — if you set a PIN, only a one-way cryptographic hash (SHA-256) is stored. Your actual PIN is never saved in readable form.
On-device data is encrypted using Android's Jetpack Security library (EncryptedSharedPreferences) and SQLCipher for the local database.
Data stored in the cloud
To provide sign-in and optional features, the App uses Google's Firebase platform. The following data is sent to and stored on Google's servers.
Account information (Firebase Authentication)
- If you register with email, your email address and password are used to create your account. Passwords are handled and stored by Firebase Authentication; we never see or store your raw password.
- If you sign in with Google, your email address, display name and profile photo URL are received through Google Sign-In.
- Each account has a unique user ID and sign-in timestamps.
This information is used solely to let you sign in and stay signed in. It is not used for advertising, and it is not sold or shared.
Family link (Cloud Firestore) — optional
- The family link is set up with a 6-digit pairing code: your phone shows the code, and the child's phone types it in. A code expires after ten minutes and works only once. Your phone deletes it as soon as the child's phone links or as soon as you request a new one, and an automatic cleanup removes any code that nobody used. There is no shared login — you never give the child's phone your password.
- The child's phone signs in with an anonymous account — no email, no name, no password. Firebase gives it a random account ID, and that ID is what identifies the phone to your family.
- Once linked, the child's phone stores under your family: the name you gave the phone, the age band you chose, the phone's model and app version, when it last checked in, and whether its protections are switched on (Accessibility Service, display over other apps, Device Administrator, Lockdown, and whether a parent PIN has been set).
- If you use the parent controls, it also stores: the names of the apps installed on it; its screen time today and the five apps it spent the most time in, as totals only; how many times a block stepped in; the same two totals for each of the last seven days; a record of when the Accessibility Service was turned off, when Device Administrator was removed, when the phone started in safe mode, when Lockdown was turned off, when an emergency unlock was used, and when an app was installed or removed; and any request the child sends you to open or unblock an app.
- Websites, searches, messages, photos, location, anything typed and anything shown on the screen are never collected. The link carries device status, app names and totals only — never what was viewed, opened or typed, and never where the phone is.
- The child can see this exact list on their own phone, under "What your parent can see" in their profile.
- Retention: records of what happened are deleted thirty days after they happened, and requests are deleted thirty days after the child sent them, whether or not you answered. The app list and the activity totals are overwritten in place each time they change; they are not kept as a history beyond the seven days above.
- Either phone can end the link at any time. The child's phone then stops reporting its status.
- If you never link a phone, no such data is created.
Usage statistics (Firebase Analytics) — optional, on by default
- The App records which screens you open, how far you got through setup, when a block is created and which kind it is, whether the blocking permissions were granted, whether Lockdown was turned on or off, whether a child's phone was linked, and whether a purchase was made.
- Three labels are attached to those statistics so the numbers can be grouped: which audience you chose at setup (yourself, a child's phone, both, or nothing yet), whether this phone manages a child's phone or is unlinked, and which plan you are on. They are never your name, your email address, or anything else that identifies you.
- It never records what you block: no app names, no websites, no keywords, no schedules, no screen-time numbers and no location.
- Google assigns a random app-instance identifier. The advertising identifier and the Android device identifier are switched off in the App, and ad personalisation is switched off.
- A linked child's phone sends no usage statistics at all. Not reduced, none.
- You can turn this off at any time in Profile → Support. Turning it off also asks Google to delete the statistics already collected from this install.
Data sent to Firebase is transmitted over encrypted (HTTPS/TLS) connections. Access is restricted by server-side security rules: a family's devices can be read only by that family's parent account and by the linked phone itself.
Permissions
Sunnah Lock requests the following permissions, each essential to its core functionality:
Used to detect which app is currently in the foreground and to identify specific in-app content (such as YouTube Shorts or Instagram Reels). This is the only method Android provides for an app blocker to function. It is used exclusively for blocking and does not read, collect, store or transmit the content of your screen, your keystrokes, passwords, messages or any other personal information.
Used to retrieve your screen-time statistics from the Android operating system. This data is displayed on the Insights screen so you can review your usage patterns. It is not stored separately or transmitted.
Used to show the block overlay screen when you attempt to open a blocked app or website.
Used to prevent the App from being uninstalled while blocks are active, so that blocking cannot be bypassed by simply removing the App. You can always disable this in Android Settings.
Used to display the list of installed apps so you can choose which ones to block. If you link a child's phone and use the parent controls, the names of the apps installed on that phone are also shared with your account, as described under "Family link" above. Without this permission, the App cannot show you your installed apps.
Used only if you configure a location-based block, a location-scoped usage limit, a prayer-time block or an adhkar reminder. For location-based blocks and usage limits, your coordinates are never stored and never transmitted; the app stores only a daily minutes counter on your device, which contains no coordinates and never leaves your device. For prayer-time blocks and adhkar reminders, the app stores a coarse location (rounded to about 11 km) on your device only, to compute prayer times, sunrise and sunset offline; it is never transmitted. If you do not use location features, this permission is never accessed.
Used for sign-in and the Firebase services described above. Your blocking activity, schedules and screen-time statistics are not transmitted over the network.
Used to restart the blocking service after the device is rebooted, so your blocks remain active.
Used to display the foreground-service notification that keeps the blocking service running, to alert you about usage limits or block events, and — only if you turn them on — to remind you of the morning, evening or bedtime adhkar.
Third-party services
The App uses the following third-party services, all provided by Google:
- Firebase Authentication — account sign-in (email and Google), and the anonymous sign-in used by a linked child's phone.
- Cloud Firestore — stores the family-link data described above, if you link a child's phone.
- Firebase Analytics (Google Analytics for Firebase) — anonymous usage statistics, as described above, unless you turn them off in Profile → Support. A linked child's phone sends none.
- Google Sign-In / Google Play Services — authentication and related services.
- Google Play Billing — if you purchase a paid feature, the transaction is processed by Google Play. The App does not receive or store your payment-card details.
Each is subject to Google's Privacy Policy. Apart from the account, family-link and usage-statistics data described above, the App does not send your usage data, block configurations or other personal information to any server.
Data security
- On-device data is encrypted using EncryptedSharedPreferences (Jetpack Security) and SQLCipher.
- Your PIN is stored only as a one-way SHA-256 hash and cannot be reversed.
- Data sent to Firebase is transmitted over encrypted HTTPS/TLS connections.
Deleting your account and data
You can request deletion of your account and all associated cloud data — your Firebase account record, any family-link device records, and your usage statistics — at any time by emailing us at the address below. We will delete it within 30 days of your request. Turning off "Share Anonymous Usage Statistics" in Profile → Support deletes the usage statistics for that install immediately.
You can remove all on-device data at any time by uninstalling the App (after disabling Device Administrator in Android Settings).
Children's privacy
Sunnah Lock is designed to be set up by an adult — for example, a parent configuring a child's device, or an adult applying strict mode to themselves. Any account is created with the adult's credentials; a linked child's phone signs in anonymously and is never asked for a name, an email address or a password. The App does not knowingly collect personal information from children. A child's blocking configuration, browsing and message content stays on the device; if a parent links the phone to their family, only the device status, app names and usage totals described under "Family link" are stored, under the parent's account.
Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be reflected in the "Last updated" date at the top of this page.
Contact
If you have questions about this policy, or to request deletion of your data, contact us at:
Analytics on sunnahlock.com
This website can use Google Analytics to count visits and see which pages and links bring people here. It only runs if you tap Accept on the cookie banner. If you tap No thanks or ignore the banner, Google Analytics does not load and sets no cookies.
If you accept, Google Analytics records the pages you view, the site that sent you here, your device and browser type, your approximate location such as your country or city, and clicks on links that leave this site, such as the App Store and Google Play buttons. It stores cookies whose names start with _ga so it can tell when you come back.
We have turned off Google signals and advertising features for this website, and we do not connect this data to your Sunnah Lock account. Google explains how it handles the data in its privacy policy.
Changing your choice
Tap Cookie settings at the bottom of any page to change your answer. Choosing No thanks deletes the Google Analytics cookies this site set.