This Privacy Policy explains how My AlMasjid ("we", "our", "us") collects, uses, stores, and shares your personal data when you use our mobile application ("App"). We are committed to protecting your privacy and complying with applicable laws including India's Digital Personal Data Protection Act 2023 (DPDPA) and the EU General Data Protection Regulation (GDPR).
1. Data We Collect
| Data Type | What We Collect | Why |
|---|---|---|
| Phone Number | Your mobile number entered at registration | One-time password (OTP) authentication via Firebase |
| Name | Full name entered in your profile | Display in the community and masjid dashboard |
| Date of Birth | DOB entered in profile (optional) | Profile completion |
| Profile Photo | Photo you voluntarily upload | Profile display within your masjid community |
| Approximate Location | City-level GPS coordinate (coarse) | Finding nearby masjids |
| Precise Location | Exact GPS coordinate (fine) | Qibla compass direction — processed on-device only, never sent to our servers |
| Device / FCM Token | Firebase Cloud Messaging device token | Sending prayer-time notifications |
| Crash & Diagnostics | Crash stack traces collected by Firebase Crashlytics | Identifying and fixing bugs |
| Audio (ephemeral) | Live Azan audio streamed by the Imam during a broadcast | Live Azan feature — streamed in real-time via Agora, not recorded or stored |
We do not collect emails, financial information, health data, contacts, racial/ethnic origin, sexual orientation, or political/religious beliefs.
2. How We Use Your Data
- Authenticate your account (phone OTP)
- Display your profile within your masjid community
- Send prayer-time and announcement notifications
- Calculate Qibla direction (on-device, data never leaves your phone)
- Find masjids near your location
- Monitor app stability and fix crashes (Crashlytics)
- Serve contextual advertisements (Google AdMob)
3. Third-Party Services We Use
| Service | Provider | Data Shared |
|---|---|---|
| Firebase Authentication | Google LLC | Phone number |
| Firebase Cloud Messaging | Google LLC | Device FCM token |
| Firebase Storage | Google LLC | Profile photo |
| Firebase Crashlytics | Google LLC | Crash logs, device info |
| Firebase App Check | Google LLC | Device attestation (hardware-backed, no PII) |
| Google AdMob | Google LLC | Device identifier, approximate location (contextual ads) |
| Agora RTC | Agora.io | Live audio stream (ephemeral, not stored) |
Google's Privacy Policy applies to Google services: policies.google.com/privacy. Agora's Privacy Policy: agora.io/privacy-policy.
4. Data Retention
- Account data (name, phone, DOB, photo) — retained as long as your account is active.
- Prayer notifications — dispatch records deleted automatically after 30 days.
- Crash logs — retained for 90 days by Firebase Crashlytics.
- Live Azan audio — never stored; ephemeral only.
- On account deletion all personal data is permanently erased within 30 days.
5. Your Rights (DPDPA 2023 & GDPR)
As a user you have the right to:
- Access — request a copy of personal data we hold about you.
- Correction — update inaccurate data via your in-app profile settings.
- Erasure / Account Deletion — delete your account from Profile → Delete Account. All linked personal data is permanently erased within 30 days.
- Withdraw Consent — disable notifications at any time in app Settings or your device notification settings.
- Grievance Redressal (DPDPA) — raise a complaint with our Data Protection Officer at privacy@myalmasjid.com. We will respond within 30 days.
6. Children's Privacy
My AlMasjid is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us immediately at privacy@myalmasjid.com.
7. Data Security
We implement industry-standard safeguards including:
- Sensitive credentials stored in Android Keystore / iOS Keychain (never in plain storage)
- All data transmitted over HTTPS (TLS 1.2+)
- Firebase App Check (Play Integrity) — prevents unauthorised API access
- Rate limiting and input validation on all API endpoints
8. Advertising (Google AdMob)
We display ads via Google AdMob. Google may use your device identifier and approximate location to serve contextual or personalised ads depending on your consent. EU/EEA/UK users are shown our GDPR consent form on first launch (powered by Google's User Messaging Platform). You can opt out of personalised ads at any time via Settings → Ads → Opt out of Ads Personalisation on your Android device.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective" date at the top. Continued use of the App after any changes constitutes your acceptance of the updated policy. Significant changes will be notified via an in-app banner.
10. Contact & Grievance Officer
My AlMasjid
Email: privacy@myalmasjid.com
Security disclosures: security@myalmasjid.com
For DPDPA grievances, responses will be provided within 30 days of receipt.