Privacy policy

Controller

Name

Rakhman Vakhabov

Trading as

abyad - clear vision

Address

Fuchsstraße 2/2, 6060 Hall in Tirol, Österreich

Email

info@masajidu.app

The short version

• The app creates no account. There is no sign-in and no user name.
• There is no advertising, no tracking, no analytics and no sharing with third parties for advertising.
• What you do in the app, which prayers you mark, which counters you keep and where you are in the Quran, stays on your device.
• Your position is sent to the server only when you ask for times to be calculated for your location, and it is not stored there.

What stays on your device

The following is held only in local storage on the device and never sent to us. It disappears when the app is deleted.

• The chosen association, or the chosen place with its coordinates
• The prayer times last downloaded, so the app works without a connection
• The chosen language
• Which prayers you marked as prayed, and your dhikr and salawat counters
• In the Quran: your last reading position, bookmarks, the chosen translation and the suras already opened
• Your reminder settings

An association's prayer times

When you have chosen an association, the app requests its times under that association's identifier. What is transmitted is the identifier, not your position. As with any request to any website, the server records a log entry with the IP address, the time, the address requested and the browser or app identifier. These logs exist for operating the service and for finding faults.

Prayer times for your location

When you ask for times to be calculated for your location, the app asks the operating system for the position and sends latitude, longitude and time zone to our server. The times are calculated there and returned. The coordinates are not written to any database.

So that they do not end up in log files either, the web server is configured to log this one request without the values passed to it.

For the place name shown above the times, our server asks Nominatim, operated by the OpenStreetMap Foundation. The coordinates are rounded to two decimal places first, roughly one kilometre. That is enough for a town name and less than a position. The answer is cached with us so the same square is not asked for twice.

If you look a place up through the search field instead, our server asks Photon, operated by Komoot, with what you typed. Where we already know roughly where you are, that position goes along so nearby places come first. Your name does not, and the query is not kept here.

You can withdraw the location permission at any time in your device settings. The app asks for your location only when you explicitly ask it to.

Reminders and notifications

Prayer time reminders are scheduled by the device itself and need no connection.

If you additionally switch on notifications from your association, the device is registered with the server. That registration holds a randomly generated installation identifier, a push token, the chosen association and what you asked to be told about. The identifier is generated on the device and is tied to no person.

Delivery runs through Expo's push service and from there through Apple or Google. Notifications cannot technically be delivered any other way.

Switching notifications off removes the registration again.

Having your data deleted

The app needs no account, so there is none to delete. What you mark, count and read is held on your device and goes with the app when you uninstall it.

Only two things on our server can have come from you. The registration for notifications, made up of a random installation identifier, a push token, the chosen association and what you asked to be told about: you delete that yourself by switching notifications off in the app. And a piece of feedback you sent, together with what travelled with it.

To have feedback deleted, write to info@masajidu.app. Say roughly when you wrote and what about, otherwise we cannot find it: we hold no name. We delete within 30 days, and reply if you left a way to reach you.

Prayer times and announcements belong to the association and are meant to be published; they are not data about you. Association accounts are deleted when the association asks, see the terms of use.

Feedback from the app

If you send feedback or report a problem under "More", what you wrote is stored, along with whether it is an idea or a problem, whether it concerns the app or your congregation, and which association you had chosen at the time.

Operating system, app version and language go along without being asked for. Without those three a report saying "it does not work" cannot be answered, and whoever wrote it is rarely still reachable when the question comes back.

A way to reach you is optional. If you leave it empty we have no way to reply and do not know who the report came from. The installation identifier goes along so a flood of reports can be slowed down, not so anybody can be identified.

Accounts for associations

Anyone working for an association in the portal creates an account. That holds a name, an email address and a password. The password is not stored in the clear but as a bcrypt hash.

Alongside it sits what the association itself publishes: name, address, coordinates, contact details, prayer time rules, announcements and events. This material is meant for publication and is publicly retrievable through the API.

Resetting a password creates a single-use link. Only its hash is stored, valid for one hour and usable once.

Cookies

The app uses no cookies.

The portal sets exactly one cookie after sign-in so the session persists. Details are on the cookies page.

Email

The platform sends mail only when something has happened: confirmation of a registration, approval or rejection of an association, a password reset. It goes out through the platform mailbox at Hetzner Online GmbH. There is no newsletter.

Who else sees anything

Hetzner Online GmbH, Nuremberg

Runs the servers and the mailbox, located in Germany

OpenStreetMap Foundation

Place names from rounded coordinates, only when location times are calculated

Expo, Apple, Google

Delivery of notifications, only if you switched them on

How long things stay

Server logs

a few weeks, then deleted automatically

Coordinates used for a calculation

not stored at all

Place name for an area

cached, tied to no person

Notification registration

until you switch it off

An association's account

until the account is deleted

Data on the device

until the app is deleted

Legal bases

Processing association data and accounts rests on performance of the usage relationship under Art. 6(1)(b) GDPR. Location requests and notifications rest on your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time by removing the permission or switching notifications off. Server logs and secure operation rest on legitimate interest under Art. 6(1)(f) GDPR.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to info@masajidu.app.

Because the app works without an account, we normally hold nothing about a user of the app that could be attributed to a person. In that case we can only answer for what actually exists.

Complaints go to the Austrian Data Protection Authority, Barichgasse 40 to 42, 1030 Vienna.