Privacy Policy

Overview

Rhemn ("we," "us," or "our") operates the Rhemn browser extension and related web properties (collectively, the "Service"). This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information.

By using the Service you agree to the practices described here. If you do not agree, please discontinue use and uninstall the extension.

Information We Collect

1. Account Information

When you sign in with Google or Apple we receive:

• Display name — provided by your identity provider
• Email address — used to identify your account. We may also email you about product updates and new features; you can unsubscribe from these at any time without affecting your account or billing emails.
• Profile photo URL — provided by your identity provider
• Authentication tokens — short-lived Firebase ID tokens used to verify your identity on our servers; never stored long-term in plaintext

We do not receive or store your Google or Apple password.

2. User-Created Content

The following content is created by you and stored so it syncs across your devices:

• Tasks (to-dos) and task lists
• Notes (text content, title, tags)
• Focus intentions you type into the focus bar
• Saved ("favorited") Quran verses
• App preferences (weather unit, prayer calculation method, display settings)

3. Voice Notes & AI Features

When you record a voice note, audio from your microphone is captured only while you are actively recording and is sent — by way of our backend — to our speech-to-text provider (OpenAI) to generate a written transcript. We use the audio solely to produce that transcript and do not retain the audio recording after transcription completes.

When you use AI features, the relevant text is sent to a third-party AI provider to generate the response. It is processed only to return your result; our providers do not use it to train their models. Different features use different providers:

• Note AI features — note summaries, voice-note summaries and structuring, and in-editor AI writing tools (continue, rewrite, summarize, translate, and similar) — send your note content or voice-note transcript to OpenAI, our default provider for these features. (Depending on our configuration, this note text may instead be processed by Anthropic.)
• Quran AI features — Quran insights, Ask, tafsir, related verses, and verse reflections — send the verse you are viewing (and, for reflections, the intention you enter) to Anthropic.
• Task AI features — Plan my day, voice task capture, and smart task parsing — send the text and priority of the tasks involved (and anything you say or type for the feature) to Anthropic, together with your prayer-block times. These tasks may include tasks synced from a service you have connected (see Connected Services). If you have connected a calendar, Plan my day also sends the start and end times of your busy periods — never event titles, descriptions, attendees, or locations.

4. Location Information

The weather widget and prayer times feature require your approximate location (latitude and longitude). Location coordinates are obtained via the browser Geolocation API only when you enable these features and are sent directly to our third-party data providers (OpenWeatherMap for weather; Aladhan for prayer times). We do not store your precise GPS coordinates on our servers. Your city-level location preference may be stored locally in the extension and in your account preferences.

5. Usage Analytics

We collect anonymous, aggregate usage analytics — for example, how many people opened a new tab, added a task, or shared a verse. These are stored only as daily totals tied to a random identifier held on your device; they are never linked to your identity, never include the content of your tasks, notes, or verses, and are never sold. You can turn this off any time with the "Anonymous analytics" toggle in the profile menu. This data stays on our own servers — we do not use any third-party analytics provider.

6. Subscription & Billing Information

If you subscribe to Rhemn Pro, payment is processed entirely by Stripe. We never see or store your full card number, CVV, or bank details. We retain your Stripe customer ID and subscription status (active / cancelled / trial) to unlock Pro features.

7. Technical Information

Our servers receive standard HTTP request information when the extension communicates with our backend, including your IP address. We do not use IP addresses for tracking or advertising; they may appear in server logs that are automatically purged after 30 days.

What we do NOT collect

• The contents of your calendar events (see Connected Services)
• Browsing history or URLs you visit in any tab
• Keystrokes, clipboard contents, or screenshots
• Data from any other browser extension
• Precise persistent location (only passed to weather / prayer time APIs per request)
• Information about other apps on your device
• Biometric data

Connected Services (Google, Todoist, Apple)

Rhemn Pro lets you connect Google Calendar, Google Tasks, and Todoist, and — in the Rhemn app for iPhone, iPad, and Mac — Apple Calendar and Reminders. Connecting is always your choice, and you can disconnect at any time. This section explains exactly what Rhemn accesses, what it stores, and what it never does.

In practice, this means that data we receive from Google:

• is used only to provide the Rhemn features you can see and choose to use, described below;
• is never sold, and never used for advertising, including personalized or retargeted advertising;
• is never used to determine credit-worthiness or for lending purposes, and never used to train generalized artificial-intelligence or machine-learning models;
• is transferred to others only when needed to provide those features (for example, the task text Plan my day sends to our AI provider, which does not use it to train its models), to comply with the law, or as part of a merger or acquisition with your consent — and is never transferred to data brokers;
• is never read by people, except with your explicit permission for a specific item (for example, when you ask us for support), when needed for security (such as investigating abuse), to comply with the law, or when the data has been aggregated and anonymized for internal operations.

Google Calendar and Google Tasks

When you connect Google, Rhemn asks for these permissions and uses each one only as described:

Your calendar events are never stored

Rhemn fetches events from the calendars you select, for a window of at most three days, only when Rhemn needs to show them. Event contents are never saved to our database or any disk. To avoid asking Google repeatedly, our servers keep the latest result in memory for up to 3 minutes (and your list of calendar names and colors for up to 10 minutes), then discard it. The Rhemn app on your device may keep a copy of today's events so your day appears instantly; it is removed when you sign out. What we do store is your choice of which calendars to show.

When you use Plan my day with a calendar connected, only the start and end times of your busy periods are used — never event titles, descriptions, attendees, or locations. If you choose to take notes for a meeting, that event's title is used as your note's title and is saved with your note like anything else you write.

What Rhemn writes to your Google Calendar

Only if you turn on "Add prayer times to your calendar": Rhemn creates one secondary calendar named "Rhemn" and, for up to the next 7 days, adds five 20-minute events — one starting at each prayer time, marked as busy — named after the prayer (for example, "Dhuhr"), with the note "Added by Rhemn. Prayer times for [your city]." Rhemn never writes your coordinates, and never creates, changes, or deletes events on any other calendar. Turning the feature off lets you keep those events or remove the Rhemn calendar entirely.

Google Tasks and Todoist: what is stored

Two-way sync needs a copy, so for the task lists (Google Tasks) or projects (Todoist) you choose to link, Rhemn stores on our servers, in your Rhemn account:

• the list or project name;
• each task's text, completion status, due date, and whether it is a sub-task of another task;
• for Todoist, each task's priority;
• the identifiers Google or Todoist uses for those lists and tasks, so changes reach the right item;
• changes waiting to be sent to Google or Todoist (kept only until they are delivered).

Lists and projects you do not link are never copied. Rhemn never deletes a list or project in Google Tasks or Todoist. It deletes an individual task there only when you delete that task in Rhemn.

Todoist

When you connect Todoist, Rhemn requests the data:read_write and data:delete permissions. It uses them to read your project list (so you can choose which to link), to read and update tasks in the projects you link, and to delete a task in Todoist when you delete it in Rhemn. Rhemn also reads your Todoist account ID and email address to identify the connection. What is stored is listed above.

Connection details we keep

For each connected Google or Todoist account we store:

• the account's email address and the provider's account ID;
• the permissions you granted;
• the access and refresh tokens that let Rhemn act on your behalf. These are encrypted at rest with AES-256-GCM, are never sent to your device, and never appear in our logs;
• sync bookkeeping: when the account last synced, a sync position marker, and — if you add prayer times to your calendar — a fingerprint of the last update, used only to avoid sending an identical update twice.

Apple Calendar and Reminders (iPhone, iPad, and Mac app)

In the Rhemn app for iPhone, iPad, and Mac you can let Rhemn use Apple Calendar and Reminders on that device. This data stays on your device and never reaches our servers. Rhemn reads it directly on the device to show your events and reminders, and writes changes back on the device. Syncing between your Apple devices is handled by Apple (iCloud), not by Rhemn. If you use Plan my day, only the start and end times of your busy periods are sent, as described above. You can turn this access off at any time in your device's Settings.

Disconnecting and revoking access

You can disconnect Google or Todoist at any time under Calendars & tasks — in the profile menu on desktop, or in the More tab in the iPhone and iPad app. When you do:

• if Rhemn created a "Rhemn" prayer-times calendar in your Google account, Rhemn deletes it first, so no stale prayer times are left behind;
• Rhemn asks Google or Todoist to revoke its access;
• the stored tokens and connection details are deleted immediately from our database;
• your linked lists either stay in Rhemn as ordinary Rhemn lists or are removed from Rhemn — your choice. Nothing is deleted in Google or Todoist.

If Google or Todoist can't be reached at that moment, your tokens are still deleted from our database right away. The calendar or the access grant may then remain on their side until you remove it, as described below.

You can also revoke Rhemn's access yourself from your Google Account permissions page or from Todoist's settings (Integrations). Rhemn then stops syncing and asks you to reconnect.

Deleting your Rhemn account removes everything described in this section: Rhemn deletes its prayer-times calendar, asks each connected service to revoke its access, and deletes the stored tokens, connection details, and synced tasks along with the rest of your account.

How We Use Your Information

We do not use your information for automated decision-making that produces legal or similarly significant effects.

How We Share Your Information

We share data only as described below. We do not sell or share your data for advertising.

Service Providers

• Google Firebase — authentication infrastructure. Privacy policy →
• Stripe — payment processing. Stripe is PCI-DSS compliant and processes card data under its own privacy and security standards. Privacy policy →
• OpenAI — speech-to-text transcription of voice notes, and the default provider for AI note features (note and voice-note summaries, note structuring, and in-editor AI writing tools). The audio you record, and the note content or transcript you submit to these features, is sent to OpenAI to generate the transcript or result; it is not used to train OpenAI's models. Privacy policy →
• Anthropic — AI Quran features (insights, Ask, tafsir, related verses, and verse reflections), task AI features (Plan my day, voice task capture, and smart task parsing), and AI note features where we have configured Anthropic as the note provider. The relevant text is sent to Anthropic to generate responses; it is not used to train Anthropic's models. Privacy policy →
• OpenWeatherMap — your device's coordinates are sent per weather request. Privacy policy →
• Aladhan — your device's coordinates are sent per prayer-times request. Privacy policy →
• Unsplash — anonymous requests for background photos. Privacy policy →

Services You Connect

If you connect Google Calendar, Google Tasks, or Todoist, Rhemn exchanges data with that service only as you direct — to show your events, sync the lists you link, or add prayer times to your Rhemn calendar. See Connected Services for exactly what is accessed and stored.

Legal Disclosures

We may disclose your information if required to do so by law, subpoena, or other legal process, or if we have a good-faith belief that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers

If Rhemn is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via the email address associated with your account before your information becomes subject to a different privacy policy.

Data Retention

• Account data & user content — retained for the lifetime of your account. Deleted within 30 days of an account-deletion request.
• Server logs (including IP addresses) — automatically purged after 30 days.
• Connected services — tokens and connection details are kept while an account is connected and deleted immediately when you disconnect or delete your Rhemn account. Synced tasks are kept while their list is linked. Calendar events are never stored; our servers hold them in memory for at most 3 minutes.
• Analytics — stored on our own servers only as anonymous, aggregate daily counts (never individual event histories). Not linked to you and not sold.
• Stripe records — Stripe retains transaction records as required by financial regulations (typically 7 years); we retain only subscription status.
• Local extension data — stored in chrome.storage.local on your device and cleared when you uninstall the extension or use the in-app "Delete my data" function.

Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. To exercise any of them, email hello@rhemn.com from the address associated with your account. We will respond within 45 days (or the timeframe required by applicable law).

State-Specific Rights

California Residents (CCPA / CPRA)

This section applies to California residents and supplements the rest of this Policy.

Categories of Personal Information Collected

Your California Rights

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete — request deletion of your personal information, subject to certain exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing — we do not sell or share your data, so this right is not applicable.
• Right to Limit Use of Sensitive Personal Information — we do not process sensitive personal information beyond what is necessary to provide the Service.
• Right to Non-Discrimination — we will not discriminate against you for exercising any of your rights.

To submit a verifiable consumer request, email hello@rhemn.com. We will acknowledge your request within 10 business days and respond within 45 calendar days. We do not charge a fee unless requests are manifestly unfounded or excessive. We will verify your identity by confirming the email address on your account.

You may designate an authorized agent to submit a request on your behalf by providing written authorization.

Shine the Light (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their direct marketing purposes, so no disclosure is required under this statute.

Cookies & Local Storage

As a browser extension, Rhemn does not use traditional browser cookies in your web sessions. Instead, we use:

• chrome.storage.local — stores your todos, notes, preferences, and auth state locally on your device. This data is not accessible to websites you visit.
• localStorage — stores a random analytics identifier (not linked to your identity) and a cached auth token for fallback purposes. Cleared when you uninstall the extension.
• Firebase session cookies — managed by Firebase Authentication within the extension context only; not set on third-party websites.

We do not use tracking pixels, third-party advertising cookies, or cross-site tracking technologies.

Our public website (rhemn.com) uses privacy-friendly Google Analytics to count visits. In the EU/EEA and UK this is loaded only after you accept it via the cookie banner; analytics cookies are not set if you decline.

Data Security

We implement reasonable technical and organizational safeguards to protect your information, including:

• HTTPS encryption for all data in transit between the extension and our servers
• Firebase Authentication tokens verified server-side on every API request
• Access tokens for connected services (Google, Todoist) encrypted at rest with AES-256-GCM and never sent to your device
• Database access restricted to authenticated backend processes
• Stripe's PCI-DSS compliant infrastructure for payment data

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last updated" date at the top of this page
• Sending an email to the address associated with your account for material changes
• Displaying a notice in the extension for significant changes

Your continued use of the Service after the effective date of any changes constitutes acceptance of the revised Policy. If you disagree with any changes, please stop using the Service and contact us to delete your account.

Contact Us

For privacy-related questions, requests, or complaints:

Rhemn is an independent product. This privacy policy does not constitute legal advice. If you have questions about your specific legal rights, please consult a qualified attorney in your jurisdiction.