Privacy Policy

MyAlMasjid is a community app built to connect masjids and their members. This Privacy Policy explains, in plain terms, what personal data we collect when you use the app, why we need it, and how we protect it. We take your privacy seriously and comply with India's Digital Personal Data Protection Act 2023 (DPDPA) and the EU General Data Protection Regulation (GDPR).

1. Data We Collect

Data Type	What We Collect	Why
Phone Number	Your mobile number entered at registration	One-time password (OTP) authentication via Firebase
Name	Full name entered in your profile	Display in the community and masjid dashboard
Date of Birth	DOB entered in profile (optional)	Profile completion
Profile Photo	Photo you voluntarily upload	Profile display within your masjid community
Approximate Location	City-level GPS coordinate (coarse)	Finding nearby masjids
Precise Location	Exact GPS coordinate (fine)	Qibla compass direction — processed on-device only, never sent to our servers
Device / FCM Token	Firebase Cloud Messaging device token	Sending prayer-time notifications
Crash & Diagnostics	Crash stack traces via Firebase Crashlytics	Identifying and fixing bugs
Audio (ephemeral)	Live Azan audio streamed by the Imam	Live Azan feature — streamed in real-time via LiveKit, not recorded or stored

We do not collect emails, financial information, health data, contacts, racial or ethnic origin, sexual orientation, or political and religious beliefs. Note: when the Daily Sadaqah and Imam Hadiah payment features are activated, limited transaction-related data (amount, timestamp, payment status) will be processed by Razorpay on our behalf — this policy will be updated at that time.

2. How We Use Your Data

• Authenticate your account (phone OTP via Firebase)
• Display your profile within your masjid community
• Send prayer-time and announcement notifications
• Calculate Qibla direction (on-device — data never leaves your phone)
• Find masjids near your approximate location
• Monitor app stability and fix crashes (Firebase Crashlytics)
• Serve contextual advertisements (Google AdMob)

3. Third-Party Services We Use

Service	Provider	Data Shared
Firebase Authentication	Google LLC	Phone number
Firebase Cloud Messaging	Google LLC	Device FCM token
Firebase Storage	Google LLC	Profile photo
Firebase Crashlytics	Google LLC	Crash logs, device info
Firebase App Check	Google LLC	Device attestation (hardware-backed, no PII)
Google AdMob	Google LLC	Device identifier, approximate location (contextual ads)
LiveKit	LiveKit Inc.	Live audio stream (ephemeral, not stored)
Razorpay (Coming Soon)	Razorpay Software Pvt Ltd	Payment transaction data for Daily Sadaqah & Imam Hadiah features when activated. See Razorpay Privacy Policy.

Google's Privacy Policy: policies.google.com/privacy. LiveKit's Privacy Policy: livekit.io/privacy-policy. Razorpay's Privacy Policy (applies when payment features are activated): razorpay.com/privacy. We have Data Processing Agreements (DPAs) in place with all sub-processors listed above in accordance with GDPR Article 28 and DPDPA 2023 §9(2).

4. Data Retention

• Account data (name, phone, DOB, photo) — retained while your account is active.
• Prayer notifications — dispatch records deleted automatically after 30 days.
• Crash logs — retained for 90 days by Firebase Crashlytics.
• Live Azan audio — never stored; ephemeral only.
• On account deletion all personal data is permanently erased within 30 days.

5. Your Rights (DPDPA 2023 & GDPR)

6. Children's Privacy

MyAlMasjid is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with their data, please contact us immediately at privacy@myalmasjid.com.

7. Data Security

We implement industry-standard safeguards including:

• Sensitive credentials stored in Android Keystore / iOS Keychain (never in plain storage)
• All data transmitted over HTTPS (TLS 1.2+)
• Firebase App Check (Play Integrity) — prevents unauthorised API access
• Rate limiting and input validation on all API endpoints

8. Masjid Accounts — Data Controller & Processor

When a masjid is registered on MyAlMasjid and its members join the community, two distinct data protection roles come into play:

• The Masjid is the Data Controller for the personal data of its own community members (names, phone numbers, gender, date of birth, and any other profile information shared within that masjid community). The Masjid determines why and how that data is used within their community.
• MyAlMasjid acts as the Data Processor on the Masjid's behalf — we store, process, and transmit that member data according to the Masjid's instructions and the configuration of the platform, but we do not use it for our own independent purposes.

For all platform-wide data that MyAlMasjid collects independently — such as crash logs, device tokens, in-app analytics, and advertising identifiers — MyAlMasjid is the Data Controller and acts in accordance with this Privacy Policy.

Masjid Administrators are responsible for informing their members about data practices and for complying with applicable data protection laws in their locality. The Masjid Terms of Use set out these obligations in full.

9. Advertising (Google AdMob)

We display ads via Google AdMob. Google may use your device identifier and approximate location to serve contextual or personalised ads depending on your consent. EU/EEA/UK users are shown our GDPR consent form on first launch (powered by Google's User Messaging Platform). You can opt out of personalised ads at any time via Settings → Ads → Opt out of Ads Personalisation on your Android device.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective" date at the top will be revised accordingly. Continued use of the App after changes constitutes your acceptance of the updated policy. Significant changes will be notified via an in-app banner.

11. Contact & Grievance Officer