Privacy

Last updated 8 October 2026

Kahf is an app for chat, meetings, and communities. This page explains exactly what we collect, why we collect it, and what happens to it. It's written to be read — not to be skimmed past.

It applies to the Kahf app at app.kahf.online and to the Kahf mobile apps.

1. What we ask for

Our approach is to ask for as little as possible. Here is the complete list of what you give us when you create an account:

What we never ask for

We do not ask for your legal name, date of birth, home address, location, or payment details. We never read your device's contacts or photo library, and we never look through the files on your phone or computer — Kahf only receives the photos and files you choose to send. What you send in Kahf is checked automatically for safety, on Kahf's own servers (see Safety checks).

2. What we don't do

• We do not sell, rent, or trade your personal data. Not to anyone, not for any price.
• We do not share your data with advertisers, data brokers, or marketing companies.
• We run no third-party analytics, ad networks, or tracking pixels in the app.
• We do not build a profile of you or use your activity to target anything at you.
• We do not use your messages to train AI models.

Statistics that aren't about you. We may use information that can no longer be connected to anyone — for example how many messages are sent in a day, or which features are used — to understand and improve Kahf. It is never used to identify you, and never given to anyone else.

Your data leaves our systems in only these situations:

• Service providers we need to run Kahf — the company that hosts our servers, the service that sends our emails (such as password resets), and Apple, Google and your browser's push service, which deliver notifications to your device. They process data only on our instructions, only to deliver the service, and are not permitted to use it for anything else.
• Links you send. When a message contains a link, our server fetches the page's title and picture from that website to show a preview. The website sees a request from Kahf's server — not from you or your device.
• A valid legal order that we are required to comply with. See Legal requests below.
• Child safety. United States law requires us to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). We will always do so.

3. Your messages and calls

Messages. Your messages and group content are stored on our servers so that they sync across your devices and are still there when you come back. They are stored for you, not for us. Except that a parent admin Kahf assigns to an under-18 account sees who that account chats, calls and meets with (name, gender, age group) and when. Never what is said (see Parent admins).

Calls. Voice and video calls are relayed through our servers so they connect reliably. We do not record, store, or transcribe calls. Once a call ends, nothing of its content remains.

Meeting avatars and face data. In a meeting you can show an avatar: a drawn figure that turns its head, blinks and smiles when you do. It is off until you turn it on in the meeting. While it is on, your phone or iPad looks at your face through its front camera (on iPhone and iPad this is Apple's ARKit face tracking) and works out eight numbers: how far your head is turned, nodded and tilted, how open your mouth is, each eye's blink, your smile and your eyebrows. Only those numbers, with the avatar look you picked, are sent through our servers to the others in that meeting, so your avatar moves. The camera picture, any image of your face, depth data and face geometry never leave your device and are never stored. The numbers are used only live, to move your avatar in that meeting: they are not stored, not used to recognise or identify you, and not shared with anyone outside the meeting. On a computer, the browser does the same on the computer itself. Kahf keeps a short technical note when an avatar starts, pauses or fails (with the device model and system version) to fix problems, and the avatar look you build is saved on your account. One-to-one video calls are a separate feature, where you choose to send your camera video to the person you are calling.

Nobody at Kahf reads your conversations. Our staff cannot browse your chats. Access to stored message data is restricted, logged, and permitted only where it is strictly necessary — for example, investigating a specific abuse report or block, or a security incident.

Deleting a message takes it away for everyone in the conversation, straight away. A copy may stay on our servers, where it is never shown to anyone, for safety reviews and for statistics that aren't about you.

Flagged and reported content stays inside Kahf. A photo, video, file or message that a member reports, or that they blocked someone from — or that our own safety checks flag — is reviewed only by Kahf's safety team, on Kahf's own systems. It is never sent to outside companies for review. The one exception is child sexual abuse material, which the law requires us to report (see above). A parent admin sees only that a message in their child's group was flagged: who, where and when, never the words.

Safety checks. Photos, videos, profile, group and community pictures, the pictures in link previews, PDFs and the pictures inside Word, PowerPoint and Excel files you send are checked automatically for sexual or violent content, by software Kahf runs on its own servers. Nothing is sent to another company, and the check never blocks or delays what you send — the one exception is material already confirmed as child sexual abuse, which is removed at once. For every file we keep only the check's scores (numbers, not the picture). When the check flags a file, a copy is kept in a restricted area that only Kahf's safety team can open; every time one of them looks at it is recorded, and they decide whether to remove it or blur it for everyone. Flagged copies, with the team's decision, are kept to review those decisions and to make the check more accurate. When something is flagged, Kahf also keeps the IP address it was sent from, with the flag, for safety review and for legal reports.

4. Age, and keeping adults and under-18s apart

You must be 13 or older

Kahf is not for children under 13. When you sign up we ask which age group you're in — under 13, 13 to 17, or 18 and over. If you choose under 13, no account is created.

If we find out that an account belongs to a child under 13, we delete the account and everything associated with it. If you're a parent or guardian and believe your child under 13 has an account, tell us at the address in Contact us and we'll remove it.

Adults and under-18s

Your age group is never shown to other members (Kahf's admins can see it, and so can a parent admin Kahf assigns, for the people their own child is in touch with) and cannot be changed later. It keeps adults and under-18s apart and shows a parent admin who their child is in touch with.

Adults and under-18s are kept in separate spaces. An adult cannot start a direct conversation with a minor, and minors do not appear to adults in search, suggestions, or member discovery, except a parent admin, who sees the people their own child chats, calls and meets with, and their child's groups' members. This separation is enforced by the system, not left to users to manage.

We also don't give minors a way to be found by strangers: the optional phone-number lookup only ever returns an exact match, and there is no public directory of users.

Ghost mode isn't available under 18 (see Ghost mode).

The declaration at sign-up

Members aged 13 to 17 read and tick a short declaration when they create their account: that they are at least 13, that a parent or guardian knows they use Kahf, and what they will and will not share.

If you're a parent or guardian

You can ask us what information we hold about your child, ask us to correct it, or ask us to delete the account entirely. Write to us at the address in Contact us and we will act on it. Kahf can also make a parent with a Kahf account a view-only parent admin: who their child is in touch with, never the messages.

Parent admins

A parent admin is a parent or guardian with their own Kahf account whom Kahf's admins have linked to their child's under-18 account. Only Kahf's admins can make or remove the link, and only for the accounts they name. The parent must have picked 18 and over and the child 13 to 17; both are checked again every time the parent looks. It is view-only: a parent admin cannot open a chat, send, call, change or remove anything through it.

Contact with under-18s is visible to Kahf's admins and to a parent admin Kahf assigns. A parent admin sees who their child is in touch with, where and when:

• the people their child has personal chats with, when each chat started and when it was last active;
• their child's one-to-one calls, group calls and meetings of the last 15 days: when, how long, answered or missed, and who else was there at the same time;
• their child's chat groups, meeting groups and community groups, with each group's members and admins;
• in their child's community groups, the language filter's alerts (who, where and when) and the admins' log of the last 15 days.

Video calls. If video is turned on in a one-to-one call with an under-18 account — by them or by the other person — that account's parent admin gets a notification that says only "Video call alert in parent portal". The alert in the parent portal says who the call was with and when, and the call is marked as a video call. The parent admin can turn these alerts off for those two people. Kahf keeps a note that video was turned on in that call, never the video itself.

Everyone listed is shown by name, gender and age group only. A parent admin never sees what is said: no message text, voice notes, photos, files, or call audio or video, and no email addresses, phone numbers, profile photos, group codes, reports or blocks. A parent admin also joins, as an ordinary member, the communities their child is in. Every link and removal is recorded for Kahf's admins.

Reporting a problem

If you believe a minor is being contacted inappropriately, report it to us immediately. We treat these reports as urgent.

5. Security and technical data

To keep accounts safe and the service running, our servers record a small amount of technical information:

• IP address and timestamp when you sign in
• Device and browser type
• Failed sign-in attempts
• Error and crash information
• Abuse and safety reports submitted by users

This is used only to protect accounts, prevent abuse, and fix problems. It is never used to profile you, and never shared for advertising or analytics.

6. Cookies and storage

Kahf uses only what it needs in order to work:

• A session token so you stay signed in
• Local storage on your device for your settings and cached messages, so the app loads quickly and works offline. Cached messages, pictures and files are cleared when you sign out, and on the phone when you switch into or out of Ghost mode.

There are no advertising cookies, no third-party cookies, and no tracking pixels. There's no cookie banner because there is nothing optional to consent to. Clearing your browser storage signs you out and clears the cache; nothing else is lost.

7. How long we keep things

• Account details — for as long as your account exists.
• Messages, photos, files and group content — kept on our servers. Deleting a message hides it from everyone; when you delete your account, what you sent stays without your name (see below).
• Security and sign-in logs — 30 days, then automatically deleted.
• Backups — rotated and purged within 30 days.
• Abuse reports and flagged content — kept as long as needed to act on them, to prevent repeat harm, and to make our safety checks more accurate. Child sexual abuse material is kept, securely and separately, only for as long as the law requires (one year from our report to NCMEC). The IP address a flagged file was sent from is kept with the flag. It is deleted if the flag turns out to be a mistake, when you delete your account (unless the law requires us to keep it), and — for child sexual abuse material — when that year ends.

When you delete your account, we remove your name, email address, phone number (if you gave one), profile photo and avatar, your password and every sign-in, your notification registrations, and your memberships in chats, groups and communities. You are signed out everywhere at once. Deleting your account also deletes your Ghost mode profile and PIN. If you forget your PIN, you can still ask us by email to delete the account. In Ghost mode, Delete account on the stand-in deletes only the stand-in: to delete your own account, come back with your PIN first, or email us.

What stays, without you. Messages, photos and files you sent stay on our servers, shown as from "Deleted account" and no longer connected to your name, email or phone number — the same way a letter you sent stays with the person who received it. We may keep them, and use them for statistics that aren't about anyone, to understand and improve Kahf. A short record that the account was deleted (including the old name and email) is kept for 15 days in case of abuse, then deleted. Flagged files you sent lose your name and email too, and one our safety team marked a mistake is deleted from the safety records; material reported as child sexual abuse is kept, with who sent it, for the year the law requires.

8. Your choices

• See your data. Ask us for a copy of everything we hold about you.
• Correct it. You can change your display name, email, and phone number in the app at any time. Your age bracket and gender are fixed at sign-up — if either is wrong, contact us.
• Remove your phone number. Clear it in your settings and it stops being used for lookup immediately.
• Delete your account. Available in the app, from the Profile tab, or by email — see how to delete your account. It removes your personal details as described above.
• Object or complain. Write to us and we will respond. If you are in a country with a data protection authority, you also have the right to complain to them.

We'll respond to any of these requests within 30 days, and we don't charge for them.

Ghost mode (18 and over)

Members 18 and over can turn on Ghost mode in the phone app. It takes your account off that phone for a while: the phone is cleared and switches to a stand-in profile, a second, ordinary adult profile with a made-up everyday name, a picture (never a face) and an email address on Kahf's own domain that receives no mail. Every rule for adult members applies to it, exactly as to any other adult account: its chats, calls, reports and blocks are its own. Your own account stays as it is for everyone else, just signed out everywhere. Kahf keeps the stand-in for next time, and Kahf's safety team can see which account it belongs to.

You come back with a 4-digit PIN you choose. Kahf keeps the PIN only as a keyed, one-way hash: we can't read it, look it up, send it to you or reset it, and it is never saved on your phone or in your browser. After 5 wrong PINs, tries pause for an hour, then longer, up to 24 hours; wrong PINs never delete anything. If you forget your password, you can reset it by email as usual, but you still need your PIN to sign in. If you forget your PIN, you can't get back into your account. Ghost mode isn't available under 18.

What Ghost mode can't do — the limits to know before you turn it on — is on the help page.

9. How we protect your data

• All traffic between your device and Kahf is encrypted in transit with TLS.
• Passwords are hashed using a modern algorithm. They are never stored in plain text and cannot be recovered — only reset.
• Access to production systems is limited to the people who need it, and is logged.
• Stored data is encrypted at rest.

No system is perfectly secure. If a breach ever affects your data, we will tell you directly and promptly, along with what happened and what to do about it.

10. Legal requests

We disclose user data to authorities only where we are legally required to. When we receive a request, we check that it is valid and properly issued, we push back on requests that are overly broad, and we give only what we are legally obliged to give. Where the law permits, we will notify you before responding.

11. Changes to this policy

If we change this policy we'll post the new version here with an updated date. For any change that meaningfully affects your privacy, we'll tell you in the app before it takes effect — we won't quietly revise the page and hope you don't notice.

12. Contact us

Questions about your privacy, requests about your data, or reports about a minor's safety:

privacy@app.kahf.online

We read every message sent to that address.