Ajyal app privacy
What data the Ajyal app collects, how it uses and shares it, how long it keeps it, and how to delete your account.
Last updated:
Who is responsible for your data
Ajyal is jointly operated by the partners Samer Alhammada and Shadi Ghoul, who are joint controllers of your personal data. The partnership is not registered; this description alone does not establish a particular legal form.
Address: Samer Alhammada and Shadi Ghoul, Marie-Curie-Straße 1a, 19063 Schwerin, Germany. For everything about privacy, your rights and safety reports: support@ajyal.love. You may approach either of them; both are responsible for responding. No data protection officer is appointed.
Ajyal is only for people aged 18 and over. Your date of birth is used once to confirm you are 18+. We store only that you are eligible, unless you choose to show your age, in which case we store the date. Accounts created before October 2026 may still have a stored date of birth; you can ask us to remove it at support@ajyal.love. Gender is optional. Confirming your email address shows that you can access the email account you provided. It does not verify your identity or age.
Samer Alhammada is the primary contact for rights and privacy requests; Shadi Ghoul covers absences as agreed by both partners. They check the inbox daily according to the rota. Handover preserves the original receipt date, deadline and next action. We aim to acknowledge receipt within two working days without changing the statutory response deadline. Urgent or complex requests are escalated to Samer or, during absence, Shadi. You may exercise your rights against either controller without knowing who handles the request internally.
What we collect when you create an account
An email address, a password and a nickname are required. The password is stored as a non-reversible hash. Your date of birth is used once to confirm you are 18+. We store only that you are eligible, unless you choose to show your age, in which case we store the date. Gender is optional; declining to disclose does not record “Other”. Exact age display is a separate choice, off by default; it stores the date to calculate age without displaying the date itself. This is self-declaration, not document-based identity verification.
Everything else is optional: a photo (from the Ajyal library or your phone), a bio, a country, interests, and short answers to up to three get-to-know-you questions, shown on your profile like your bio. You choose whether others see your age, gender, presence and last-seen status. You also decide who can message you or send a friend request. The app does not use your location or your address book.
A photo you upload is resized and stored as a 512×512 JPEG with its metadata (such as where it was taken) removed.
For each sign-in we keep when it began and a device label with only the platform and app version, such as “Android · Ajyal 0.2.39” — no device model, serial number or network address. Under Account › Connected devices you see the devices signed in to your account and, with your password, can sign out all the others.
In Edit profile, saving with exact age display off removes the birth date from the active profile while retaining 18+ eligibility. Choosing “Prefer not to say” and saving removes gender; hiding its display alone does not remove the value. The anti-revival journal keeps the account identifier, withdrawal type and time, without the field value. Older backups retain data until their retention ends; restore applies withdrawals before serving, preserving a proven later choice. Accounts created before October 2026 may still have a stored date of birth; the schema migration does not erase those dates automatically. You can ask us to remove it at support@ajyal.love. Otherwise it remains until the account holder chooses removal or a separate authorised erasure action.
Conversations
Messages you send in rooms and private chats — text, images and voice messages — are stored with the sender, time and read state. Room messages are visible to the room's members according to its settings; a private chat is visible only to its two participants.
Conversations are not end-to-end encrypted. Everything travels over an encrypted connection (HTTPS), but the operators of Ajyal can technically access what is stored on the server. There is no tool for browsing private chats; when a report is filed, an authorised reviewer sees only the reported message, and that access is logged.
When you block someone, all new contact between you stops and they can no longer open your private attachments. Old messages may remain on both sides, and we cannot erase a copy someone saved outside the app.
Progress points (XP) come from replies in rooms and from same-day exchanges in private chats. For this the server notes, per day, the other person, the kind of exchange and the points — never any text. You see your progress in the app and these entries in your data export; nobody else sees them. They are deleted after 30 days, and at once when you or the other person deletes the account.
Text translation
Text translation is available to members of the test group and is off until you switch it on. You choose automatic translation and a reading language: Arabic, English or German. Turning it off stops translation requests from your account and leaves the original visible. A test-group member who switches translation on may have a message you sent translated, limited to text they may already see; your setting does not override their reading choice. Messages you send may be translated for recipients who switch translation on. You can object to this at support@ajyal.love.
What is sent to Google is the message text, with names, links and numbers replaced by placeholders, the target language, and up to three earlier messages as context (max. 1,600 characters); for a reply, the replied-to message is included first. No account or sender identifiers, voice or images are sent. That context may include other people's messages. We do not send entire conversations, profile data or attachments, and this feature does not enable provider search or tools.
We use Gemini through a Google project with active billing under the Paid Services terms. Google says it does not use those inputs and outputs to improve its products, but retains the text, context and output for up to 55 days for abuse monitoring; authorised staff may review flagged content. Data may be processed outside the EEA. Google processes this data as our processor under the Data Processing Addendum for Products Where Google is a Data Processor. Transfers outside the EEA rely on the EU Standard Contractual Clauses in that addendum and on Google LLC's certification under the EU-U.S. Data Privacy Framework.
The original remains the reference for the message, reports and sanctions. A translation is derived text that may be wrong, marked as translated with an option to show the original. Ajyal's server stores successful translations for reuse within the conversation, permission and context scope; private-message memory is not pooled between conversations, and we do not use members' messages to train a model or create public examples.
Derived translations follow access, export, deletion and retention rules tied to their originals. Changing the original invalidates the old translation; deleting it prevents a late result from making it visible again. Switching translation off alone does not delete originals or translations. Deletion from Ajyal does not immediately erase Google's copies or override the backup and report-evidence periods described below.
Feature monitoring covers request, reuse, token, cost, duration and error counters, without conversation text or API keys in operational logs. Sending and receiving original messages remains available if translation fails or stops at the spending cap.
Voice
Listening to a voice room does not turn on your microphone. Speaking takes a tap, and your voice goes live to the people present through Ajyal's server without being recorded or stored.
A voice message you record and send yourself is stored as an attachment (up to two minutes). Playing an audio file from your phone, or another app's sound, into a room keeps the file on your phone; only the live stream reaches the server.
Notifications
Phone notifications are optional. When enabled, Expo and Google Firebase/FCM process delivery tokens, installation identifiers and random notification references to deliver alerts. The data sent to deliver notifications contains no conversation text, your name or room name; the app retrieves permitted content from Ajyal. Lock-screen message previews are a separate choice. Withdraw using “Turn off on this phone” or block notifications in phone settings without losing your account or rights. If offline, the pending disabling action finishes after reconnection; tapping does not instantly erase every provider record.
Where your data is kept and who processes it
Ajyal's accounts, conversations and voice run on a rented server at the hosting company Contabo, administered by the operators of Ajyal themselves. We use no third-party chat service, but the hosting company provides the machine and can technically access it.
Access logs record the network address, time and request path. Rotation of isolated Ajyal access logs covers roughly two weeks and does not guarantee the full period. The isolated operating log has a 100 MiB storage limit and may cover less under pressure; we do not promise a strict cap for its active file. New retention cleanup has not been activated. Abuse limits retain keyed network hashes for about one hour and email/sign-in-attempt hashes until 24 hours after the last failed attempt; the separate security payload is described below. The network fingerprint uses the IPv4 address or first half of IPv6; these addresses are not stored in the application database by the attempt limiter.
Email confirmation, password recovery, security notices and privacy-request verification use Porkbun email hosting, which also hosts support@ajyal.love. The mail provider processes the recipient address, message headers and technical message content, including a verification link where applicable; account emails do not include your nickname or conversations. Messages you send to support may contain whatever you choose to send, so send only what is needed and never passwords.
Contabo hosts accounts, conversations, media and voice in the European Union on the existing server. Expo terms contain processing and transfer provisions; Firebase processing terms apply by service, including FCM. A general international-framework listing is not proof of coverage for every operation. A data processing agreement under Article 28 GDPR is in place with Contabo GmbH, Welfenstraße 22, 81541 München, as processor. It was concluded electronically on 25 October 2026 for the Cloud VPS hosting the app. The provider is based in Germany. The data centre is operated by the subprocessor Contabo France SAS in Lauterbourg, France, in the EU. There is no third-country transfer for this hosting. Available documents have not established processing and transfer coverage for the Porkbun mailbox. Notification and mail services may process data outside the EEA, including the United States. We do not record these remaining gaps as provider acceptance or established coverage; authorization to prepare this notice does not resolve them. We do not sell your data or use advertising or analytics tracking.
Usage measurement is switched off: we do not collect a history of how you use the app, and any old measurement data is deleted after 14 days.
How long we keep your data
You can delete a private message for both sides within 60 seconds of sending it. After 30 days without a new message, a private chat is deleted entirely for both participants. A room and its content are deleted after 30 days of inactivity, with a warning to its owner beforehand.
When you report content, we keep a copy of the reported message(s) for 90 days to review it and handle appeals, then delete it automatically, not the whole conversation. This copy may remain for up to 90 days even if the message or account is deleted. Copies of reported messages are deleted automatically 90 days after the report. Report records (reason, description, the accounts involved and the decision) are currently kept until we delete them; we are introducing a 365-day limit after the case is closed. This limit is not in force yet. A sanction by itself does not extend this evidence period. Sanction and appeal reasons are redacted after the relevant sanction and appeal have ended and the applicable 90-day period has passed; a reason may remain while the relevant sanction or review is active. Sensitive audit payloads expire 90 days after creation, or with the report evidence when linked to it; report-decision payloads follow their report evidence expiry. The base event or decision record remains without the sensitive text and currently has no final period.
A sign-in session lasts 7 days. A verification link in an email is valid for 15 minutes. An account-deletion receipt is valid for 24 hours. A notification binding is deleted after 30 days without use.
Routine server backups are deleted after 7 days. There are also encrypted recovery copies outside the server, taken manually, which remain until the operators delete them; no period has been set for them yet. Audit records and the list of used account numbers are kept without a final period for security and accountability, and contain no message text. Blocks and declined friend requests also remain as identifiers only, without a set period, even after account deletion. The table below summarises the periods.
We assess evidence-preservation requests by requester, legal basis, scope and deadline. A request does not automatically stop deletion; the current system cannot place an individual item on legal hold. If a specific obligation or legal claim requires additional preservation, we identify the material, duration and ability to implement it, and escalate before promising preservation. This notice neither automatically extends retention nor promises that extension can never be required. Receiving an email does not itself copy evidence or alter its retention.
Previously issued membership numbers remain protected against reassignment, including by the owner, while first allocation of unused numbers and the rules for number 1 and platform-ownership transfer remain. Potential personal links are subject to the targeted annual review. Identifiers and hashes do not become anonymous merely because names are absent. Tools for the approved target periods exist, but first deletion is a separate activation and has not occurred. The table distinguishes implemented behaviour from the target policy.
Ajyal operating periods, not uniform periods imposed by law. Cleanup is periodic and file-removal failures can delay deletion.
| Data | Purpose and access | Period and start | Removal and exceptions |
|---|---|---|---|
| Account, profile and photo | To run your account; visible to those you allow, technically accessible to the operators | Until you delete your account; the photo and optional answers until you change or remove them | Profile, login details and media are deleted; audit records remain (see the audit row) In Edit profile, saving with exact age display off removes the birth date from the active profile while retaining 18+ eligibility. Choosing “Prefer not to say” and saving removes gender; hiding its display alone does not remove the value. The anti-revival journal keeps the account identifier, withdrawal type and time, without the field value. Older backups retain data until their retention ends; restore applies withdrawals before serving, preserving a proven later choice. Accounts created before October 2026 may still have a stored date of birth; the schema migration does not erase those dates automatically. You can ask us to remove it at support@ajyal.love. Otherwise it remains until the account holder chooses removal or a separate authorised erasure action. |
| Private chats and attachments | Between you and the other person only | 30 days from the last new message | Entire history is deleted when the period ends, not message by message; a reported message stays as evidence for its own period |
| Rooms and their history | For room members, according to the room's settings | 30 days from the last activity in the room | The room and its history are deleted after the period; if voice is still running there, deletion waits until it ends |
| Text translations | Stored in message_translations so a test-group member who switched translation on can reuse the derived text in that conversation. Google receives the placeholder-redacted message text, the target language and limited context as our processor | Until the original message is edited or deleted, or the account is deleted | Stored in message_translations; deleted when the original message is edited or deleted, or the account is deleted. Google may keep a copy for up to 55 days for abuse monitoring. |
| Progress (XP) entries | Per day: the other person, the kind of exchange and the points, never text; only for you, in the app and your data export | 30 days from the day of the award | Deleted when either account is deleted; the remaining person keeps the points already earned |
| Report evidence | When you report content, we keep a copy of the reported message(s) for 90 days to review it and handle appeals, then delete it automatically (Art. 6(1)(f) GDPR; legal obligations under the EU Digital Services Act). For authorised review only; access is recorded | 90 days from the report | Copies of reported messages are deleted automatically 90 days after the report. This copy may remain for up to 90 days even if the message or account is deleted. A sanction alone does not extend it. Legal preservation needs a specific assessment; no deletion-hold mechanism is implemented (see preservation procedure). |
| Report records | The reason, description, the accounts involved and the decision, for authorised review of repeated abuse | Currently kept until we delete them; a 365-day limit after the case is closed is not in force yet | Report records (reason, description, the accounts involved and the decision) are currently kept until we delete them; we are introducing a 365-day limit after the case is closed. This limit is not in force yet. |
| Sanction and appeal reasons, and audit records | For Ajyal's administration only | Audit payload: 90 days from creation or linked report evidence expiry; decision payload: report evidence expiry; sanction and appeal reasons after ending and meeting related 90-day review conditions; base record has no final period | Sensitive text is deleted or redacted; the record keeps actor and target identifiers, action, time and an applicable reason digest, without message text; not automatically anonymous |
| Blocks and declined friend requests | To protect people who refused contact | No set period | Party identifiers and relationship remain without a name or content even after account deletion; they may remain personal data |
| Usage measurement | Disabled; we collect no new usage history | Any earlier detail is deleted after 14 days | Whatever remains of yours is deleted with your account |
| Session, email links and deletion receipt | To sign you in, verify you and follow up your request; you see your sessions with start time and device label (platform and app version) under Connected devices | Session 7 days; email link 15 minutes, single use; deletion receipt 24 hours | Expire automatically; signing out (including out of all other devices), resetting your password or deleting your account ends sessions |
| Protection against password guessing and mail floods | Hashes computed with a secret key of your network and of the email address entered (alone and with your network), never the addresses themselves; only to limit attempts | Network hash for account emails about 1 hour; sign-in failures until 24 hours after the last one | Deleted automatically; a password reset clears the sign-in entries at once |
| Phone notifications | To deliver alerts through Expo and Google; they receive only your device token, an installation identifier and, per alert, two random reference numbers, never content | Device binding deleted after 30 days without use; delivery records within two days; Expo and Google try to deliver an alert for at most 5 minutes | Signing out or deleting your account detaches the device; what Expo and Google keep follows their policies |
| Live voice and room presence | Sent live to the people in the room | Not recorded or stored | Ends when you leave the room; a voice message you send yourself is stored as an attachment |
| Photos and files | Only for those allowed to see them; no public links | Until the message, room or account is deleted; an uploaded file that is never used is deleted within 24 hours | Access is blocked first, then the file is deleted; a failed deletion is retried later |
| Backups and server logs | For the operators only; the hosting company provides the server | Routine backups 7 days; access log about 14 days; system logs without a time limit yet; manual off-server copies until deleted | Not everything is erased instantly; when a copy is restored, recorded deletions are applied again before it is used |
| Security record and payload | Selected events: type, result, time and event ID; separate payload with identifiers and keyed hashes where applicable | Payload: 90 days from event; base record has no final period | Cleanup deletes only the payload; separate from the one-hour or 24-hour attempt limits. Account deletion does not mean the whole record is deleted |
| Protected membership numbers | Reserved membership number and its current technical links; to prevent impersonation of a former number holder | Permanent reservation; no reassignment even by the owner; unused numbers retain first allocation | Code prevents reuse; annual review of personal links is a target policy, not an automatic process. No name does not mean anonymous |
Your rights and deleting your account
From the Account tab in the app you can export a copy of your data or delete your account after entering your password. You can also do this on the Ajyal website without reinstalling the app, through a link sent to your account email. The copy contains your profile and settings (including your get-to-know-you answers), your own messages, your rooms, contacts and blocks, your progress entries, and your reports, sanctions and appeals with their reasons; it leaves out other people's messages, protected evidence and sign-in secrets.
Account deletion removes your profile, login details and photo, ends sessions and notification bindings, closes rooms you founded, redacts your messages and removes media through the cleanup process. Translations stored by Ajyal are deleted with the original message, and Google's copies expire within 55 days. The other person’s messages, report evidence and reasons remain for the periods and conditions in the retention section; an open appeal is withdrawn. This copy may remain for up to 90 days even if the message or account is deleted. Copies of reported messages are deleted automatically 90 days after the report. Report records (reason, description, the accounts involved and the decision) are currently kept until we delete them; we are introducing a 365-day limit after the case is closed. This limit is not in force yet. Audit and security records and their payloads until their expiry, protected membership numbers, block and refusal relationships, and manual off-server backups may remain; some currently have no set deletion period. Deletion is final and does not occur merely by uninstalling the app. The legal-preservation note in the retention section applies.
You have rights of access, rectification, erasure and restriction under their legal conditions. Portability applies to automated processing based on contract or consent; you may object to legitimate-interest processing on grounds relating to your particular situation. You may withdraw optional consent for the future without affecting the lawfulness of earlier processing. We respond within one month of receipt; complexity or number of requests may require two further months, with reasons notified within the first month. You may complain to a data protection authority; details are on the rights page and contact is support@ajyal.love.
Using the app is not blanket consent to processing. A privacy notice explains processing, a read acknowledgement records reading only, acceptance of terms is separate, and optional consent concerns a specific purpose and can be withdrawn. Acknowledging a privacy update is not a condition for accessing rights requests or account deletion.
Security records
The base security record contains the event identifier, type, result and time, including sign-in, password changes, session revocation and refused permission. A separate payload may contain actor/target identifiers, a keyed email fingerprint and a network-source fingerprint. Routine cleanup expires it after 90 days; it contains no passwords, verification tokens or request text. Removing that payload does not remove the base event. The 180-day base-record period is approved and tooling is prepared, but its new cleanup has not been activated; we do not claim it is enforced on existing records.
Purposes and legal bases
Account, verification, sessions, conversations, media and requested voice: Article 6(1)(b) insofar as necessary to provide the service. By default, the age check stores only that you are at least 18 according to the date of birth you entered; gender and stored birth dates are not required for the core service.
Optional gender, storing a birth date for exact-age display, and optional phone notifications: separate choices for specific purposes under Article 6(1)(a), withdrawable in settings. OS permission alone and accepting terms are not blanket consent, and we do not record a choice that did not happen.
Account security, abuse prevention, report review, blocking, audit, recovery backups and protected membership numbers: Article 6(1)(f), for service and user safety and preventing impersonation. We limit data, permissions and retention and provide objections and review; this does not justify preserving every personal link indefinitely.
Rights requests, proportionate verification, responses and fulfilment: Article 6(1)(c), to meet GDPR obligations, particularly Articles 12–22. Other official requests require a specific applicable basis; not every report imposes a new retention period.
Text translation: Article 6(1)(b) for the member who switches it on or requests it; for the sender whose visible message is translated, Article 6(1)(f), the conversation partners' interest in understanding each other, limited to text the recipient may already see. You may object at support@ajyal.love.
We do not make decisions based solely on automated processing with legal or similarly significant effects. Moderation actions are taken by people. Automated rate limits and temporary sign-in lockouts protect the service and are lifted automatically.
These bases do not automatically cover special categories or offence-related data. Where Article 9 or 10 applies, its appropriate condition and a case-specific assessment are needed. Do not include unnecessary sensitive information in profiles or reports, or send passwords. Provider-agreement limitations are described under operations.
Target retention policy — approved, not implemented
On 23 September 2026 the owner approved this target policy for later implementation, without authorising deletion or service changes now: manual off-server backups, 30 days from the snapshot, with assessment of losing the last backup before any deletion and no permanent “last backup” exception. Ajyal-specific operational and access logs, 14 days, conditional on being able to isolate their settings from shared services.
Base security events: 180 days from the event. Audit and decision records: 365 days from the event or closure of the related case, whichever is later, with open cases reviewed every 90 days. Sensitive-payload periods and their links to evidence remain unchanged; the 365-day limit does not automatically apply to the journal preventing restoration of erased data.
Blocks and rejections remain while both accounts are active and the relationship continues; the target is to remove the link 30 days after either account is deleted, without expiring blocks between active accounts. The target retention policy is approved and implementation tools exist; new deletion has not been activated on existing data. Publishing this notice does not activate cleanup. Previously issued membership numbers remain protected against reassignment, including by the owner, while first allocation of unused numbers and the rules for number 1 and platform-ownership transfer remain. Potential personal links are subject to the targeted annual review. Identifiers and hashes do not become anonymous merely because names are absent. Tools for the approved target periods exist, but first deletion is a separate activation and has not occurred. The table distinguishes implemented behaviour from the target policy.