Lucentay Privacy Policy

Last updated: 14 October 2026 Effective date: 14 October 2026

1. Who we are

Lucentay ("we," "us," "our"), operated by Lucentay Inc. (Corporation No. 1817129-7), a corporation incorporated under the Canada Business Corporations Act (federal), operates the Lucentay mobile app, a halal matrimonial platform. This Privacy Policy explains what personal information we collect, why, how we use and protect it, and the choices available to you. It is intended to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Lucentay is not yet available in the Province of Quebec.

2. Information we collect

Account information: email address, phone number (optional), and a Firebase-issued authentication identifier. We do not store your password; authentication is handled by Firebase.

Profile information, all of which you provide directly: first and last name, date of birth, gender, city, province/state, country, marital status, whether you have children, whether you want children, your intended marriage timeline, and willingness to relocate.

Religious information, which is sensitive personal information and is treated with particular care: your madhab (school of Islamic jurisprudence), prayer frequency, hijab status (for women), whether you are a revert to Islam and the year of your reversion, and your self-assessed Qur'an and Arabic proficiency levels. Because this information is sensitive, we ask for your express consent before collecting it: you give it by ticking the consent box when you create your profile. You can withdraw it at any time by deleting your account (see Section 5).

Background information: ethnicity, languages spoken, education level, profession, and income range (income range is optional and coarse-grained, not an exact figure).

About you: a free-text biography, what you are looking for in a spouse, and any dealbreakers you choose to share.

Photos: up to six profile photos, stored with a third-party image hosting provider (Cloudinary). You control whether your primary photo is visible only to your matches or more broadly within the app's Discover feature, via the "photos public" setting in your profile.

Verification data: if you choose Imam Verification, we collect the name, email address, and mosque affiliation of a religious leader you name, and use this to send them a verification request by email. Identity verification through Stripe Identity is planned but not yet available in the app. Before we turn it on, we will update this Policy to explain exactly what it collects.

Guardian (wali) information: if you choose to add a guardian, we collect that person's name, email address, phone number, and their relationship to you. This is personal information about someone who may not be a Lucentay user. See Section 8 for how we handle this.

Messages: the content of messages you send to your matches, timestamps, and read status. Message content is scanned automatically by simple pattern-matching to detect phrases suggesting an in-person meeting request, or the presence of an actual phone number, email address, or social media handle, in order to show you an in-app safety reminder. After a message is sent, its text is also sent to our AI provider, Anthropic, for an automatic safety review that looks for signs of pressure or manipulation. This review never blocks or delays a message. If a message is flagged, our moderators can see that message and the reason for the flag. Apart from flagged messages, message content is not reviewed by staff, except when a report is filed or as needed to investigate abuse.

AI compatibility notes: to write the short compatibility explanation shown between two profiles, we send a limited set of profile details for both people to Anthropic: city, province, madhab, prayer frequency, marital status, whether you want children, marriage timeline, willingness to relocate, education level, and languages. We do not send names, photos, or contact details for this purpose. The finished note is saved so it does not have to be written again. Under Anthropic's commercial terms, information we send is not used to train its AI models.

Usage and device information: log data such as IP address, general error and request logs, and, if you enable notifications, a device push-notification token used solely to deliver notifications to your device.

Payment information: if and when Lucentay's paid tier becomes available with real payments, billing will be handled by Stripe. Lucentay will not store your full card number; Stripe provides a token or customer ID that we use to process payments.

3. Why we collect this information

We use your information to: operate the matching and Discover features; enable messaging between matches; support the guardian and Imam Verification features you opt into; respond to safety reports; write short compatibility explanations between profiles and run an automatic safety review of messages (both using an AI service, see Section 4); send you service-related notifications (matches, messages, verification results); and improve the Service.

We do not use your religious information, or any other information you provide, to build advertising profiles, and we do not sell or rent personal information to third parties.

4. Who we share information with

Your matches: your profile information (subject to your photo-visibility setting), and any messages you send them.

Guardians (walis) in the Guardian View. A sister on Lucentay can name a guardian. That guardian can open the app's Guardian View, but only after creating their own Lucentay account with the exact email address she gave us and verifying it. In the Guardian View, the guardian sees:

• her first name and his relationship to her; and
• for each of her active matches: the match's first name, city, madhab, education level, verification badges, biography, what they are looking for, and which week of the 30-day journey the match is in.

This means that if you match with someone who has named a guardian, that guardian can see the profile details listed above about you. The guardian does not see your last name, photos, contact details, or messages. Guardian involvement is a core part of how Lucentay works, so by using the Service you agree to this sharing. If you do not want it, you can end a match at any time; once a match ends, it no longer appears in the Guardian View.

Your named guardian, if you add one: receives an email telling them that you named them as your guardian, with your first name and their relationship to you.

Your named imam, if you request verification: contacted by email with a request to confirm your standing in your local mosque community, and shown your name and mosque information in that request.

Service providers who process data on our behalf, currently: Firebase (authentication), Supabase (database hosting), Cloudinary (photo storage), Resend (transactional email delivery), Railway (application hosting), Anthropic (AI compatibility notes and automatic message safety review), Expo (push notification delivery), and, once those features launch, Stripe (identity verification and payments). These providers may only use your information to provide their service to us.

Storage outside Canada. Several of these providers are based in the United States, and your personal information may be stored and processed in the United States or other countries. While it is there, it is protected by our agreements with those providers, but it is also subject to the laws of those countries, and may be accessed by their courts, law enforcement, and national security authorities under those laws.

Law enforcement or legal process, where required by law, or to protect the safety of a user or the public.

We do not sell your personal information.

5. Your choices and rights

Under PIPEDA, you have the right to access the personal information we hold about you, to correct inaccurate information, and to withdraw consent (which may limit your ability to use parts of the Service). You may:

• Edit most profile information at any time through Edit Profile.
• Control whether your primary photo is visible to non-matches via the photo privacy setting.
• Delete your account at any time from within the app (Home screen, "Delete account"). See Section 6 for what is deleted.
• Request a copy of, or the correction or deletion of, your personal information by contacting us at lucentayinc@gmail.com.

We respond to access, correction, or deletion requests within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

6. Data retention

We keep personal information only as long as we need it for the purposes in this Policy.

• While your account exists: we keep your account and profile information so the Service can work.
• Ended matches: an ended match and its messages stay visible to both people for 7 days. After that they are no longer shown in the app, but are kept until either person deletes their account, so that we can investigate any later safety report about that conversation.
• When you delete your account: we immediately and permanently delete your account, profile, photos (including from Cloudinary), matches and their messages, guardian and imam records, swipes, notification tokens, and your login. Deleting your account also deletes the conversations you had with your matches, for both people.
• Safety reports: reports you made, or that were made about you, are kept after you delete your account, as long as reasonably needed for safety and legal purposes, but without a link to your account. For reports made about you, we also keep the email address you used, so that a moderator can still act on the report.
• Banned accounts: the email address of a permanently banned account is kept so it cannot be used to create a new account.
• Backups and logs: deleted information may remain in our providers' encrypted backups and server logs for a short time, generally no more than 90 days, until it is overwritten.

7. Security

We take reasonable steps to protect your information, including encrypted connections (HTTPS) between the app and our servers, authentication tokens verified on our server, and role-based access controls limiting who can view moderation and admin data. No system is completely secure, and we cannot guarantee absolute security.

If there is a data breach: if a breach of security involving your personal information creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires. We keep a record of every breach of security safeguards, whatever its size, for at least 24 months.

8. People who are not Lucentay users

You can name a guardian or an imam who has not created a Lucentay account. When you do, you confirm that you have that person's permission to give us their name and contact information for this purpose. We use their information only to contact them about the role you named them for:

• a guardian receives an email invitation. They only see your matches if they choose to create their own Lucentay account with that email address, and by doing so they agree to this Policy themselves;
• an imam receives a single verification request by email.

A guardian or imam can ask us at any time to delete their information by writing to lucentayinc@gmail.com. We will delete it and tell you that the guardian or imam was removed.

9. Privacy Officer

Anas Faour is Lucentay's Privacy Officer and is accountable for our compliance with this Policy and with PIPEDA. Contact: lucentayinc@gmail.com.

10. Children's privacy

Lucentay is not intended for anyone under 18, and we do not knowingly collect information from anyone under that age. If we learn that a user is under 18, we will delete their account.

11. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes by email or in-app notice before they take effect, and will update the "last updated" date above. If a change would use your information for a new purpose, we will ask for your consent first.

12. Contact us

Questions about this Privacy Policy, or requests to access, correct, or delete your information, can be sent to lucentayinc@gmail.com.