This policy explains what Khitbaah collects, why, who can see it, and what you can do about it. It is written to be read, not to be survived. Khitbaah is the controller of the personal data described here, and "we" throughout this document means Khitbaah. Questions go to info@khitbaah.com.
Khitbaah is for adults seeking marriage. You must be 18 or over to use it. We enforce this by requiring an age of 18 or above at sign-up and by removing accounts reported as belonging to under-18s. We do not verify anyone's age against a document, so please treat this as a rule we enforce on report, not a guarantee about every person you encounter.
We do not collect or store your date of birth. Your device works out your age and sends us only the resulting whole number. That number cannot be changed afterwards without contacting support, which is deliberate — an age that can be edited freely is not a safety control.
Your email address, your name, and an identifier that Google or Apple gives us when you sign in with them. We never receive your Google or Apple password. If you sign in with Apple and choose to hide your email, we only receive the relay address Apple creates for us. We also keep a count of how many times an account has been created with your email address.
Everything you put in your profile, which is a lot, because that is what the app is for: age, gender, city, height, education, profession, sect, school of thought, caste, prayer habits, nationality, the country you grew up in, ethnicity, languages, marital status, whether you have or plan to have children, smoking, drinking, how many brothers and sisters you have, your hobbies, how long you want to get to know someone and be married within, faith tags, your written bio, and whether you are acting as a wali for someone else. We also store the partner preferences you set.
When you open the app, it checks where your device is and works out the city, state or province, and country you are in. That happens every time you open Khitbaah, not just when you signed up, so that distances stay accurate and so you can filter by place. It only ever asks your phone for an approximate position, never a precise one, and if you decline the location permission the app carries on working — you just keep whatever location you set yourself.
The city, state and country worked out this way are turned into place names on your own device. Your coordinates are not sent to any mapping or geocoding company to do it.
Your coordinates are deliberately blurred by roughly one kilometre before we store them, and we never give them to anyone. Other people only ever see an approximate distance. We blur before writing them down, not when showing them, so the precise point is never something we hold.
Travelling does not quietly move you. The place shown on your profile only changes once your device has been reporting somewhere new for a sustained period — a week away does not relocate you, and a single trip home cancels it. If you want to look at people somewhere else in the meantime, use the location filter; that does not change your profile.
A location you deliberately share inside a chat is different. It is sent exactly as you shared it, because a blurred "meet me here" pin would be useless. Instead, it is end-to-end encrypted: it is locked on your phone and can only be opened on your match's phone. Our servers only pass on a copy they cannot read, and delete it as soon as your match's phone has received it, or after 30 days if it never does. After that the only copies are on your device and theirs.
Your profile photos — we store both the original and a blurred copy that we generate, so that blurring works even before a match. Photos you send in a chat. Selfies you take for verification. When a photo is uploaded we re-encode it, and that strips the embedded metadata, including any GPS coordinates your camera recorded.
If you use photo verification, we compute and store a set of 128 numbers that describe the geometry of your face. It is not a photograph and cannot be turned back into one. It exists so that photos you upload later can be checked against the face you verified with, which is what stops a verified account from quietly swapping in someone else's pictures.
We use face data only for that verification. We do not use it to log you in, for advertising or marketing, to build a profile of you, or to identify you anywhere else, and we never share it with anyone.
We ask for this separately. Before your first verification attempt we show you a notice explaining what is measured, how long it is kept and who can see it, and nothing is computed or stored until you agree to it. That is deliberate: in some places this counts as biometric or special-category data, and consent to it has to be asked for on its own rather than bundled into your acceptance of these documents.
You can change your mind. "Delete my face data" in Settings erases the measurements and every selfie you submitted, and withdraws your consent. Your verified tick goes with them, because the whole purpose of the measurements is to keep that tick meaningful — but your account, your photos and your conversations are untouched, and you can verify again later if you want the tick back.
We delete verification selfies on a schedule as well as on request: thirty days after you take them, whether the check passed or failed. Deleting the image does not remove your tick — the measurements it produced stay until you delete them or your account. The face-recognition models run on our own servers, and your selfie is never sent to a third-party face-recognition service.
Our staff can view a verification selfie — for example if you contest an automated rejection. No other member ever sees it.
Khitbaah does not currently read, upload or store your contacts, and the app does not ask for permission to access them. If we ever offer a contacts feature, it will be optional, we will update this policy before it launches, and the app will explain what it does and ask you first.
Text messages and locations you share in a chat are end-to-end encrypted. They are locked on your phone and can only be opened on the phones in the conversation — not by us. Our servers hold an encrypted copy only until the other person's phone has received it, or for 30 days if it never does, and we do not store the text of your messages.
If you turn on chat backup, your phone copies those messages to your own Google Drive (Android) or iCloud (iPhone) so you can restore them on a new phone. The backup is encrypted on your phone with a password you choose before it is uploaded: Google, Apple and Khitbaah cannot read it, and if you forget the password nobody can restore it. Backups never reach our servers and do not include photos or voice notes. You can turn backup off, which deletes the backup, in Settings; deleting your account from the app deletes it too.
For every message we do store who sent it, to whom, when, what kind of message it is (text, photo, voice note or location), whether it has been read, and the public encryption keys your phone publishes so that others can start an encrypted conversation with you.
Photos and voice notes you send in a chat are not end-to-end encrypted: they pass through our servers so they can be screened for explicit content, and we keep them only for the times in section 8. If a conversation cannot be encrypted — for example because the other person uses an older version of the app — the chat says so, and text messages in it are stored on our servers. Messages sent before end-to-end encryption was introduced are also stored on our servers.
You can call someone you are matched with, but only after they have agreed to take calls. Calls are audio only. When you place or answer a call, the app asks for microphone permission, and your voice travels from your phone to theirs through a call server that we run ourselves — no outside calling service is involved. We do not record calls and we do not keep any audio.
Calls are end-to-end encrypted when both phones are on an up-to-date version of the app: your phone creates a one-time key for the call and sends it to the other person's phone locked, so our servers carry the audio but cannot listen to it. If the other person's phone cannot take an encrypted call, the call screen says "Not end-to-end encrypted" and the audio is protected in transit but could be heard by our call server while it passes through. The call server also sees the IP addresses the two phones connect from, for as long as the call lasts.
For every call we keep a log: who called whom, in which conversation, when it started, whether it was answered, missed or declined, when it ended and who ended it. The one-time call key we pass on is deleted as soon as the call ends. We never store call content. Requests to allow calls, and whether you accepted or declined, appear as short notices in your conversation.
When you were last active, who you liked, passed on, viewed or blocked, and the notification token that lets us deliver a push to your device. Your exact last-active time is never shown to anyone else — other people only see a coarse bucket such as "online" or "active yesterday".
Support tickets and their messages. Reports you file, and reports filed about you — including a copy of the reported message's text and a copy of any photo that was blocked or reported, kept as evidence so a complaint can still be reviewed later.
Like any service you connect to, our servers see the IP address your device connects from. We use it only to rate-limit requests, which is what stops one machine from hammering the app. It is held in memory for that purpose and is not written to our database, not attached to your profile, and not used to work out where you are — that comes from your device's own location, and only with your permission.
To show you people and rank them against the preferences you set; to keep the app safe through moderation and reports; to run photo verification; to answer your support messages; to send you notifications; and to keep the service working.
We do not sell your data. We do not use it for advertising. We do not use your messages, photos or profile to train machine-learning models. Khitbaah shows no adverts at all today; if that ever changes we will update this policy, explain exactly what an advertiser would and would not receive, and ask you to accept the new version before you carry on.
All content screening runs on our own servers. Your messages, your bio and your photos are never sent to any third-party artificial-intelligence or content-moderation service.
Several things in Khitbaah can act on your account without a person reviewing it first. You are entitled to know what they are.
The consequences can include being hidden from other people's discovery feeds, being refused verification, or having your account suspended or banned.
You can ask a human being to review any of these. Contact us in the app or at info@khitbaah.com and a person will look at it.
Khitbaah works through written proposals rather than an open feed. This section explains what is stored about them and who can see it.
When you send a proposal we store the note you wrote, who it is for, and where it stands (waiting, accepted, declined or withdrawn). Unlike chat messages, a proposal note is stored in a form our servers can read, because the person receiving it, and their wali if they have one, have to be able to read it. Notes are checked for phone numbers, social media handles and unsafe language before they are sent. We keep proposals for as long as your account exists and delete them when you delete it.
The person you propose to sees your note and the details your profile shows: your name (or first initial if you hide it), age, city and country, profession, education, school of thought, prayer habits, marital history, how soon you hope to marry, and your bio. They do not see your photos until you approve a request to see them.
You may invite one person, such as a parent or guardian, to be your wali. They get their own Khitbaah account. We store their email address and name, the relationship you described, the mode you chose, and when the link was made or ended.
You can change the mode or remove your wali at any time. When you do, they lose access at once and anything waiting for their approval goes through. Deleting your account ends the link.
A wali account has no profile and no photos and cannot browse people. You can see only the proposals of the members who invited you, including the other person's profile details as listed above, even though that person did not choose you. You can stop being someone's wali, or delete your account, at any time.
Administrator access is limited to the people who run Khitbaah, and it is worth being plain about what they can see: your profile, your email address, your photos, and your verification selfie if you submitted one.
They cannot browse your conversations, and they cannot read end-to-end encrypted messages at all. Access to message content is limited to messages that have been reported. When you report a message in an encrypted conversation, your phone sends us its text, signed by the sender's phone so that it cannot be faked; in a conversation that is not encrypted, the surrounding messages are bundled with the report. There is no screen anywhere in the administration tools that lists a conversation you are having.
One exception you should know about: a photo attached to a report can be viewed during moderation even after it has expired for both people in the chat. That is deliberate — an eight-second photo used to harass someone would otherwise be unreviewable — but it does mean "expired for both of us" is not the same as "gone" when a photo has been reported.
Every administrative action taken against an account is recorded in an internal audit log, including who did it and when.
Your account and profile data are held in our own database, hosted with Hostinger. Photos, voice notes and verification selfies are stored with Cloudflare R2 (see section 5). Traffic between your device and our servers is encrypted. We store no passwords at all, because signing in goes through Google or Apple.
Being straightforward about a limitation: profile photos, chat photos and voice notes are encrypted at rest only by Cloudflare, with keys Cloudflare holds. That protects against stolen disks, but not against someone with access to our storage account. Verification selfies and evidence copies of blocked photos are additionally encrypted by us, with a key that never leaves our servers. Every file is served only through an authenticated request to our servers that checks whether you are allowed to see it — there is no public link to any file, the storage is not publicly listable, and file names are random.
For voice notes and shared locations, that window is how long our copy lasts, not how long the message lasts. Both apps save them permanently on the devices in the conversation, so afterwards those devices hold the only copies. The practical consequences: if the person you sent one to never opens the conversation within the window, they will never see it, and if you reinstall the app or change phones, we cannot restore old ones for you because we no longer have them.
Deleting your account removes your profile, your photos, your verification selfies and your matches. A small amount of information deliberately outlives it, and you should know exactly what and why:
You should also know what happens if you come back. If you sign up again with the same email address, the reports and blocks in that list are reattached to your new account and the account is flagged for review. Deleting and re-registering does not clear a safety history.
We do not put a fixed expiry on these. They exist to stop someone who has already harmed people from coming back, and a record that expires on a schedule would not do that — so they are kept for as long as that purpose holds. If you believe a record about you should no longer be kept, write to us and we will look at it.
Everything in that list exists to protect other people from someone who has already harmed them. None of it is used for any other purpose, and none of it is ever shown to another user.
We respond to requests within 30 days. Write to info@khitbaah.com, or use support inside the app.
Our database is hosted outside the United Kingdom and the European Economic Area, and files are stored with Cloudflare, whose data centres may be in several countries. So wherever you are in the world, using Khitbaah may mean your data is stored in another country and is subject to that country's laws while it is there. Apart from that, the only routine transfers are notification delivery through Apple and Google.
The country where our database is hosted is not covered by a United Kingdom or European Union adequacy decision, which is the shortcut that lets data move freely to some countries. So if you are in the UK or the European Economic Area, that transfer relies instead on the Standard Contractual Clauses approved for that purpose, which we have in place with our hosting provider. Our use of Cloudflare is covered by Cloudflare's data processing terms, which also include those clauses.
Khitbaah is not for anyone under 18 and we do not knowingly hold data about children. If you come across an account you believe belongs to someone under 18, report it from their profile and choose the under-18 reason. We remove such accounts. If you believe we hold data about a child, write to info@khitbaah.com and we will delete it.
If we change this policy in a way that matters, we will show you the new version in the app and ask you to accept it before you carry on using Khitbaah. You will not have to hunt for what changed on a website. The version and date at the top of this document tell you which one you are reading.
Email info@khitbaah.com about anything in this policy, or info@khitbaah.com about anything else. You can also reach us through support inside the app.