Privacy Policy

1. Introduction and who we are

Welcome to Taqwa — Your Islamic Companion (hereinafter, "the App", "Taqwa" or "we"). This Privacy Policy describes how we collect, use, store and protect your personal information when you use our mobile app, available on the Google Play Store and the Apple App Store.

It also describes data processing when you use features of the taqwamuslim.com website that require an account, in particular the Prayer Calendar (taqwamuslim.com/calendario), since it uses the same account system and the same database as the App.

And it applies to the app.taqwamuslim.com web app, the version of Taqwa used from the browser, with the same account and the same database as the App. What is specific to it is set out in sections 2.2 and 8.3.

The data controller is:

By downloading, installing or using the App, you accept the practices described in this Privacy Policy. If you do not agree, please refrain from using the App.

2. Data we collect

2.1 Data you provide to us

• Account information: first name, last name and email address when you register.
• Login credentials: password (stored encrypted; never in plain text).
• Sign in with Google: if you choose to authenticate with Google, we receive your name, email address and profile photo from your Google account.
• Sign in with Apple: if you choose to authenticate with Apple, we receive your name and email address (or Apple's private relay address, if you choose to hide your email).
• Profile photo: if you upload a profile photo (from the camera or your gallery), it is stored in Firebase Storage linked to your account and other App users can see it. It is deleted when you delete your account.
• User-generated content: posts, comments or content you share in the App's Social feature.
• Favorite du'as: du'as you mark as favorites are stored linked to your account.
• Initial questionnaire answers: when you start using the App we ask about your spiritual level, your goals (your niyyah), how often you pray and read the Quran, and whether you are a brother or a sister. They are stored in your account. We use your goals for your daily goals list; your goals and how often you pray and read the Quran, to choose which reminders we send you; and whether you are a brother or a sister, for the greeting on the home screen and to show you the streak pause. Your spiritual level is stored, but we do not currently use it for any feature.
• Record of your practice: the prayers you mark as done each day and your prayer streak, the daily goals you complete and the Quran pages you log. They are stored in your account to show you your progress, calculate your streak and generate your weekly summary. The people you have added as friends can see your goals, how many you have completed today and the Quran pages you have logged today; the App does not show them your prayers or your streak.
• Streak pause for menstruation: if you said you are a sister, you can turn it on from the home screen. While it is on, we store in your account that it is on and the paused days, so that those days do not break your streak. Only you can see it.
• If you are a founder (one-time €7.99 payment at app.taqwamuslim.com): your founder number, the payment date, the Stripe payment identifier, the platform you paid from (iPhone, Android, computer or other) and your account language. Only if you turn on the founders wall, also the name you choose to show and the date you turned it on (section 2.8).

When you delete your account, your questionnaire answers, the record of your practice and the streak pause are deleted automatically. The copy of your profile that your friends can access (name, photo, email address and goals) is not yet deleted automatically: we delete it when you request deletion by email (see 7. Your rights).

2.2 Data collected automatically

• Geographic location (GPS, App only): with your explicit permission, we access your GPS location solely to calculate prayer (Salat) times and the qibla direction. This is processed on-device and not stored on our servers.
• Product analytics (App usage): we collect data about how you interact with the App — screens visited, buttons tapped, features used, time spent, the order you use features in, where you drop off a flow (for example, sign-up) — through two tools, linked to your Taqwa account identifier (an internal code; not your name or your email address):
  • Firebase Analytics (Google), whose data we view in Google Analytics (GA4): usage events and screens, your account identifier, the app instance identifier, device language, country, time zone and currency, your plan (free, trial or Pro), app version, device model and OS, and the approximate location Google derives from your IP address.
  • PostHog: the same usage events and screens, your account identifier and a device identifier, device language, country, time zone and currency, your plan, app version, technical device and OS data, and the approximate country and city PostHog derives from your IP address (the IP address is not stored).
  Some of these events show which religious features you use and how: for example, which prayer you mark and how many minutes after its time, how many you have marked that day and your streak, which goal you complete, which surah you read or listen to and for how long, or which dhikr you repeat on the tasbih and how many times. With the current version of the App, your initial questionnaire answers, your name and your email address are not stored in either tool.
  
  Earlier versions of the App: until the update of October 10, 2026 (version 1.2.8 for Android), the App also sent your initial questionnaire answers to Firebase Analytics and PostHog, and your name and email address to PostHog. Earlier versions that have not been updated yet, including every iOS version released so far, keep sending them until they are updated: PostHog discards them on arrival, but Firebase Analytics does receive them. In PostHog we have deleted from user profiles the data that had already been sent, but it remains in its event history; in Firebase Analytics it remains stored. You can ask us to delete it (see 7. Your rights).
  
  Web app (app.taqwamuslim.com): it uses the same account as the App and stores in it the data from section 2.1 that you generate on the web. Its initial questionnaire only asks about your goals, how often you pray and, optionally, whether you are a brother or a sister. It does not use Firebase Analytics. It only sends data to PostHog if you accept analytics cookies; in that case, PostHog receives the same usage events, your account identifier and technical browser data, but not your questionnaire answers, your name, your email address or what you tap during the questionnaire. Until October 10, 2026 it did send PostHog your goals, how often you pray, your name and your email address; if your browser still runs that version, PostHog discards them on arrival. Separately, even if you do not accept cookies, our server records in PostHog, linked to your account identifier, one technical event each time you use an AI feature (section 2.4) and one event when a payment on the web is completed (what you bought, the amount, the currency and the device you paid from). They do not include your name, your email address or any card details, and they store nothing in your browser. We use them to keep costs under control and to know how many payments are completed. See details for each tool in section 4. Third-party services.
• Device data: device type, operating system, app version, language, anonymous installation identifier.
• Push notification tokens: if you grant permission, we collect your device's notification token to send you prayer reminders or other relevant notifications.
• Crash reports and technical diagnostics: when the App crashes or closes unexpectedly, we automatically collect technical information so we can fix it, through two tools:
  • Firebase Crashlytics: technical stack trace, device model and state, OS and app version.
  • Sentry: technical stack trace, the screen and action that triggered it, device model and OS, app version and, in some cases, the source IP address (used only for diagnostics, never to identify you).

2.3 Prayer Calendar (taqwamuslim.com/calendario)

This feature uses the same account system as the App (Firebase Auth), but collects additional data specific to generating the calendar:

• City search: the text you type to search for your city is sent to OpenStreetMap (Nominatim) to obtain its coordinates. No other data of yours is sent in that search.
• Geographic coordinates (latitude/longitude): sent to the AlAdhan API to calculate prayer times for that location, and saved to your profile (Firestore) so you don't have to search again.
• Calendar settings: calculation method, Asr school, file duration in months, alert minutes before each prayer, prayer and Jumu'ah duration, timezone, and which prayers to include. Saved linked to your account.
• Payment data: when you tap "Pay", we redirect you to Stripe Checkout, off taqwamuslim.com. We never see or store your card number; we only receive confirmation from Stripe that payment was completed.
• Generated .ics file: built in your own browser from the prayer times downloaded from AlAdhan, and downloaded directly to your device. It is never uploaded or stored on our servers.

2.4 AI-powered features

Some features of the App use artificial intelligence models from OpenAI. What you send goes first through our servers (Firebase Cloud Functions) and from there to OpenAI; your device never connects to OpenAI directly. Only what each feature needs is sent:

• Noor (Islamic assistant): the messages in the conversation and, if you attach them, the images you choose. Your conversation history is stored only on your device, not on our servers.
• Voice notes in Noor: if you use the microphone, the recorded audio is sent to be transcribed into text. We do not keep the audio.
• Du'a Finder: the text of your search.
• Weekly summary: counts from your week (prayers logged, complete days, most and least consistent prayer), without your name or email.
• Prayer Mat mode of app blocking: see section 2.5.

For each call we log a technical event in PostHog (feature used, model, tokens consumed and cost) and keep a daily usage counter linked to your account, to control costs and prevent abuse. Neither the content you send nor the AI's replies are stored on our servers or reach PostHog. Under its API policy, OpenAI does not use this data to train its models and may keep it for up to 30 days in its safety logs before deleting it (see 4. Third-party services).

2.5 App blocking during prayer (Pro)

If you turn on app blocking, the App blocks the apps you choose during each prayer's window.

• On iOS it uses Apple's Screen Time API (Family Controls). The apps you choose are stored on your device as opaque Apple identifiers: Taqwa cannot see their names.
• On Android it uses the usage access and display-over-other-apps permissions to detect which app is in the foreground and show the block screen. The list of chosen apps and the foreground app are processed only on your device and are never sent to our servers.
• In product analytics we only record how many apps and categories you chose and when blocks and unlocks happen, never which apps they are.

Prayer Mat mode (strict mode). It is optional and only turns on after you accept a specific notice inside the App. In this mode, to unlock your apps you take a live photo with the camera (never from the gallery) of your prayer mat, and an AI checks that it is a prayer mat. The AI only checks the object, never your prayer or you.

• What is sent: only the part of the photo inside the frame shown on screen, cropped and downscaled on your device before sending. It reaches our servers and from there OpenAI, which analyses it.
• What we do not keep: Taqwa does not keep any image. The photo is processed in memory and discarded as soon as the answer arrives; it is not written to our database, file storage or technical logs. OpenAI does not use it to train its models, but may keep it for up to 30 days for safety reasons before deleting it.
• What we do keep: the result of each attempt linked to your account (prayer, accepted or rejected, reason, the AI's confidence level, response time, model and instruction version, the threshold applied, and whether the AI saw a screen or printed paper, or a dark or blurry photo), to improve the accuracy of the check. We do not keep the text of the AI's answer. Also a temporary single-use session that expires after 2 minutes and is deleted automatically.
• Analytics: in PostHog we log each attempt and its result (prayer, accepted or rejected, reason, response time and attempt number) and the cost of the AI call. Never the photo.
• How to stop using it: switch back to Trust mode in the blocking settings and no more photos will be sent. Stored results are deleted when you delete your account.

2.6 Data we do NOT collect

• We do not directly collect payment data. Transactions are handled by Google Play, the Apple App Store and RevenueCat in the apps, and by Stripe on the web (the one-time web payment and the Prayer Calendar payment).
• We do not access your contacts. The camera, photo gallery and microphone are only used with your permission and for the features described in this policy (profile photo, images and voice notes in Noor, and Prayer Mat mode).
• We do not collect biometric data.

2.7 Data that may reveal your religious beliefs or your health

Your initial questionnaire answers and the record of your practice (section 2.1) may reveal your religious beliefs, and the streak pause for menstruation is data concerning your health. They are special categories of data under Article 9 GDPR.

• What we use them for: we store them in your account only for the features described in section 2.1. In addition, counts of your practice are sent to OpenAI for your weekly summary (section 2.4) and to Resend for some informational emails (section 4.14).
• Analytics: your initial questionnaire answers are not sent to any analytics tool, except from the earlier versions of the App described in section 2.2. Events about how you use the practice features, such as marking a prayer, do reach analytics (section 2.2).
• What is required: the questions about your spiritual level, your goals and how often you pray and read the Quran are required to finish the initial questionnaire; for brother or sister you can choose "Prefer not to say". The record of your practice is only stored when you use those features, and the streak pause is optional.
• How to ask for deletion: by deleting your account (section 7) or by emailing us at info@taqwamuslim.com so that we delete only this data without deleting your account.

2.8 Founders programme and founders wall

If you make the one-time €7.99 payment at app.taqwamuslim.com, you become a Taqwa founder. We give you a number in order of payment, and it is never reassigned.

• Founders wall (taqwamuslim.com/fundadores): it is public and voluntary. By default you do not appear. If you turn it on in your Profile, we publish the name you choose (up to 40 characters), your founder number and the date of your payment. Never your email or your account identifier. Anyone who visits the page can see it; the page asks search engines not to index it, but we cannot guarantee that nobody copies what is published.
• How to remove it: turn it off in Profile → Founders wall and it is removed from the wall straight away. It is also removed if you get a refund or delete your account.
• Founder card: the image is created in your browser. It only leaves your device if you share it.
• Internal notice: when someone becomes a founder, we get an email with their name, email, language and number, so we can write to them personally.

3. How we use your data

We use the information we collect for the following purposes:

• Providing and personalizing the service: creating and managing your account, showing you personalized content and remembering your preferences.
• Calculating prayer times: using your location to provide accurate Salat times for your city. Location is processed on-device and is not sent to our servers.
• Syncing across devices: saving your favorite du'as and settings in the cloud so they are available on all your devices.
• Notifications: sending you prayer reminders, daily ayah alerts or other notifications you have enabled. You can disable them at any time from your device settings.
• Improving the App: analyzing aggregated usage data with Firebase Analytics, Google Analytics (GA4) and PostHog to identify which features are used most, measure retention, understand where users drop off a flow (e.g. sign-up), and prioritize new feature development.
• Technical diagnostics and stability: using Firebase Crashlytics and Sentry to detect errors, crashes and freezes in the App, and fix them as soon as possible.
• Generating your prayer calendar: calculating your city's prayer times via the AlAdhan API, searching your city via OpenStreetMap, processing the one-time payment via Stripe, and unlocking the .ics download once payment is confirmed.
• AI features: answering your questions in Noor, transcribing your voice notes, finding du'as with Du'a Finder, generating your weekly summary and checking the Prayer Mat mode photo (sections 2.4 and 2.5).
• App blocking: blocking the apps you choose during each prayer's window and unlocking them when you mark the prayer or, in Prayer Mat mode, when the photo is verified.
• Security: detecting and preventing fraud, misuse or activities that violate our Terms of Use.
• Service communications: sending you important emails about policy changes, security updates or service interruptions.
• Managing premium subscriptions and one-time payments: if you purchase premium features, processing and validating your subscription through RevenueCat, Google Play Billing and the Apple App Store; if you purchase the Prayer Calendar or make the one-time web payment, processing the payment through Stripe.
• Founders programme: giving you your number, showing your badge and card, handling refunds and emailing you the promised App Store codes (Terms, section 6).
• Founders wall: showing your name and number on the public wall, only if you turn it on, and removing it when you turn it off (section 2.8).
• Promotional emails: emailing you news about Taqwa's return, the founders programme, surveys and the invitation to our WhatsApp channel. We only send them if you accept them with the optional checkbox at sign-up (unticked by default), and you can unsubscribe using the link in each email. Unsubscribing does not affect the promised codes, which you will still receive.

3.1 Emails we send you

We use the email address of your account for the messages described here. We send them with Resend (section 4.14) from hola@taqwamuslim.com or noreply@taqwamuslim.com.

Service emails. These are the ones you need to use your account, and unsubscribing does not turn them off:

• account verification and password reset, which we only send when you ask for them;
• notices from the founders programme that apply to you, such as sending the App Store codes we promised (section 6 of the Terms).

Informational emails. These are occasional messages about how you use Taqwa. All of them carry an unsubscribe link at the bottom and your email client's one-click unsubscribe header. Today they are:

• the welcome email, when you finish the app's initial questionnaire;
• a series of up to seven emails, over about ten days, if you finish the initial questionnaire and do not start the Taqwa Pro trial: they explain the features of the app and of Taqwa Pro;
• a series of up to six emails while your Taqwa Pro trial lasts: usage tips, your progress and, at the end, what Taqwa Pro includes, its price and how to cancel;
• occasional emails if you have not logged anything in the app for a while: after 3 days, after 14 days (a reflection) and after 30 days (a news item about the app).

These emails use your first name and your account language. Some include counts of your activity (prayers logged, goals completed, active days). They do not use the answers to the initial questionnaire (goals, spiritual level, form of address); the exception is the founders programme emails, which may address you as brother or sister depending on the form of address you chose. Some of the informational emails include information about Taqwa Pro (features, price and how to subscribe): they are commercial communications about our own app.

Except for the welcome email and the trial-start email, which go out right away, we do not send you more than one informational email every 20 hours, counting all types, and they go out between 10:00 and 21:00 in your time zone. The App has no checkbox to accept them and no switch in Settings: the way to stop receiving them is to unsubscribe.

On the website (taqwamuslim.com and app.taqwamuslim.com), the first two emails of the welcome series are service emails. The next three (news, founders programme, surveys and the invitation to our WhatsApp channel) only reach you if you tick the optional box at sign-up, which is unticked by default.

Legal basis. Service emails are based on performing the contract to use the App (GDPR art. 6.1.b). Informational emails to App users are based on our legitimate interest in keeping you informed about your use of Taqwa (art. 6.1.f), with immediate unsubscribe in every email; you can object at any time by unsubscribing. Promotional emails on the website are based on your consent (the checkbox), which you can withdraw at any time.

How to unsubscribe. At any time, in any of these ways:

• with the "Unsubscribe" link at the bottom of every informational email: it opens a page where you confirm, with no sign-in;
• with the unsubscribe button your email client shows, which unsubscribes you with one click;
• by writing to info@taqwamuslim.com.

When you unsubscribe we stop sending you informational emails and the series, and we mark your contact as "unsubscribed" in our Resend lists so we do not write to you again. You will keep receiving service emails. We keep the record of your unsubscription for as long as your account exists.

If you delete your account from the App (Profile → Delete account), your sending record and your email statistics are deleted. Your contact in the Resend lists is not deleted automatically: if you want us to remove it, write to info@taqwamuslim.com and we will delete it. Resend keeps the delivery record of messages under its own policy (section 4.14).

4. Third-party services

Taqwa integrates trusted third-party services to provide its features. Each provider has its own privacy policy:

4.1 Firebase (Google LLC)

We use Firebase for user authentication (in both the App and the website's Prayer Calendar), real-time database (Firestore), file storage (Storage, for profile photos), cloud functions (Cloud Functions, which process AI requests and the Prayer Mat mode check), push notifications (FCM), usage analytics (Firebase Analytics) and crash reporting (Crashlytics).

• Data shared: user identifier, email address, usage data linked to your account identifier, device tokens.
• Purpose: authentication, data sync, notifications and analytics.
• Privacy policy: firebase.google.com/support/privacy

4.2 Google Sign-In (Google LLC)

We offer the option to sign in with your Google account as an alternative to email registration, in both the App and the Prayer Calendar.

• Data shared: name, email address and profile photo from Google.
• Privacy policy: policies.google.com/privacy

4.3 Google Analytics (GA4)

Google Analytics (GA4) is where we view the data Firebase Analytics collects in the App (section 4.1): which screens and features are used, how many sessions there are and where users drop off a flow (e.g. sign-up). We do not use a separate Google Analytics SDK.

• Data shared: the Firebase Analytics data described in section 2.2: your Taqwa account identifier, the app instance identifier, usage events (including those that describe your practice), device language, country, time zone and currency, your plan, app version, device model and OS, and IP address (used by Google for approximate geolocation and then discarded).
• Purpose: product analytics and improving the App.
• Privacy policy: policies.google.com/privacy

4.4 PostHog

We use PostHog as a product analytics tool to understand in more detail how the App is used: which buttons are tapped, in what order features are used, and how long it takes to complete key actions.

• Data shared: your Taqwa account identifier (or, before you sign in, an anonymous identifier) and a device identifier, App usage events (including those that describe your practice, see section 2.2), device language, country, time zone and currency, your plan (free, trial or Pro), technical device data (OS, app version) and the approximate country and city it derives from your IP address, which it does not store. For AI features, also one technical event per call (section 2.4), and for each payment completed on the web, one event with what you bought, the amount, the currency and the device (section 2.2). PostHog does not store your initial questionnaire answers, your name or your email address: if an earlier version of the App sends them (section 2.2), they are discarded on arrival.
• Purpose: product analytics, feature prioritization and detecting friction points in the App.
• Privacy policy: posthog.com/privacy

4.5 Sentry

We use Sentry to receive technical reports when the App crashes or behaves unexpectedly, so we can fix it.

• Data shared: technical stack trace, the screen and action where it occurred, device model and OS, App version and, in some cases, the source IP address.
• Purpose: diagnosing and fixing technical errors.
• Privacy policy: sentry.io/privacy

4.6 RevenueCat

If the App offers premium features or paid subscriptions, we use RevenueCat to manage subscription status, verify purchases and administer entitlements.

• Data shared: your Taqwa account identifier (before you sign in, an anonymous identifier generated by RevenueCat), purchase history, subscription status. It does not receive your name or your email address.
• Important: RevenueCat does not receive credit card data or payment information; this is handled directly by Google Play or the Apple App Store.
• Privacy policy: revenuecat.com/privacy

4.7 Google Play Billing and Apple App Store

In-app purchases and subscriptions are processed through Google Play Billing (Android) or Apple's App Store (iOS). We do not store or have access to your payment data.

• Google privacy policy: policies.google.com/privacy
• Apple privacy policy: apple.com/legal/privacy

4.8 Expo (Expo Inc.)

The App is built with Expo / React Native. Expo may collect basic technical data required for the app runtime to function.

• Privacy policy: expo.dev/privacy

4.9 Stripe

The website's one-time payments (the Prayer Calendar at taqwamuslim.com/calendario and the founder payment at app.taqwamuslim.com) are processed through Stripe Checkout, off our website.

• Data shared: your email address, your Taqwa account identifier and, for the founder payment, the platform you pay from. From Stripe we receive the payment confirmation, its identifier, the amount and any refund. We never receive or store your card number or any other banking data: Stripe handles that directly.
• Purpose: processing the one-time €2.99 calendar payment and the €7.99 web payment, granting the corresponding access and handling refunds.
• Privacy policy: stripe.com/privacy

4.10 AlAdhan API (Islamic Network)

To calculate the Calendar's prayer times, your browser sends the coordinates of the chosen city to the public AlAdhan API (api.aladhan.com).

• Data shared: latitude and longitude of the chosen city, calculation method and Asr school. Your name, email or any account identifier is never sent.
• Purpose: calculating prayer times for that location.

4.11 OpenStreetMap / Nominatim

The Calendar's city search uses the Nominatim geocoding service from OpenStreetMap.

• Data shared: the text you type when searching for your city.
• Purpose: converting your city's name into geographic coordinates.

4.12 OpenAI

We use OpenAI's models (OpenAI, L.L.C., United States) through its API for the AI features described in section 2.4: Noor, voice notes, Du'a Finder, the weekly summary and the Prayer Mat mode photo check. Requests are always sent from our servers, never from your device.

• Data shared: only the content each feature needs (messages and images you send to Noor, the audio of your voice notes, your Du'a Finder search, your weekly counts and the cropped Prayer Mat mode photo). We do not add your name, email or any account identifier to what is sent.
• Retention by OpenAI: under its API policy, data sent is not used to train its models and may be kept for up to 30 days in its safety logs before being deleted.
• Purpose: generating Noor's replies, transcribing audio, finding du'as, writing the weekly summary and checking that the Prayer Mat mode photo shows a prayer mat.
• Privacy policy: openai.com/policies/privacy-policy · API data

4.13 Apple (Sign in with Apple and Screen Time)

On iOS we offer signing in with your Apple account, and app blocking uses Apple's Screen Time API (Family Controls).

• Data shared: when you sign in, Apple gives us your name and email (or a private relay address). With Screen Time, Apple gives us opaque identifiers for the apps you choose, which do not reveal their names and do not leave your device.
• Privacy policy: apple.com/legal/privacy

4.14 Resend

We use Resend to send the App's and the website's emails: account verification, password reset, welcome, informational emails about your free trial and your account, emails about the founders programme (including sending the App Store codes) and promotional emails (news about Taqwa's return, surveys and invitations to our WhatsApp channel). You can unsubscribe from informational and promotional emails using the link in each email.

• Data shared: your email address, your first name and the content of the email. Some informational emails include counts of your activity (prayers logged, goals completed and active days). The welcome email and the series no longer use the answers to the initial questionnaire (goals, spiritual level, form of address); the founders programme emails may address you as brother or sister depending on the form of address you chose (section 3.1).
• Purpose: delivering transactional, informational and promotional emails. To organise sending, your email is on one of our Resend lists (registered on the web, or founders).
• Privacy policy: resend.com/legal/privacy-policy

4.15 WhatsApp (Meta)

We have a WhatsApp channel and, for founders, a private community. Joining is voluntary and you do it from a link; we do not add you or share your number with anyone.

• Data: when you join, WhatsApp processes your phone number and profile name under its own policy. What others can see about you depends on the format and on WhatsApp's settings: in a channel, followers do not see other followers; in a community or group, other members can see your profile name and, depending on the settings, your number.
• Privacy policy: whatsapp.com/legal/privacy-policy-eea

5. Storage and security

5.1 Where your data is stored

Your account and content data are stored on Firebase (Google Cloud) servers, which may be located in the European Union, the United States or other regions. Firebase complies with GDPR and has signed the EU Standard Contractual Clauses (SCCs).

The Prayer Calendar's one-time payment data is processed and stored by Stripe, Inc. (United States), under its own EU Standard Contractual Clauses. Analytics and technical diagnostic data (Google Analytics, PostHog, Sentry) is stored on each provider's own servers, which may be in the EU, the United States or other regions depending on their configuration.

5.2 For how long

• Account data: for as long as your account is active. If you delete your account, your data is deleted as explained in section 7 (Account deletion).
• Usage data linked to your account identifier (Firebase Analytics, Google Analytics): typically up to 14 months, per each tool's default settings.
• Crash reports (Sentry): up to 90 days by default. Crashlytics follows Firebase's standard retention.
• Product events (PostHog): per the project's configured retention.
• Prayer Mat mode photos: Taqwa never keeps them. OpenAI may keep them for up to 30 days in its safety logs.
• Prayer Mat mode results: while your account is active; deleted when you delete it. Temporary verification sessions expire after 2 minutes and are deleted automatically.
• Content sent to AI features: we do not keep it. OpenAI may keep it for up to 30 days in its safety logs.
• Founder data: while your account is active. If you delete your account, we delete your wall entry and the name you chose; we keep your number (so it is never reassigned) and the payment record.
• Payment records (Stripe and our database): for as long as tax and accounting obligations require.
• Founders wall: until you turn it off, get a refund or delete your account.
• Mailing lists (Resend): while your account is active; if you unsubscribe, your contact is marked as unsubscribed. When you delete your account from the App, your contact in Resend is not deleted automatically: we remove it if you ask us by email (section 3.1). Notices about the promised codes still reach you.
• Backups: may be retained for up to an additional 90 days in encrypted backups.

5.3 Security measures

• Data transmission via HTTPS/TLS.
• Passwords stored with secure hashing (managed by Firebase Auth).
• Restricted access to production data via two-factor authentication.
• Firestore security rules that prevent unauthorized access between users.

6. Minors

Taqwa is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data without your consent, contact us at info@taqwamuslim.com and we will delete that information immediately.

In the European Economic Area (EEA), we do not collect data from minors under 16 without the verifiable consent of their parents or legal guardians.

This applies equally to accounts created from the Prayer Calendar on the website, since it uses the same account system as the App.

7. Your rights

Depending on your place of residence, you may have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request the deletion of your personal data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to the processing of your data for certain purposes.
• Restriction: request that we restrict the processing of your data in certain circumstances.
• Withdrawal of consent: withdraw your consent at any time (for example, by disabling location, camera, microphone or notification permissions from your device settings, or by switching back to Trust mode to stop sending Prayer Mat mode photos).

How to exercise your rights

To exercise any of these rights, contact us at info@taqwamuslim.com. We will respond within a maximum of 30 days. In some cases we may need to verify your identity before processing the request.

Account deletion

To delete your account and all your data, email us at info@taqwamuslim.com from the address linked to your account, requesting deletion. This is the official channel, whether you signed up through the App or only through the website's Prayer Calendar. We will permanently delete all your data from our active servers within a maximum of 30 days from your request.

If you use the App, you can also delete your account from Profile → Delete account. This immediately deletes your account and the data stored in it (profile, questionnaire answers, record of your practice, profile photo and friendships), but not everything: the copy of your profile that your friends can access (name, photo, email address and goals), the reactions you have sent, your progress in the invitation program and analytics and diagnostic data are not deleted automatically. If you are a founder, your entry on the founders wall is deleted straight away (section 5.2). For us to delete everything, email us; if you have any doubts or don't see that option, emailing us is always the safest way to get it processed.

Complaints

If you believe that the processing of your data does not comply with applicable regulations, you have the right to file a complaint with the data protection authority in your country (in Spain: AEPD — aepd.es).

8. Cookies and tracking technologies

8.1 Website (taqwamuslim.com)

This section refers only to the taqwamuslim.com website (including the Prayer Calendar). The app.taqwamuslim.com web app has its own section, 8.3.

The only information this site stores in your browser is your language preference (the language you view the site in), via localStorage. This data:

• Never leaves your device and is never sent to our servers.
• Does not identify you and is not used for statistical or advertising purposes.
• Is strictly necessary to provide the service you requested (showing you the site in your language).

If you use the Prayer Calendar (taqwamuslim.com/calendario), your Firebase Auth session — the one that keeps you signed in — is likewise stored in your browser via localStorage/IndexedDB. It is strictly necessary for the session to work (without it you'd have to sign in again on every visit) and is exempt from consent for the same reason as the language preference.

For this reason, and in accordance with Article 22.2 of Spain's Law 34/2002 on Information Society Services (LSSI-CE) — which exempts cookies or equivalent technologies "strictly necessary to provide a service expressly requested by the user" from the duty to inform and request consent — this website does not need to display a cookie consent banner.

If we add analytics, advertising, or any other non-strictly-necessary technology in the future, we will update this policy and display a banner to request your prior consent, as required by the GDPR and the LSSI-CE.

8.2 Mobile app

The mobile App does not use browser cookies (not applicable, as it is not a web environment). However, it uses similar technologies such as:

• Local storage (AsyncStorage): to save user preferences on the device (theme, language, last surah read), your conversation history with Noor and the app blocking state (chosen mode and each prayer's unlocks). This data stays on your device and is not sent to our servers.
• Firebase Analytics SDK: uses your Taqwa account identifier and an app instance identifier to log the usage events described in section 2.2; this is the data we view in Google Analytics (GA4). If you want us to stop linking it to your account or to delete it, email us at info@taqwamuslim.com.
• PostHog SDK: uses your Taqwa account identifier (or, before you sign in, an anonymous identifier) and a device identifier to log the usage events described in section 2.2. If you want us to stop linking these events to your account, email us at info@taqwamuslim.com.
• Sentry SDK: stays idle and only sends data when an error occurs, so we can diagnose and fix it.
• Advertising identifier (ADID/GAID/IDFA): we do not use it. On Android its collection is turned off in Firebase Analytics, and on iOS the App does not ask for the tracking permission (App Tracking Transparency) needed to access it.

8.3 Web app (app.taqwamuslim.com)

The web app stores these technologies in your browser:

• Necessary (always on): the Firebase Authentication session, which keeps you signed in; your language and settings, in the browser's local storage; and, if you start a payment, the cookies Stripe sets on stripe.com during the process. They are strictly necessary for the service you request and do not require consent.
• PostHog analytics (only with your consent): if you accept it, PostHog stores a cookie and local storage data with an identifier in your browser, to measure which screens and features are used (see section 2.2). They last up to 1 year or until you withdraw consent. Until you accept it, PostHog is not activated in your browser and the web app sends it no data. Only our server records the events for AI features and completed payments (section 2.2), which do not use cookies.

The first time you visit, a banner asks you to choose between Accept, Reject or Configure; accepting and rejecting carry the same weight, and the banner does not close until you choose. You can change your decision at any time from Profile or from the web app's cookie page (app.taqwamuslim.com/cookies). If you withdraw consent, PostHog stops recording data and the identifier stored in your browser is reset.

9. Changes to this policy

We may update this Privacy Policy periodically to reflect changes to the App, applicable legislation or our privacy practices.

When we make material changes, we will notify you through:

• An email to the address linked to your account.
• Updating the "Last updated" date at the top of this document.

We recommend reviewing this page periodically. Continued use of the App after changes are published constitutes your acceptance of them.

10. Contact

If you have questions, requests or comments about this Privacy Policy or about the processing of your personal data, you can contact us through:

This privacy policy has been drafted in accordance with the General Data Protection Regulation (GDPR), Spain's Organic Law 3/2018 on Data Protection (LOPDGDD), Spain's Law 34/2002 on Information Society Services (LSSI-CE), the California Consumer Privacy Act (CCPA) and the publication requirements of the Google Play Store and Apple App Store.

جَزَاكُمُ اللَّهُ خَيْرًا