Privacy and the law

What we keep

• Your account: your email address and a scrambled form of your password (we cannot read your password).
• Emailed links: to confirm your address or reset your password we email you a one-time link. We keep only a scrambled copy of it, and it stops working once used, or after 72 hours (confirming) or one hour (resetting). We use your email address only for these messages, never for advertising.
• Your settings: which apps you block, your own allowed and blocked sites, and SafeSearch.
• Your home connection, only if you link it: its internet (IP) address, so your router is recognised.
• Recent lookups (which websites your devices asked for, and whether they were blocked): kept for 24 hours, then deleted. This is what the Recent activity list on your dashboard shows.
• Report counts: per profile and day, how many lookups there were, how many were blocked (and at what hour), and how often each blocked site was asked for. Kept for 5 weeks, for your reports. Allowed sites are only counted, never listed.
• Devices with the Kafayah app: the name you see on the dashboard, whether protection is on, and when it last checked in, so you can be alerted if it is switched off.
• Sites you report as blocked by mistake, and the Kafayah team's answer.
• Your plan and payments: when your trial and paid time end, and for each payment the plan, the amount, how you paid and the transaction ID you typed, so it can be matched to the money received. Kept with your account, as payment records.

What we never do

• We never see your screen. To close YouTube Shorts and Instagram Reels, the Android app and the Windows program look only at which screen or page address is open, on the device itself; nothing is sent.
• We do not sell or share your data, and we do not show ads.
• We do not see the pages you read, your messages or your passwords: only the names of the websites asked for.

Who can see your activity

Only you, when signed in to your dashboard. Kafayah may have to share information when Pakistani law requires it (for example a lawful request under the Prevention of Electronic Crimes Act). Because lookups are deleted after 24 hours and reports only keep counts, there is very little to share.

Tell the people you protect

Your dashboard shows lookups from every device you connect, and from everyone on your home Wi-Fi once it is linked, including adult family members and guests. Connect only devices and networks you are responsible for, and let the adults who use them know. Schools should inform students and parents.

Kafayah and Pakistani law

• Kafayah only adds blocks; it never removes one. Allowing a site on your dashboard only undoes a Kafayah block.
• Where your data is kept. Kafayah's servers are outside Pakistan, in Amazon Web Services' data centre in Sydney, Australia. Because Kafayah looks websites up from there, a site that the Pakistan Telecommunication Authority (PTA) blocks through Pakistani internet providers may still open on a device protected by Kafayah. Kafayah is a family filter, not a government filter, and does not promise to apply the PTA's blocks.
• Kafayah blocks adult content, gambling, scams and dangerous sites, plus the apps and sites you choose. It does not judge news or political content.
• The Kafayah Android app filters on your phone. It shows Android's "VPN" key symbol because that is how Android lets an app filter, but it does not send your internet traffic through another country or hide it.
• Kafayah is not a way around any block, and must not be used as one.

Removing your data

You can delete your account yourself, at any time: on the dashboard, under Account safety, choose Delete this account and type your password. It permanently deletes the account and everything under it: every profile, list, device, alert, report and mistake report. It also takes your devices off the Kafayah DNS server, so protection on them stops. This cannot be undone.

Recent lookups sit in the DNS server's short-lived log and disappear on their own within 24 hours. Removing just one child's profile deletes that profile's reports and settings. To stop a single device using Kafayah without deleting anything, undo its setup (see the setup guide).