Privacy Policy

Last updated: October 23, 2026

Istighfar.club is built privacy-first. This page describes everything the extension and website do with data. It is intentionally short, because we collect almost nothing.

What the extension never does

The extension never reads, stores, or transmits your browsing history, page content, URLs, keystrokes, or anything about the sites you visit. Reminder timing is computed entirely on your device. The extension requests only storage (to save your preferences and counts on your device), alarms (to schedule reminders), and activeTab (to read the current site’s name only when you use the pause-on-this-site button). It loads no remote code.

Activation and your email

Istighfar.club is free. Your first ten counts need nothing; to keep counting after that you verify an email address: we send a one-time 6-digit code, and entering it activates the browser. The extension contacts our own server at istighfar.club and nowhere else: to email the code, to activate the browser, once a day to re-check that the activation is still valid, and to back up your daily totals. That backup runs with the daily check, and in between at most once every six hours · and only when your totals have actually changed, so a day you count nothing sends nothing. No page content, URLs, or browsing data are ever sent.

Why the totals are backed up: so they survive. Before this they existed only in one browser, and a reinstall or a new computer took every count and the whole streak with it. The backup is one number per day · how many times you counted · and nothing about when, where, or on which site. From version 0.9.24 it also says which version of the extension sent it, so we can see which releases are in use. From version 0.9.26 it also carries your reminder settings (Reflection or Tasbih, how often, whether quiet hours are on, whether reminders are paused) and, once, when the card said “Still here. One tap counts.”, so we can see which settings people stop counting with and whether that line helps. From version 0.9.27 it also carries when the extension asked you for a store review and whether you chose “Leave a review” or “Not now”, so it never asks more than twice. It also lets a second browser pick up the same history once you activate it there. This only ever happens on a browser you have activated; without that, the extension sends nothing at all.

What we store: your email address, an opaque identifier for each activated browser, and an approximate location, being the country and city our hosting provider derives from the network connection of that request. We never store your IP address, and we never ask your browser for GPS or precise location. We use this to know how many people use Istighfar.club and roughly where, to send you your verification code, and to send you a short note when your lifetime count passes a milestone, the 21-day challenge’s morning notes if you ask for them, and once a request for a store review (below). We do not sell it, and we do not send marketing.

If you give your email in the 21-day challenge. We keep the address you give, the number you chose, the day you started, your time zone and the link or ad you came from, and the counts you make on that page, even before you confirm it. Before you confirm, you get at most two emails: the day’s reading, straight away, and one reminder the next morning. Both buttons in them confirm the address and sign you in on that browser. If you don’t confirm within 30 days, we delete the sign-up. Once you confirm, it becomes your account like any other, and the morning notes below begin.

Write to mohdsami038@gmail.com at any time to see everything held against your email. Deleting it needs no email at all · there is a button on your dashboard, described below.

The email we send you

Besides your verification code, there is a short note when your lifetime count passes 1,000, then 5,000, 10,000, 25,000, 50,000 and 100,000. Six in a lifetime at most, and most people will see two or three. Each one is the ayah of forgiveness that milestone unlocks, and nothing else.

And if you join the 21-day Istighfar challenge, by signing up with your email or while signed in and asking for it, a short note each morning of those 21 days, and one when it ends. For that we keep the challenge’s start date, your daily number and your time zone with your account, so the same challenge shows on your phone and laptop and the note arrives on your morning. Leaving the challenge, or Delete my data, removes it.

Once, we may ask whether you would like to leave a review on the Chrome Web Store. It is a single email, and you can ignore it or unsubscribe.

Once, if you added the extension a week or more ago and nothing was counted in the last 7 days, Sami, who built Istighfar.club, may write to you himself, with no tracking pixel, to ask what got in the way. Your reply goes to him. Replying “stop” stops every email from us.

None of this is marketing: they sell nothing and concern only your own record, apart from a link to add our own free Chrome extension if you haven’t, and that one request for a review. If you would rather not have them, every one carries a link that stops them in one click, with no sign-in and no questions · and your counts, streak and account are untouched by stopping them.

For each email we send, any of the above or a sign-in code, we keep a short record of the address, which kind of email it was and when, so we can see what went out and answer “did my email arrive?”. Never its contents. The record is deleted after 30 days, or with Delete my data.

Data stored on your device

Your preferences (mode, goal, reminder interval, bubble position) and your daily Istighfar counts are stored locally in your browser. So is a 21-day challenge you start without an email (its start date and number), and the link or ad you came by, for 30 days. They never leave your device unless you sign in, or give your email in the challenge, as described above. Starting the challenge is counted on our side as one start, with the link or ad you came by and nothing else. The extension also keeps whether your last 20 reminders of each kind were counted or let pass, which sets how often a road sign comes in place of the usual reminder, and how many in a row went unanswered today, which spaces reminders out until your next count. That never leaves your device.

If you choose to back up

Backing up your counts is optional, and it uses the same verified email you activated with. There is no second account and no other login: if the extension is installed, the dashboard recognises you automatically. When you back up we store your daily count per date, your goal at the time, that email address, and when you last backed up (and when the extension last did, so we can count how many extensions are in use each day). That is the complete list. It lives in a MongoDB Atlas database and is used for nothing except showing you your own progress and those daily counts.

Aggregate totals

When someone backs up, we add the change in their count to two running totals: a single global number, and a tally per country. The country code comes from the network request at that moment and is never stored alongside your account or as an IP address. These totals are numbers only. They let us show a community counter and understand where the project is being used. If you never back up, you are never part of these totals.

Partner pages, where a creator hosts a round of the 21-day challenge, show community totals only, and nothing at all until five people have joined. The partner sees totals too, never your name, your email or your own count.

If you uninstall

Removing the extension opens one page on this site. That page exists mostly to tell you something: uninstalling does not delete your backed-up counts, and if you want them gone you have to say so. From version 0.9.16 its address carries a little about the browser it came from: the extension’s version, how many days you had it, how many you counted on it, and whether you had verified. If you had verified, it also carries a random token that can match a note to your account and can do nothing else. None of it is stored unless you send a note, and our page-view counting records the page without it. We do add one to that day’s count of uninstalls, so we can see how many people leave; the count is a number per day and holds nothing about you or your browser.

It offers four reasons to tap and an optional box. If you tap one or write something, we store the reason or the text, the date and the details above, and if you had verified, your email, so we can reply. The page says so under the reasons. Notes that carry your email are deleted with the rest of your data when you press Delete my data. Every note is deleted automatically after six months. Notes from versions before 0.9.16 carry nothing but the text and the date.

If you send a note

“Send a note”, at the foot of this site and in the extension’s popup, opens a page with a box. We keep what you write, the date, whether it came from the website or the extension (and the extension’s version), and your email only if you type it there for a reply. Nothing else, and it is deleted after six months, or sooner with Delete my data if it carries your email. The page has no advertising pixel.

Website analytics, Google Analytics and the Meta pixel

The extension carries no analytics library and reports to no third party. It talks to one server, ours, for the two things described above: keeping your activation valid and backing up your daily totals, and once more, when it is added, to ask whether it came from the link in one of our emails (below). It does not watch what you do, follow you between websites, or build a profile of you. Our emails carry no tracking pixel, and the only counted link in them is the one we send to people who ask for it on our Facebook or Instagram form.

This website uses Vercel Analytics to count page views so we know whether the project is reaching anyone; it sets no cookies. Some links we share in posts or adverts (istighfar.club/go/…) count how many times they were opened, in total and per day, so we know which places bring people · nothing about who opened them is kept. Link previews and Meta’s ad checkers are counted apart. Opening one also sets a small cookie on this site, ic_src, holding only that link’s name (the same for everyone who opened it), for 30 days, so what you then do here is credited to the link: starting the challenge, giving your email, making an account. It is never sent to anyone else. The install link in Sami’s letters does the same, with the letter’s name (founder-a, for one) in place of a link’s, and so does one of our Google ads, with the ad’s campaign name (google-search, for one).

With analytics cookies allowed, we also count visits ourselves: one a day per browser, with the link or ad that brought you, or the kind of site you came from (a search engine or a social app, by name, never its address). Your browser keeps the date of its last counted visit so a second page is not a second visit. We keep the numbers per day and nothing else: not the page, not your address, nothing about who you are.

This website also uses the Meta pixel, to measure and improve our ads on Instagram and Facebook. When it is on, your browser tells Meta which pages you visit on this site and a few things you do here: opening the 21-day challenge or the install page, starting the challenge, pressing Add to Chrome, giving your email and confirming it, each with the name of the link or ad you came by. Like any request, these carry your IP address and details of your browser and device, and Meta sets its own cookie on this site to recognise your browser on later visits. Meta may connect this to a Facebook or Instagram account you have, under its own privacy policy. It never receives your email address, your counts, your daily number or anything you read here.

With advertising cookies on, we also keep Meta’s two cookies from this site (_fbp and _fbc) and your browser’s description of itself (its user agent) with your challenge sign-up, your account or your request for the link. When you give your email, when your account is made, and the first time you switch the extension on, our server tells Meta through its Conversions API, with those cookies, the user agent, the page and the name of the link or ad you came by. That is how Meta learns which ads bring people who actually use it. From us it never receives your email address, your IP address or your counts. With advertising cookies off we keep none of this and send nothing.

If you ask for the link on one of our forms on Facebook or Instagram, Meta passes us what you entered there: your email, your name and your answers. We keep them with your request (and, for 90 days, the form entry’s number and whether we could read it, so none is lost), and email you a link of your own to the extension (istighfar.club/l/…). Opening it is noted with your request, when and whether on a computer or a phone (from what your browser says of itself, never your IP address), and it goes on to the Chrome Web Store. If you said you use only a phone, that email goes at once. If you said you use Chrome on a laptop, a short note goes at once and the link at 10:00 on your next working day, when you are more likely to be at it. For that we keep a time zone with your request: your country’s, when we know your country, or else a guess from the form. The note’s “Remind me on my laptop” button gives you a 10-minute event with your link for your own calendar (we never see your calendar); opening it is noted, and when it is opened on a phone, the time zone our hosting provider gives for that request becomes the one we keep, and the link email moves to 10:00 there. Then, until you open the link or add the extension, we send short reminders, three emails in all, and none once you press stop in any of them. Your address and first name are also kept as a contact with Resend, the service that sends our email, in one of two lists, laptop or phone, by your answer. If you reply, we keep the first words of your reply with your request; replying “laptop” moves you to the laptop list and sends you the link.

If you said you use Chrome on a laptop and have still not added the extension after those, Sami may write to you himself, with no tracking pixel, and once more three days later only if you have not added it or replied. We keep when each went and the first words of any reply. Replying “stop” stops every email from us; replying “remind me” sends the link once more two days later, and nothing after it; anything else you write goes to Sami.

If you press “Send me the laptop link” on this website on a phone, the same happens with your email address: the note at once, the link of your own at 10:00 on your next working day in the time zone our hosting provider gives for your request, a reminder while it is not opened, and the laptop list at Resend. No name or answers are asked for, and none of it is sent to Meta as a form lead.

On a computer, where your advertising cookie choice allows it (in the UK and the EEA once you have accepted it, elsewhere unless you have turned it off), that link also leaves a cookie on this site, ic_l, holding the link’s code, for 30 days. When the extension is added in that browser it asks this site once whether the cookie is there; that is how we know the link worked, and the cookie is then removed. Otherwise we only know when you sign in to the extension with the same address. If you then make an account or switch the extension on, our server tells Meta, with the form’s lead number and your email address in hashed form (Meta has it already, from the form), so Meta can see which forms bring people who use it.

This website also uses Google Analytics, to see how people find it and move through it. When it is on, your browser tells Google which pages you visit here and the same few steps in the 21-day challenge, each with the name of the link or ad you came by. Google works out a rough location (country and city) and your browser and device from the request, and says it does not store your IP address. It sets its own cookies on this site (named _ga) to recognise your browser on later visits. It never receives your email address, your counts, your daily number or anything you read here.

Google Ads measures our own ads, through the same Google tag. When advertising cookies are on, your browser tells Google which pages you visit here and when you press Add to Chrome, so we can see which of our ads bring people who install the extension. It sets its own cookies on this site (named _gcl_au and similar) and never receives your email address or anything from your account. If you arrive from an ad, its name (utm_source, utm_medium and utm_campaign) and Google’s click code (gclid) are kept in your browser for that visit only, and the name is added to the Chrome Web Store link, so the store’s own statistics can tell which ad an install came from. We send them nowhere else.

The cookie banner groups them by what they are for: analytics cookies are Google Analytics, advertising cookies are the Meta pixel and Google Ads. Accept all turns both on, Necessary only leaves both off, and Manage lets you choose each. In the UK and the EEA each loads only once you have accepted it. Elsewhere both are on unless you turn them off. You can change your choice at any time with Cookie settings, at the foot of the home page and the challenge, or here: Cookie settings. You can also limit how Meta uses the pixel in your Facebook or Instagram ad settings. None of them is ever on the admin pages or on the pages whose address carries a sign-in or leaving token, and none is in the extension or in any email. There are no ads on this site, and we never sell data.

Cookies

This site sets one cookie of its own that identifies you: a signed token that says which email address you verified, so the dashboard recognises you without asking again. It holds no identifier beyond that address, it is not read by anyone else, and it is what the law calls strictly necessary · a cookie without which the thing you asked for cannot work.

Two more hold no identifier at all: ic_src, the name of the link or ad you came by, for 30 days (above), and ic_ads, whether advertising cookies are on, so our server keeps to your choice. One more, ic_l, is set only by the link in the emails to people who asked on our form (above), holds that link’s code, and goes when the extension has read it.

When the Meta pixel, Google Analytics or Google Ads is on, Meta and Google also set cookies on this site, as described above. That is why visitors from the UK and the EEA see a small banner before they load, and why everyone can turn either off with Cookie settings. Turning one off removes its cookies from this site. Your choice is kept in your browser.

Terms

What is promised, what is expected, and how to leave is set out on the terms page.

Deleting your data

Cloud data: open your dashboard and press Delete my data. It removes your membership and every activated browser, every day of counts, your lifetime total, and any unused verification code, immediately and for good. Nothing is kept and nothing needs to be asked for. The shared counter on the home page keeps its total, because it is a sum with no names in it and your part cannot be subtracted without keeping exactly the record you just destroyed.

Local data: remove the extension, or clear it from the extension’s options. Or simply never sign in, and no cloud data will ever exist.

Contact

Questions: mohdsami038@gmail.com