Privacy Policy

We collect only the data the app needs to function. Information you give us directly:

• Account information: your email address and display name when you sign up with email and password, or with Google or Facebook sign-in.
• Self-reflection data: the deeds you log, the deeds you hide or add, your sect, language, theme and text size, your sleep time, your Qaza counts, your streak settings, quiz answers, and any feedback you submit through the in-app form.
• Shop orders: if you order from the in-app shop, the delivery name, phone number and address you enter for that order.

Information collected automatically:

• Approximate location: when you grant permission, your device coordinates (or a city you enter) are used to compute prayer times and to show community events near you. The coordinates are cached on your device and stored with your account. We do not keep a location history.
• Device information: a generic device or browser identifier sent with push-notification registrations so we can debug delivery problems.
• Error reports: if the app hits an error, a short technical report (the error message, the screen, the app version) is sent so we can fix it. It is rate-limited and contains none of your reflections.

We do not use cookies for tracking. We do not use third-party analytics, advertising or A/B-testing SDKs.

• Account information: to identify you across devices and personalise the app.
• Self-reflection data: to render your dashboard, Review Your Day, streaks, points and reports, and to deliver bell and push notifications you have turned on.
• Location: only to compute prayer times for your city and to show nearby events. It is not used for anything else.
• Shop orders: only to fulfil and deliver the order you placed.
• Feedback: to fix bugs and improve the app. We may reply to the email on your account.

We never sell your data. We never share it with advertisers or data brokers.

• Your deed logs, reflections and Qaza counts are yours alone. Postgres Row Level Security restricts every user to their own rows; the database refuses the request, not just the app.
• The community leaderboard shows your display name and points total to other users. You can change your display name at any time.
• Administrators manage shared content (deeds, sayings, quizzes, Masail, events, shop) and see aggregate analytics and the order details needed to deliver a shop order. Every administrative action is written to an audit log.

• Supabase (PostgreSQL hosted on AWS): database, file storage and sign-in, under a data processing agreement.
• Google Firebase Cloud Messaging: push notifications on Android. Firebase handles only the notification token and payload.
• Web Push (browser-native, no third party): notifications in the web app.
• Aladhan (api.aladhan.com): prayer-time calculation. Your coordinates and the date are sent; the request is not linked to your account on their side.
• Google and Facebook: only if you choose to sign in with them.

All network traffic uses HTTPS. Authentication tokens are managed by Supabase and stored in OS-secured or browser storage.

So the app works offline, recently viewed deeds, logs, sayings, Qur’an text and du’as are cached on your device, and anything you mark while offline is queued until you reconnect. Signing out clears the cache; uninstalling the app removes all locally cached data.

We keep account-related data while your account exists. When you ask for deletion, we remove your data from our active systems within 30 days and from encrypted backups within 90 days.

• Correct it: change any field in Settings.
• Revoke location: through your device or browser settings. The app keeps working, just without automatic prayer times.
• Notifications: Settings → Notifications, toggle individual channels off, or revoke the OS permission entirely.
• Delete it: request deletion of your account and all associated data from our account deletion page. We respond within 30 days.

Muhasba is not directed at children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We use encrypted connections, database-level row security and audited administrative access. No system is perfectly secure; use a unique password and keep your device locked. If we discover a data breach involving personal information, we will notify affected users within 72 hours.

The app is operated from Pakistan. By using it you consent to your data being processed in the countries where Supabase and our other processors operate, including the United States and the European Union.

We may update this policy. Material changes are announced inside the app at least 7 days before they take effect, and the date at the top of this page always reflects the latest revision.