Privacy Policy

Jamaah: Pray Together · Version 2026-09-15 · Last updated: 16 September 2026

The short version

Your prayer records show your religious practice. We treat them as sensitive data and only store them with your explicit consent.
You decide what each friend sees. Late/jamaah details, excuse reasons, qada and which extra prayers you pray are never shared.
No ads, no advertising or analytics trackers, and we never sell or rent your data.
You can download everything (Me → Account → Download my data) or delete your account at any time, in the app or at /delete.
Under-13s don't get accounts. Teens (13–17) need a parent to link and consent first.

1. Who is responsible

The controller of your personal data is Mohamad Sawan (trading as Jamaah Labs), REPLACE_WITH_POSTAL_ADDRESS, Türkiye ("we", "us"). Contact: jamaahlabs@outlook.com.

EU representative (Art. 27 GDPR): REPLACE_WITH_EU_REPRESENTATIVE_OR_DELETE_THIS_LINE. UK representative: REPLACE_WITH_UK_REPRESENTATIVE_OR_DELETE_THIS_LINE.

2. What we collect, why, and who can see it

Data	Why we use it	Legal basis (GDPR)	Who can see it
Account: your Google account's email and name, or your phone number; an internal user ID	Sign-in and account security	Contract (Art. 6(1)(b))	Only you
Profile: display name, username, emoji or initials avatar; optionally a photo (Premium, adults only)	So friends can recognise and find you	Contract	Adults: any signed-in Jamaah user who searches your exact username, scans your QR code or matches you by phone. Teens: only people already connected to them or with a pending request.
Date of birth (entered in the Gregorian or Hijri calendar) and optional gender	Age protections for minors (13+ / under-18 rules); showing your Hijri birthday; showing Jumu'ah; the optional "only share with my gender" setting	Contract; legal obligation for age checks	Only you. If you switch on "let friends see my birthday", friends see a 🎂 on the day itself — never the year, the date or your age. Off by default, and never available to under-18s.
First and last name	So friends recognise you	Contract	People you are connected to, and anyone who searches your exact username (adults only)
Your answers at sign-up: madhab, how established your prayers are, the prayer you find hardest	Correct Asr times and travel rules; gentler defaults for beginners; highlighting the prayer you want to work on	Contract	Only you. Never shown to anyone.
Prayer records (sensitive): which of the five prayers you marked and when, on time/late, jamaah, extra prayers, excused days, fasting and your private reason for not fasting, Taraweeh, Jumu'ah, travel mode, qada (make-up) ledger, streak, and the days you read Qur'an (and your Qur'an streak)	The core feature: tracking your prayers and sharing progress with people you choose	Explicit consent (Art. 9(2)(a) and 6(1)(a)), given during sign-up	You. Friends and circle members see only what your sharing level allows (see section 3).
Approximate location: coordinates rounded to about 1 km, or a city you pick; a "home" location for travel mode	Calculating prayer times and the Qibla; suggesting travel mode	Contract	Only you. Friends with detailed access see your prayer-time windows, which reveal your general region and time zone.
Precise location, only when you tap "Check in at a masjid"	Showing nearby masjids and confirming you're within 400 m. The coordinates are used for that request and not stored.	Consent (the location permission and your tap)	Friends with detailed access see the masjid's name for 45 minutes; others see "at the masjid". Never your coordinates.
Masjids you add or confirm: masjid name and location	Helping others find and check in at the masjid	Legitimate interest (Art. 6(1)(f))	Masjid name and location: Jamaah users nearby. Your name is never shown. We keep your user ID with it only to limit spam, and remove it when you delete your account.
Contacts' phone numbers, only if you tap "Find friends from contacts"	Showing which of your contacts use Jamaah and chose to be findable	Consent (yours) and legitimate interest (for your contacts, whose numbers are discarded)	Nobody. Numbers are sent over an encrypted connection, compared against keyed hashes, and discarded when the request ends. They are never stored. Limited to 3 times a day.
Findable by phone (optional, adults only): a keyed hash of your phone number	Letting contacts who have your number find you	Consent (the toggle)	Nobody can read it. It's only used for matching.
Social activity: friend requests and friendships, per-friend settings, circles, circle challenges, Group Khatm (your first name on the juz you claim), accountability buddy settings, blocks and reports	The social features	Contract	The people involved (e.g. circle members see the circle)
Nudges, reactions, "praying now", "I'm coming" and Eid greetings: preset messages only, never free text	Encouraging each other	Contract	Sender and recipient. Automatically deleted after 30 days.
Children's profiles you add as a parent: first name, emoji avatar, birth year, optional gender, prayer records	Letting parents track prayers together with young children	Consent of the parent	You, and members of Family circles you add the child to
Purchases: plan, product, renewal/expiry dates	Unlocking Premium and Family features	Contract	Only you. Payment details are handled by Google Play; we never see them.
Device and technical data: push notification token, app language, an App Check token from Google Play Integrity, invite code from the install link	Sending reminders and nudges in your language; blocking fake apps and abuse; connecting invites	Contract; legitimate interest (security)	Nobody
Reports you send or that others send about you	Keeping the community safe	Legitimate interest	Our moderation only

Adhan times, reminders, Qibla direction and most settings are calculated and stored on your phone as well, so the app works offline.

3. What your friends and circles see

For each friend you choose a sharing level (default: detailed):

Detailed: which of the five prayers you've marked today, today's prayer-time windows (so they can see "Asr ends in 20 min"), your prayer and Qur'an streaks, "praying now", "fasting" during Ramadan, Taraweeh, and the name of a masjid you checked in at.
Count only: how many of the five you've marked (e.g. 4/5), your prayer and Qur'an streaks, "praying now", "fasting", "at the masjid".
Hidden: nothing.

Never shared with anyone: whether a prayer was late or in jamaah, excused days and their reason (an excused day looks exactly like "Private today"), not fasting and its reason, which extra prayers you pray (only an optional ✨), what or how much Qur'an you read (only the streak number), qada, your location and your birth year.

"Only share with my gender" hides your progress from friends of another gender (except members of your Family circle). In mixed circles you then appear as an anonymous "Private member". Circles have their own visibility setting (detailed, count or anonymous).

A linked parent always sees at least a teen's daily count.

4. What we never do

We don't sell or rent personal data, show ads, or share data with advertisers or data brokers.
We don't use advertising IDs or third-party analytics or tracking SDKs.
We don't make automated decisions that have legal or similarly significant effects on you.
We don't use your data to train AI models.

5. Service providers and international transfers

We use these providers ("processors"), who may only process data on our instructions:

Google Firebase / Google Cloud (Google Ireland Ltd / Google LLC): database, file storage and server functions hosted in Belgium (europe-west1). Sign-in (Firebase Authentication), push notifications (Firebase Cloud Messaging) and App Check are global Google services that may process data outside the EU, including in the USA.
Google Cloud Vision: automatic screening of profile photos for nudity and violence, processed in the EU.
RevenueCat, Inc. (USA): subscription management. It receives your internal user ID and purchase receipts, but no prayer data.
Google Play: payments, app delivery and integrity checks. Google Play acts under its own privacy policy for payments.
OpenStreetMap / Overpass API: our server asks for mosques in a roughly 5 km area. No user ID or other personal data is sent.

Where data leaves the EU/EEA or UK, transfers are protected by the European Commission's Standard Contractual Clauses and/or the recipient's certification under the EU-U.S. Data Privacy Framework (and its UK extension).

6. How long we keep data

Account, profile, settings and prayer records: until you delete them or your account.
Nudges, reactions and greetings: 30 days. Invite links: 30 days. Anti-spam counters: 2 days. Parent link codes: 30 minutes. "Eid greeting sent" markers: about 13 months.
Contacts you upload and precise check-in coordinates: not stored at all.
Old profile photos are deleted as soon as a new one is approved.
Reports: up to 12 months after they're resolved, to protect the community.
When you delete your account, your data is removed from our live systems immediately. Our providers erase remaining copies (for example in their disaster-recovery backups) within their standard deletion periods.

7. Your choices and rights

In the app: per-friend sharing levels, "Private today", same-gender sharing, findable by phone, mute nudges from someone, quiet hours, and block or report.
Access and portability: Me → Account → Download my data gives you a file with everything we store about you.
Correction: edit your profile and settings in the app, or contact us (birth year can only be corrected by us).
Deletion: Me → Account → Delete account, or jamaah-pray-together.web.app/delete. This deletes your prayer history, profile, friends, circle memberships, children's profiles, photo, streak, nudges and sign-in account. Community masjids you added stay, without your ID. Deleting your account doesn't cancel a Google Play subscription, so cancel that in Google Play.
Withdrawing consent: tracking prayers is the core of the app, so withdrawing consent for prayer data means deleting your account (or you can simply stop marking prayers). Withdrawal doesn't affect processing that happened before.
You may also have the right to restrict or object to processing, and to complain to a data protection authority where you live or work.

8. Children and teens

Under 13: no account. If someone enters a birth year under 13 during sign-up, we stop, delete the sign-in record that was just created, and don't allow another attempt on that device for 24 hours. A parent can add a child profile to their own account instead (first name and birth year only) and log prayers together with the child.
13–17: a teen must be linked to a parent or guardian, who confirms they're the parent and consents, before the teen can record any prayers. The parent sees the teen's daily progress, approves every new friend, and must be in any circle the teen is in. Teens can't be found by username search or phone number, can't upload photos, and can't hide their progress from their linked parent.
If you believe a child under 13 has an account, contact us and we'll delete it. See also our child safety standards.

9. Security

Data is encrypted in transit (TLS) and at rest. Database access rules, which we test automatically, ensure users can read only what they're allowed to see. Our servers accept requests only from the genuine app (App Check). We also use rate limits, keyed hashing for phone numbers and automatic photo screening. No system is perfectly secure. If a breach puts your rights at risk, we will notify the authorities and you as the law requires.

10. Changes

When this policy changes we update the version and date above. For significant changes, especially anything about prayer data or who can see it, we'll tell you in the app and ask for your consent again where the law requires it.

11. Contact

jamaahlabs@outlook.com · Mohamad Sawan (trading as Jamaah Labs), REPLACE_WITH_POSTAL_ADDRESS