Privacy Policy — Irada
Last updated: 22 September 2026
Irada helps you restrict your own device: you choose what to block, and it blocks it. This page states exactly what is collected, why, and what never leaves your phone.
1) What never leaves your device
- What appears on your screen. The accessibility service reads on-screen text only to compare it against your own blocklist. The comparison happens on the device; no text, screenshot, or page address is ever sent anywhere.
- Your setbacks log and everything you write in it.
- Your letter to your future self.
- Your tasks and habits, and the custom dopamine wheel you write yourself.
The trade-off is explicit: lose the device and this data is gone — we hold no copy to restore it from.
1b) What is kept in your account so you can get it back — journal and goals
Your journal entries and goals are stored on your device first. Every read and every search happens on the device, with no internet needed. A copy is also kept in your account so it comes back to you if you change or lose your phone.
This means, plainly: the text of your journal exists on our servers (Firebase). Access rules restrict reading and writing it to your account alone, and our support console does not read this path. But it is not encrypted with a key we do not hold — because such a key would have to live somewhere. On your device, it would be lost with the device, defeating the whole point. As a password you remember, forgetting it would erase your journal with no way back. We chose recoverability, and we are telling you so.
You can turn this backup off and delete what was uploaded, from the app settings.
2) What we collect, and why
| Data | Why |
|---|---|
| Your email and name | To create your account, sign you in, and contact you when needed. |
| The list of what you chose to block (apps, sites, keywords) | So it works across your devices and survives a reinstall. |
| Your settings: commitment period and its length, and which features are on | The core of the product: a restriction that the device alone can lift is not a restriction. |
| Your accountability partner’s email and the partnership status | To send them approval requests. You add them by choice, and it is deleted when you disconnect them. |
| Your notification token and app language | To send important notices (an outage, a required update) in your language. |
| Your subscription status | To unlock paid features. Payment is handled by Google Play; we never see your card details. |
| When protection started and stopped, and your device model | To warn you if protection stopped without you meaning it to. The device model matters because every manufacturer kills background services in its own way, so it tells us what your particular device needs. |
| What you write in a support request | To handle your request. You write it by choice. |
| Two random identifiers: one for the app instance, one for the installation | Created automatically by Firebase so crash reports and usage counts can be tied to a single device. They are not your device serial and not your name, they do not follow you outside Irada, and they disappear when you uninstall. |
3) Who can access your data
- Google Firebase — hosts accounts, the database and notifications.
- Firebase Crashlytics — receives a crash report when the app crashes: where in the code it failed, the device model, and the OS version. It is how we fix what we cannot reproduce on our own devices.
- Firebase Analytics — counts general usage: how often the app is opened, which screens are visited, and roughly which country (inferred from the IP address, not from your location). We send it three events of our own and no more — protection set up, subscription sheet opened, purchase completed. The last carries the product ID alone (such as
premium_subscription) — no name, no email, no amount. Their purpose is measuring whether our ads work, not tracking you. Alongside them goes your device’s advertising ID (a number Android gives to apps; it carries neither your name nor your email) — it reaches Google Ads so we can tell which ad brought someone to the app. You can reset or switch it off whenever you like in Android Settings → Privacy → Ads. Nothing about what you block, and nothing about what is on your screen, ever reaches it. - Google Play — processes payment and subscriptions.
- An email service (Resend) — delivers approval requests and protection alerts to your partner (see 3b). It receives your partner’s address, your name and email, and the event type and time.
We do not sell your data, and we do not use it to target you with ads or to track you across other apps; what reaches Google Ads is limited to measuring our own ads, as described above.
Everything that travels between your device and our servers is encrypted in transit (TLS). Nothing is sent any other way.
3b) What your accountability partner receives — and when
If you choose an accountability partner, Irada emails them in two cases: your approval requests (turning a feature off, ending the partnership), and alerts when something affects your protection:
- The protection service being turned off.
- A factory-reset attempt.
- Device admin being disabled.
- Protection going silent for a while.
- Signing out of the account (blocking stops with it).
- The device date being changed by hand.
They receive the event, its time, and your name and email — never your browsing, your blocklist, or anything you write in your journal or log.
⚠️ And nothing about you reaches them until they accept. Only the invitation is sent first; if they never accept, no alert, no approval request, and no news of anything you did. The one further message they may receive is a notice that the invitation ended, if you cancel it. They can also withdraw at any time from the link at the foot of every message they receive — without your permission and with no waiting period.
4) The accessibility service
Irada requests this permission for one purpose: to see what is displayed on screen and compare it against the blocklist you wrote. On a match, the content is closed and a notice is shown.
What is read is neither stored nor transmitted. We do not collect your browsing, your passwords, or your messages. The comparison happens in memory on your device and ends immediately.
5) Deleting your account and data
In the app: Settings → Account → “Delete account”. Deletion is immediate and needs no approval from us, and it erases what is on the device at the same moment — except during a commitment period, an active partnership, or an emergency lock. The app won’t delete then, and you can ask support to delete it; we do so within 30 days. Details are on the account deletion page.
What remains after deletion: nothing, except support requests about payments and subscriptions — kept for 90 days from the day of deletion, then deleted, so we can answer any dispute about a payment.
If you lost your device: email us at support@iradaapp.com from the address registered on your account and we delete it within 30 days.
Uninstalling the app clears what is on the device but does not delete the account.
6) Children
Irada is made for adults and is rated 18+ on Google Play. It is not directed to children, and we do not knowingly collect their data.
7) This website (iradaapp.com): cookies and measurement
Everything above is about the app. For the website you are reading now:
- Hosting — Vercel. Like any web server, it receives your IP address, browser type and the time of the request in order to serve the page and protect it from abuse, and these may stay in its technical logs for a limited time. We don’t add any Vercel analytics tool.
- Nothing is requested from a third party before you agree: fonts and images are served by the site itself, Google Tag Manager is not loaded, and we set no cookies.
- Google Tag Manager — only with your consent. On your first visit a bar asks you to choose “Accept” or “Decline”. If you accept, the Google Tag Manager container loads from Google, and we use it to measure visits to the site and how our Google Ads perform. Google then receives what any service a page loads from receives: your IP address, your browser type, and the page you are on and the one you came from — plus one event we write ourselves when you tap the download button: where the button was, the page language, and whether the app is published yet. Google may store cookies in your browser for this measurement.
- Your choice is stored in your browser (local storage), not with us, so we don’t ask on every visit. None of this is linked to your account in the app.
You can change your choice at any time here: — or from the footer of the home page. If you withdraw consent, we clear the cookies Google’s tags set on our domain and reload the page without Tag Manager.
8) Who holds your data
The controller of the data described above is:
- Ittihad alAidi Establishment For Trading
- Commercial Registration: 1011152031
- Unified National Number: 7032748779
- Riyadh, Kingdom of Saudi Arabia
9) Changes and contact
Any material change to this policy is announced inside the app. Questions: support@iradaapp.com