Privacy Policy

The app “Raff” («رفّ») for iPhone and iPad, and this website
Effective date: 31 October 2026

This is a translation. If it differs from the Arabic text above, the Arabic text prevails.

1. Who we are

The app, this website and the app’s server are run by the developer Asim Ali (“we”). For any privacy matter, write to asimapps.dev@gmail.com.

2. What the app saves on your device

• Your shelves: what you added to each shelf and its status (such as have, played, watched, watching, want to read), your rating and short review, what you liked (“Liked”), the details you enter (such as a perfume’s bottle size and where you bought it, a game’s platform and hours, a series’ season and episode, or the page you are on in a book), the items you added yourself, and the buy or watch links you put on items.
• Your diary and lists: what you wore, watched or read and on which day, with your notes, your lists, your perfume layering combos, and your top four on each shelf.
• Your profile: the name, bio, symbol and colour if you add them, and the shelves you chose and their order.
• Your photos: the photos you add to your items yourself (section 5).
• Friends: the profiles you opened from links and saved, which ones you hid or blocked, and which of your items you posted to Friends.
• The restore code and the Friends key: kept in the iOS Keychain on your device, encrypted, readable only by this app, and never put in iCloud Keychain. The Friends key is made only if you join Friends.
• Settings: such as the language, haptics, “Real covers” and the covers you hid, your Friends sharing choices and your agreement to the rules, and when to remind you to save a copy.

This data stays in the app’s own storage on your device. Your device backup (such as iCloud or a computer) includes it, and it moves to a new iPhone with Quick Start, depending on your settings and under Apple’s policy. None of it reaches us except what sections 6 and 7 describe: the encrypted backup, and what you post yourself in Friends. The catalogs of perfumes, games, movies and the rest are inside the app, and searching them happens on your device. Your profile is deleted from the device when you delete the app; iOS may keep Keychain items after the app is deleted, so if you install it again your profile and Friends come back by themselves.

3. What you share

None of the following happens unless you tap it yourself.

Your profile link and QR code: “Share your profile” gives you a link of the form https://le3batna.github.io/raff/p/#…, and a QR code with the same link. The link carries what your profile shows to others, such as:

• the name, bio, symbol and colour if you added them, and the date you shared it;
• a random profile identifier made on your device, which does not identify you, so that a friend’s app can update its saved copy of your profile when you send a newer link;
• your top four on each shelf, your latest additions and entries with their rating, status and day, what you liked, a few counts per shelf, and your lists and combos;
• short titles of the items (including the ones you added yourself), and the buy or watch links you put on items.

The link carries no photos and never the restore code. All of this sits in the part after the #, which browsers never send to any server, not even this website’s. The profile page on this website decodes the link inside the browser of whoever opens it, draws the covers itself, and asks no other site for images.

Anyone who gets the link can see what is in it, so send it only to people you choose. The link is a snapshot of your profile when you shared it, and it does not update by itself. Because we do not store it, we cannot delete or disable it; if you want a friend to see your latest profile, send a new link.

Your Friends invite link: a link of the form https://le3batna.github.io/raff/c/#…, with a QR code and an eight-character code. It carries only the invite code; section 7 explains it.

Cards and images: images of your profile and shelves (story or square) and your taste and review cards are drawn on your device, then your device’s share sheet opens, and you choose the app and the person. The images never pass through us. If you added your own photo to an item, it shows on that item’s cards you share (section 5). If you choose “Save Image”, iOS asks your permission to add it to Photos.

The “Move to another phone” file: from Settings, the app saves your whole profile as one file through the share sheet, and you choose where it goes (Files, AirDrop, or a message to yourself). The file also carries your photos while they fit (newest first, up to about 5 MB); the rest stay on your phone. Treat it as a private file: whoever has it can read what is in it and see its photos. The file never holds the restore code or the Friends key. “Restore from a file” reads only the file you pick. Once a month the app reminds you to save a copy; the reminder only shows inside the app.

Shop links: the shop search buttons (such as Amazon.sa and noon) open a search page in your browser with the item’s name, so the shop receives that search, and the shop’s own policy applies there. These links carry no referral or tracking code from us at the moment; if that changes, we will update this page first. Buy and watch links on your friends’ profiles were added by their owners: the app checks their form (full https links only, no URL shorteners that hide the destination) and asks you before opening one.

Reports by email: “Report content” on a friend’s profile opens your mail app with a draft that contains that profile’s content and link. “Report this image” opens a draft naming the item and the image shown for it. Nothing is sent automatically: you decide whether to edit, send or discard it. A report inside Friends goes straight to our server (section 7).

Other links: the privacy policy link and the links in Settings → Sources open their pages in your browser, outside the app, where that site’s policy applies. “Rate the app” opens the app’s page on the App Store.

4. Cover images

Raff shows real covers for some series, books, games, movies and comics, which your phone loads straight from their sites: TVmaze, Open Library, IGDB and Wikimedia Commons. When an image shows, your phone asks that site for it, so the site sees your phone’s IP address and which image was asked for, like any web page. We send them nothing else: no name, no shelves, no identifier, no cookies and no referrer; the request names only the app and our email address, as Wikimedia asks. Each of those sites has its own privacy policy.

Images are only cached on your phone, in a cache that is not backed up and that iOS may clear. Covers of items in Friends load the same way; the cards you share use drawn covers. You can turn real covers off in Settings → “Real covers”: the app then shows its drawn covers and asks for no image. On any item you can also “Hide this image” or “Report this image” (section 3).

5. Your photos

You can add your own photo to any item on your shelf (“Add your photo”), from the camera or from your photos. iOS asks your permission before the app uses the camera or the photo library, and the app takes only the photo you shoot or pick, and makes it smaller on your phone.

The photos you add stay on your phone, in the app’s own storage (your device backup includes them, depending on your settings), and we never receive them: they are never uploaded to our server, they are not in the restore-code copy or in Friends, and profile links carry no photos. They show on the cards you share yourself, and anyone who sees a card sees the photo, so the app tells you this before your first photo and asks you to confirm. They travel in your “Move to another phone” file while they fit (section 3). Delete an item’s photo at any time with “Remove your photo”.

6. The restore code (no account)

So you can bring your profile back on a new phone without signing in, Raff gives you a restore code. Whenever your profile changes, the app uploads a copy by itself, but before anything is uploaded, the copy is encrypted on your phone with a key made from that code (end-to-end encryption, AES-256). If you joined Friends, the encrypted copy also holds your Friends identity key, so your friends come back with you on the new phone. Your photos are not in this copy.

Our server, which runs on Cloudflare, stores only the encrypted copy, its size, the time of the last backup, its version number, the app’s name and a one-way fingerprint of an ID derived from your code. We cannot read your profile and we do not know who you are: the copy is not linked to your name, e-mail, phone number, advertising ID, or your Friends profile on our server. Cloudflare processes your IP address to deliver each request; we do not store it.

The restore code stays on your phone (in the iOS Keychain) and with you. The app shows it once, at the first backup, for you to keep (“Copy code” or “Save as image”), and you find it in Settings afterwards. We never receive it, so we cannot recover a lost code, and anyone who has it can open and change your copy. Keep it to yourself; we will never ask you for it. On the new phone, choose “Have a code? Restore my profile” and type the code.

Deleting your cloud copy: in Settings › Delete my cloud copy, the encrypted copy is erased from our database at once and backups stop; only a marker that the code was retired remains (the fingerprint, the app’s name and the time), so the copy cannot come back from another device. Your profile stays on your phone. Deleting the app does not delete the cloud copy, so delete the copy first if you want it gone. You can then back up again with a new code.

7. Friends: your reviews, for your friends only

Friends («أصحابي») is an optional feature where you post your reviews and activity to the friends who follow you, and follow theirs. None of the following happens unless you join it yourself.

Your Friends identity: when you join, your phone makes a key pair (Ed25519). The public key is a random number that serves as your identifier; the private key never leaves your phone except inside the encrypted backup (section 6). The app signs every request with your private key, so nobody can post as you, and our server holds no secret about you.

What gets posted: nothing from your shelves is posted by itself. A review is posted when you choose “Share with my friends”, and an activity (a short line, such as an item you want, started or finished) is posted only if you turn on “Share my activity automatically” in Settings. “Share my reviews with Friends” makes the share switch start on. Both settings are off until you turn them on. A posted review follows its stars, words and status when you edit them, and when you delete the item the app asks about its post. Hadith, tafsir and supplication books are never posted with stars or words.

What our server keeps (on Cloudflare):

• your display name, emoji and colour, your identifier (the public key), and when you joined;
• the reviews and activities you post: the item (its number in the app’s catalogs, or its name and creator if you added it yourself), its shelf, status and stars, your words, and when you posted and edited them;
• your comments and replies, and when you wrote them;
• your likes (which reviews, comments and profiles you liked), and the number of likes on each;
• your in-app notifications: who followed you, who liked what you posted or your profile, who commented on your review or replied to your comment, and when you read them;
• who you follow and who follows you, and who you blocked;
• your current invite code and when it expires (30 days, or until you replace it);
• reports: who reported (their identifier), which review, comment or person, the reason and an optional note.

What we do not keep: no phone number, email or real name (unless you write one in your display name or your words), no photos, no IP address, and no device or advertising identifier. Cloudflare processes the IP address to deliver each request; our server holds it in memory for at most a minute to limit abuse and never writes it anywhere. Workers Logs are off, and the server does not log what requests contain.

Who sees what: your reviews, activity, name and emoji are seen only by the people who follow you, and they see your Friends profile built from what you posted. Nobody can follow you without your own invite code or link. There is no public page and no people search, and nothing from Friends appears on this website. A comment on a review is seen by whoever sees the review (its author and their followers), except people with a block between them. People see how many likes reviews, comments and profiles have; who liked what you posted is shown to you alone, in your notifications. Anyone who has your code can follow you while the code is valid, so send it only to people you choose, and replace it at any time (“New code”): the old code stops working. You can remove any follower, or block them.

Notifications: inside the app only; we send no push notifications. “Activity” refreshes when you open Friends (if it is more than two minutes old); the app never checks for notifications in the background.

Blocking: when you block someone, the follows between you end both ways and the notifications between you are deleted; afterwards neither of you can follow the other, see the other’s reviews, comments or profile, or comment on or like what the other posts. We do not tell them you blocked them.

Reports and moderation: you can report a review, a comment or a person. We review reports ourselves within 24 hours. When three different people report a review or a comment, it is hidden automatically until we review it. The reported person is not told who reported them. The Friends rules appear before your first post or comment, and we may remove content that breaks them or stop an identifier from using Friends.

The filter: display names, reviews and comments pass through a filter for inappropriate words, on your phone and again on the server, before they are published.

Retention and deletion:

• Your Friends profile, reviews, comments, likes and follows: until you delete them.
• Deleting a review or a comment: its text is erased at once, and what remains of its record (the identifier and times) is deleted within 30 days, unless a report on it is still waiting for review. A comment can be deleted by whoever wrote it, or by the review’s author from their own review.
• Notifications: deleted after 90 days, and only the latest 500 are kept. Notifications from a blocked or deleted person, or about deleted or hidden content, are not shown.
• “Delete my Friends profile”: deletes at once your profile, everything you posted, your comments, likes, follows both ways, invite code, your notifications and the ones you caused for others, and the blocks you made. Blocks other people made against your identifier stay, so whoever blocked you stays protected if you come back with the same identifier.
• Content we remove for breaking the rules: its text is kept for up to 90 days for review, then erased. A stopped identifier stays stopped.
• Reports: kept until we review them, then deleted 90 days after they are closed.
• Expired invite codes are deleted automatically.

Deleting the app does not delete your Friends profile; delete it from inside Friends first if you want it gone.

8. Ads (Google AdMob)

Where and when: a small banner on some lists, never on writing or editing screens and never in Friends. If the app offers a rewarded ad, it is optional and only starts when you tap its button yourself.

What happens in the background: shortly after the app starts, and if consent allows (see below), it starts the Google Mobile Ads SDK and may get an ad ready in advance. So the SDK contacts Google’s servers even if you never tap an ad.

What Google may collect: according to Google, its ads SDK may collect:

• the IP address, from which an approximate location is inferred (a city or region, never your precise location);
• a device identifier scoped to this app or to this developer’s apps. Nobody gets the advertising identifier (IDFA), because the app never asks for tracking permission;
• data about the ads you were shown and how you interacted with them (such as watching or tapping an ad);
• diagnostic data about performance and crashes.

Google uses this data to show and measure the ad, to limit how often an ad is shown, to fight fraud and abuse, and to improve its ad services. We give Google nothing from your shelves, your photos, your backup or Friends, and we never link them with ad data.

Non-personalised, family-safe ads: every ad request asks for non-personalised ads, which are not based on your past activity or interests. Google may still pick an ad from general context, such as the device language and the country. We also limit ads to content suitable for general audiences with parental guidance (PG).

No tracking: the app never asks for Apple’s “App Tracking Transparency” permission. We never link data about you with data from other companies’ apps or websites for advertising, and we do not sell data or share it with data brokers. The app uses Apple’s SKAdNetwork, which lets advertisers count the installs their ads brought without identifying you.

Consent: in the UK, Switzerland and the European Economic Area, and anywhere else the law requires it, Google shows a consent message when you open the app (Google’s User Messaging Platform). If you do not agree, the app requests no ads at all, and the app stays complete. The “Ad and privacy choices” button then appears in Settings, so you can change your choice at any time.

More: How Google uses information from sites or apps that use its services and the Google Privacy Policy.

In our AdMob account we see aggregated figures only (such as ad views and earnings by country). They do not identify anyone.

9. What the app does not do

No accounts or sign-in, no in-app purchases at the moment, no analytics or crash-reporting tools of our own, no chat or private messages, no public pages, and no push notifications. The app never accesses your contacts, precise location or microphone. It uses the camera only when you choose to take a photo for an item, and takes from your photos only the one you pick. The catalogs are inside the app; only real covers, the backup, Friends, the ads, the consent message and opening links need the internet.

10. All ages

The app is for a general audience. What people post in Friends passes through a filter and is subject to the rules, reporting, blocking and review. Real covers pass through a deny list for anything unsuitable for families, and you can hide or report any image. The app never asks your age, and we do not knowingly collect personal data from anyone, whatever their age.

11. Emailing us (optional)

• If you email us, we receive your email address, the display name on it, your message and any attachments.
• We use them only to reply to you, to handle a report, an image you reported or a copyright takedown request, or to sort out what you asked about. We never use them for marketing, and we share them with no one unless the law requires it.
• Retention: up to 12 months after our last exchange, then we delete them. You can ask us to delete them sooner: we do so within 30 days and confirm.
• Our support email is hosted by Google (Gmail), and messages may be stored on servers outside Saudi Arabia.

12. This website

• The website is static pages hosted on GitHub Pages by GitHub.
• No cookies, no analytics, no trackers, and no fonts or scripts from other sites.
• The profile page (/raff/p/) reads the profile from the link inside your browser only, sends it nowhere, and draws the covers itself. The invite page (/raff/c/) shows the invite code from the link inside your browser only, and contacts no server.
• Like any host, GitHub may log technical data about a visit in its server logs (such as the IP address, browser type and the page requested) for operation and security, under GitHub’s privacy statement, and its servers may be outside Saudi Arabia. We do not ask for or use these logs.

13. Who processes data with us, and transfers

• Cloudflare runs the app’s server and database (Cloudflare Workers and D1) on our behalf, for the encrypted backup and Friends. Its servers are in several countries, including countries outside Saudi Arabia, under its own policies and safeguards. Like any network provider, Cloudflare may process technical data about requests (such as the IP address) for operation and security; we do not ask for or use it.
• Google processes ad data on its servers in several countries, including countries outside Saudi Arabia, under its own policies and safeguards.
• The cover sites (TVmaze, Open Library, IGDB and Wikimedia Commons) do not process data on our behalf: your phone asks them for images directly (section 4), their own policies apply, and their servers may be outside Saudi Arabia.

14. Your rights

Under Saudi Arabia’s Personal Data Protection Law you have the right to know how your data is processed, to access it and get a copy, to have it corrected, and to ask for it to be destroyed. You can use most of them in the app itself:

• Your profile and photos are on your device and in your hands: you edit or delete them in the app, and deleting the app deletes all of it.
• The backup: “Delete my cloud copy” in Settings. We cannot read it to give you a copy, but it is a copy of the profile on your phone.
• Friends: you edit your name and emoji, delete your reviews and comments, undo your follows and likes, and “Delete my Friends profile” deletes all of it.
• For anything else, write to us and we reply within 30 days. Because we do not know who you are, we may ask you to show that the profile is yours.

The data Google collects for ads is managed from the “Ad and privacy choices” button in Settings (where it appears) and from Google’s own tools. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA). If you live in a country with its own data-protection law, you have the rights it gives you.

15. Changes

If we change this policy, we update this page and its effective date above. If the app ever collects other data, or asks for tracking permission, we will say so here before that update, and update the App Store privacy details.

16. Contact

asimapps.dev@gmail.com