Who is responsible
Shakirr is a personal project operated in the United Kingdom. Muhammad Rehman Qureshi is the controller for the limited personal information described in this policy. You can contact the controller at privacy@shakirr.app.
The product today
Shakirr version 1 does not require an account. The app is local-first and offline-first: its core journaling, 313 blessings across seven categories, 11 gratitude duas, reminders and settings work without a network connection.
Shakirr is a private gratitude aid. It is not an emergency, medical or mental-health service and should not be used as a substitute for qualified support.
What stays locally
Your saved reflections, any unfinished reflection draft, profile and settings are stored in local app or browser storage on the device you use. An unfinished draft is removed after it is successfully saved as a reflection and is not included in exports until it has been saved. Shakirr has no server database containing this journal data and does not send it to us.
Native apps: On iPhone and iPad, Shakirr stores journal data in local app storage configured to be excluded from iOS device backups. On Android, Shakirr disables cloud backup and device-to-device transfer for app data. Shakirr cannot recover native data; export a full local backup before replacing, resetting or uninstalling a device.
Web app and PWA: Journal data is stored in the browser profile you use for app.shakirr.app. Shakirr does not sync it. Browser storage may be copied or removed by your browser, operating-system backup, device-migration or device-management tools under their own settings. Export a full local backup before clearing site data, changing browser profiles or devices, or uninstalling the PWA.
What we collect
The Shakirr journal app does not use in-app analytics or crash-reporting services. The app code does not set advertising cookies, build behavioural profiles or transmit your journal to Shakirr.
The public website uses Vercel Web Analytics to measure anonymous, aggregate visits and page views. It may record the page path, referring website, approximate country, region and city, device type, operating system and browser. Query strings and page fragments are removed from the Shakirr page URL before an event is sent. Referrer information depends on the referring site and browser. The service does not use cookies, advertising identifiers or persistent cross-site identifiers. Website analytics never includes your reflections, drafts, profile or settings. Vercel uses a daily-changing hash to help distinguish visitors and discards that visitor identifier after 24 hours.
The public website also uses Vercel Speed Insights to measure anonymous, aggregate website performance. It may record the page path, Web Vitals and their page-element attribution, network speed, browser, device type, operating system, approximate country, SDK information and the time Vercel receives the measurement. Query strings and page fragments are removed before a measurement is sent. Vercel states that these measurements are not tied to an individual visitor or IP address and cannot be used to reconstruct a browsing session. Speed Insights never includes your reflections, drafts, profile or settings.
The reporting window depends on the Vercel plan. Vercel may retain aggregate measurements longer than the guaranteed reporting window. We do not combine these measurements with journal or support records.
Like almost every website, the infrastructure serving shakirr.app and app.shakirr.app may process ordinary request information such as an IP address, browser type, requested file and timestamp for delivery, reliability and security. Those requests do not include the contents of your reflections.
If you email Shakirr, we receive your email address, message and any information you choose to include. Please do not send private reflection text. We use this information only to answer you, keep support secure and maintain necessary correspondence.
When information can leave your device
Information can leave Shakirr when you choose to export or share it, or use a platform feature that processes what you enter. An exported file is then under your control, including any copy you save to email, messaging, cloud storage or another app.
Shakirr export and backup files are readable and are not encrypted. Store them somewhere you trust, and avoid sharing them with anyone who should not see your journal.
A keyboard, spell-check, browser extension or other operating-system service may process entered text according to its own settings and privacy terms. These services are not controlled by Shakirr.
If you enable and apply reminders, Shakirr gives your chosen times and generic reminder text to the operating system so it can schedule local notifications. Shakirr does not use push notifications, and your profile or reflection text is not included.
Retention, deletion and recovery
Local data remains until you remove it using Shakirr’s data controls, clear the site or app data, or uninstall the app, subject to how your device handles deletion. Because there is no Shakirr cloud copy, we cannot recover a deleted or lost journal. Keep exports somewhere you trust if you need a backup.
The Reset profile & reflections control removes those items only. Sound settings and reminder preferences remain; scheduled native reminders remain until you change or disable the reminder schedule and apply the change.
If you previously enabled biometric unlocking, your device can verify your identity so you can reset the PIN without deleting the journal. Shakirr receives only whether the device verification succeeded, not your fingerprint, face scan or other biometric data.
If biometrics were not enabled or are unavailable, the lock screen can permanently erase the local journal and profile before removing the lock. This destructive recovery cannot be undone, so keep a current backup somewhere you trust.
Ordinary support and privacy correspondence is kept for 12 months after the case is closed, then deleted or reviewed for deletion. It may be retained longer only when reasonably necessary for a live case, security incident, legal obligation or legal claim. Ordinary server-log retention follows the operational and security schedule of the relevant provider.
Security boundaries
We restrict released journal app code from making API, telemetry or data-upload connections. Its service worker only fetches same-origin release files needed for offline use. The public website remains on a separate origin from journal storage and permits only same-origin connections for its Vercel analytics route. No software can protect information from every compromised device, malicious extension, screen capture or person who has unlocked-device access.
You can enable an optional app lock with a four-digit PIN and, on supported native devices, Face ID, Touch ID or supported Android biometrics. The PIN verifier is stored locally, separately from your journal, and the PIN itself is not included in Shakirr backups. Shakirr does not receive or store your fingerprint, face scan or other biometric data; your operating system performs biometric verification. App lock reduces casual access but does not encrypt exported files or protect a compromised device.
Purpose and lawful basis
We rely on legitimate interests where limited information is necessary to deliver, secure and support the website and apps, prevent abuse, respond to support requests, understand aggregate website use and performance, and maintain reliable services. These uses are limited to what people would reasonably expect and do not include journal content.
We may also retain information where necessary to comply with a legal obligation or establish, exercise or defend legal claims. We do not use support or request data for advertising.
Service providers and international transfers
Vercel hosts the website and processes the limited technical, aggregate Web Analytics and Speed Insights performance information described above on our behalf. Email and app-store providers may process limited technical or correspondence information on our behalf or under their own terms. Service providers may process limited information outside the UK. Where our use of a provider creates a restricted transfer under UK law, we will rely on an applicable adequacy regulation or put an approved safeguard in place.
Email privacy@shakirr.app to request information about the applicable transfer safeguards and how to obtain a copy.
Apple and Google process app-store activity, downloads and platform diagnostics under their own privacy notices. Shakirr does not receive your journal from them.
Future cloud features
If Shakirr later introduces accounts, optional cloud sync, in-app analytics or crash reporting, we will explain the change before it applies, update this policy and request any consent required by law. Existing local reflections will not be silently uploaded merely because a future version adds an account option.
Questions, requests and complaints
Email privacy@shakirr.app if you have a question about information handled through the website or a support message. Please do not include private reflection text. We will explain what information we can access and the choices available to you.
Depending on the circumstances, you may ask us to access, correct, erase or restrict our use of personal information, or ask for a portable copy. These rights are not absolute. Because Shakirr cannot access your local journal, you control that data directly through the app and your device.
In the UK, you can also ask the Information Commissioner’s Office for guidance or make a complaint through ico.org.uk.
Your right to object
You may object to processing based on legitimate interests by emailing privacy@shakirr.app. We will consider your circumstances and stop that processing unless applicable law permits us to continue, including where compelling legitimate grounds or legal claims apply.
Children
Shakirr is a general-audience journal for people able to read and write; it is not designed specifically for children. If you are under 18, the same privacy protections apply: your core journal stays on your device, and Shakirr does not ask for an account, age or contact details. Ask a parent or guardian before emailing support, because an email gives us your address and message, and before using the service where local law requires their permission.
Contact
For privacy questions, email privacy@shakirr.app. For help using Shakirr, email support@shakirr.app.