Privacy Policy for “Okaz” App & Website

Last Updated: November 2026

1. Introduction

Welcome to “Okaz” (referred to as “we”, “us”, “App”, or “Platform”), a meditation, breathing and music app and website developed and managed by Zack Abasi. Zack Abasi is the data controller responsible for your personal data under this policy.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what information we collect when you use the Okaz app (iPhone, iPad and Android) and the website okaz.io, how we use it, who helps us process it, and the choices you have. It is written to comply with the General Data Protection Regulation (GDPR), other applicable privacy laws, and the privacy requirements of the App Store and Google Play.

In short: we collect only what Okaz needs to work, we never sell your data, and Okaz has no ads and does not track you.

Please read this policy to understand how we handle your data. If you do not agree with it, please stop using the App and the Website.

2. Data We Collect

We follow the principle of data minimisation and collect only what we need to provide Okaz. You can use Okaz as a guest without giving us your name or email; an account is needed only for some features, such as the Intermittent Breathing practice and keeping your progress on all your devices.

In the app:

  • Account details: If you create an account, we store your email address and your name (when provided). You can sign in with Apple (on iPhone, iPad and the website), with Google, or with an email and password. If you use Sign in with Apple and choose to hide your email, we receive Apple’s private relay address instead. If you sign in with Google, we also save the link to your Google profile photo.
  • Profile picture (optional): A photo you choose from your photo library in Settings › Edit profile. It is stored in Firebase Storage.
  • Guest accounts: If you use the app without signing in, it creates a guest account with an anonymous ID and no name or email. For guests, we also count how many items are played each day, to apply the guest daily limit.
  • Subscription data: If you subscribe to Okaz Premium, Apple (App Store) or Google (Google Play) takes the payment, and RevenueCat, the service we use to manage subscriptions, receives the store’s purchase records (such as your plan, price, purchase and renewal dates, and which store you used). Our server then saves on your account whether Premium is active and when the current period ends. RevenueCat also receives a record each time our plans page is shown to you. What RevenueCat receives is linked to your account’s ID, not to your name or email. We never see your card or payment details.
  • Practice and listening progress: Your Intermittent Breathing sessions (the days you practised, the number of sessions and their minutes), your listening time with Triluma, your streaks, level and badges, your Favourites, and a record of what you have already seen (such as the Intermittent Breathing intro videos). This is saved to your account so it is not lost and appears on your other devices.
  • Notifications: To deliver notifications, Firebase Cloud Messaging uses a push token for your device. If you turn on notifications or a reminder in Okaz and allow notifications on your phone, your device joins the list we send important alerts to. We do not save this token with your account.
  • Technical data: When the app connects to the services listed in section 4, they receive standard technical information, such as your device model, operating system and app version, language and region settings, IP address, and an identifier specific to our app on your device. Okaz does not collect your advertising identifier (IDFA or Advertising ID).

Kept only on your phone:

  • Your reminder settings: Present Moment Reminders and the Meditation Reminder, with the hours and time you choose. Your phone schedules them itself, using its time zone.
  • Search’s “Recently opened” list (only which items you opened; what you type is never saved).
  • Media kept for faster playback: audio tracks, practice videos and practice sounds you return to are saved on your phone (up to 400 MB), so they start faster and use less data. When signed in, you can remove them in Settings › Clear downloaded media; they are also removed when you log out, delete your account or delete the app.
  • Your app preferences, such as the app language, subtitles and Breathe with Zakoor.

(Important Note: Okaz does NOT collect any medical data, audio recordings, or precise location data.)

On the website (okaz.io):

  • Guest and account sign-in: When you open the website, it signs you in as a guest with an anonymous ID (through Firebase) so you can play content, and counts guest plays to apply the daily limit. You can also sign in with the same Okaz account (Apple, Google, or email and password); your Favourites and profile are the same in the app and on the website.
  • Forms: If you use the contact form or the account deletion form, we receive what you enter (such as your name, email address, message or reason for leaving). Web3Forms delivers these forms to our email.
  • Cookies and browser storage: Okaz itself sets no analytics or advertising cookies. The website keeps in your browser only what it needs to work: your sign-in session (stored by Firebase Authentication), a cookie that remembers the site language during your visit, and whether you closed the cookie notice and the app banner. Some blog posts include YouTube videos in YouTube’s privacy-enhanced mode; when you play one, YouTube (Google) may set its own cookies under Google’s privacy policy.

3. How We Use Your Data

We use your data only for the following purposes:

  • Operating the service: To sign you in, play audio and videos, apply the guest daily limit, and keep your Favourites, progress, streaks, level and badges.
  • Syncing across devices: So your account, progress and Favourites appear on all your devices where you sign in; the website shows your profile and Favourites.
  • Unlocking and verifying Okaz Premium: Our server checks your subscription with RevenueCat (for example after a purchase, a renewal or Restore Purchases) and records on your account whether Premium is active, so Premium also works on your other devices when you sign in with the same account.
  • Reminders and notifications: Reminders are scheduled by your phone. We send notifications only if you turn on notifications or a reminder in Okaz and allow notifications on your phone; you can turn them off at any time in Settings or in your phone’s settings.
  • Support and communication: To answer your messages, handle deletion requests, and, when needed, tell you about important changes to Okaz or to this policy.
  • Improving Okaz: We look at overall subscription numbers in RevenueCat’s reports (for example, how often the plans page is shown and how many people subscribe), at the overall statistics and crash reports Apple and Google give us (see section 4), and at the feedback you send us. We do not use Google Analytics, Firebase Analytics or any advertising tools.

Legal bases (GDPR): we process your data to provide the service you asked for (performance of a contract), with your consent where we ask for it (for example, notifications), for our legitimate interests in keeping Okaz secure, improving it (for example, by understanding how the plans page performs) and answering your messages, and where the law requires it.

4. Sharing Data with Third Parties

We never sell or rent your personal data. Okaz shows no ads and does not track you across other companies’ apps or websites. We share data only with the service providers that run Okaz for us, and only as much as each one needs:

  • Google Firebase: Authentication (sign-in, guest accounts and password-reset emails), Cloud Firestore (your account, progress, Favourites and Premium status), Cloud Storage (profile pictures and the app’s audio, videos and images), Cloud Messaging (notifications) and Cloud Functions (our server code, for example to check subscriptions with RevenueCat).
  • RevenueCat: Manages Okaz Premium subscriptions. It receives your account’s ID, the store’s purchase records, a record each time our plans page is shown to you, and the technical data described above, and tells our server whether Premium is active.
  • Vercel: Hosts the website and receives standard request data, such as your IP address and browser type.
  • Web3Forms: Delivers the website’s contact and account deletion forms to our email.
  • MXroute: Hosts our email address support@okaz.io and stores the emails you send us.
  • Apple and Google: Sign in with Apple and Google Sign-In (if you use them), payments and subscriptions through the App Store and Google Play, app downloads, and delivering notifications to your device. They also give us overall statistics (such as downloads) and, if you allow it in your phone’s settings, crash reports. They act under their own privacy policies and may collect some information independently.
  • Legal requirements: We may disclose your data if required to do so by law or in response to valid requests by public authorities.

Firebase, RevenueCat, Vercel, Web3Forms and MXroute process data on our behalf only to provide their services to us, and we share your data only with providers that give it the same or equal protection as this policy describes. Some of them process data outside your country, including in the United States. For people in the EEA and the UK, transfers to Google, RevenueCat and Vercel rely on the safeguards in their data processing terms, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework. If you prefer not to use the website’s forms (Web3Forms), you can email us at support@okaz.io instead. You can ask us for details of these safeguards.

5. Your Rights under the GDPR

If you are a resident of the European Economic Area (EEA), the United Kingdom, or another region with similar laws, you have the following rights:

  • Right of Access: You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification: You have the right to request correction of any inaccurate or incomplete data. You can also change your name and photo yourself in Settings › Edit profile.
  • Right to Erasure (“Right to be Forgotten”): You have the right to request that we permanently erase your personal data (see section 6).
  • Right to Restrict or Object: You have the right to ask us to limit or stop certain processing of your data.
  • Right to Data Portability: You have the right to receive your data in a common, machine-readable format.
  • Right to Withdraw Consent: You have the right to withdraw your consent at any time (for example, by turning notifications off), without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to Complain: You have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us using the contact information provided below. We will reply within one month.

6. Data Retention & Deletion

  • Retention period: We keep your account data for as long as your account exists, or as long as necessary for the purposes set out in this policy or to comply with our legal obligations. Messages you send us are kept only as long as needed to help you.
  • Guest accounts: A guest account has no name or email. If you create an account in the app on the same phone, the guest’s progress becomes part of your new account, and Delete Account removes it with the rest of your account data. Guest records that are no longer in use (for example, from an earlier installation of the app or from a visit to the website) stay on our servers, linked only to a random ID.
  • Deleting your account in the app: When signed in, go to Settings › Delete Account. This deletes your sign-in account and the data saved with it (name, email, progress, Favourites, level and badges), and clears the media and the “Recently opened” list the app saved on that phone. For your security, the app may first ask you to log out and log in again before it can finish. It does not yet remove a profile picture you uploaded, or the subscription records linked to your account’s ID at RevenueCat and on our server; to have those deleted too, use the form or email below.
  • Deleting your account on the website: The Delete Account button in the website’s Settings currently deletes only your sign-in account, not the data saved with it. To have that data deleted as well, use the form or email below.
  • Other ways to ask for deletion: Use the form at okaz.io/delete-account, or email support@okaz.io from the address on your account. We aim to complete these requests within 5 business days, and always within 30 days. When you ask this way, we also delete your profile picture (if you uploaded one) and the subscription records linked to your account’s ID at RevenueCat and on our server.
  • Sign in with Apple: If you used Sign in with Apple, you can also stop using it with Okaz in your Apple Account settings.
  • Your subscription: Deleting the app or your Okaz account does not cancel your subscription. To stop payments, cancel it in your App Store or Google Play subscription settings (in the app, when signed in: Settings › Manage Subscription). Apple and Google keep their own records of your purchases under their policies.

7. Data Security

Keeping your data secure is a top priority for us. Data is sent over encrypted connections and stored with Google Firebase, which encrypts stored data. Our database rules let each user read and change only their own account record (such as their name, email, progress and Favourites), and Premium status can be changed only by our server or by us, not from your device. However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure.

8. Children’s Privacy

The “Okaz” App does not target children under the age of 13. We do not knowingly collect any personal information from children. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we discover that we have collected personal information from a child without parental consent, we will take immediate steps to remove that information from our servers.

9. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. We will notify you of any material changes by posting the new policy on this page and updating the “Last Updated” date at the top. We encourage you to review this page periodically.

10. Contact Information

If you have any questions or concerns about this Privacy Policy, our data handling practices, or if you wish to exercise your rights as a user, please contact us:

© 2026 - Okaz