Privacy Policy

1. Scope and Applicability

This Privacy Policy applies to all information collected through the Prayr web application, mobile-responsive website, the Prayr apps for iOS and Android, related public pages (including our landing page, blog, and release notes), and any communications you have with us (including support inquiries and feedback). This policy governs our practices regardless of the device or platform you use to access the Service.

This Privacy Policy does not apply to third-party websites, services, or applications that we link to, embed, or integrate with (such as Google OAuth, Discord OAuth, external Quran audio providers, or podcast feeds). Those third parties are governed by their own privacy notices and terms. We encourage you to review their policies before providing any information to them.

2. Information We Collect

We collect information in several ways: directly from you when you provide it, automatically when you use the Service, from third-party authentication providers when you sign in with them, and from integrated services that support our functionality. The categories of information we may collect include:

2.1 Account and Identity Information

• First name and last name
• Email address
• Account identifiers and user IDs
• Profile photograph (if you choose to upload one)
• Authentication metadata (e.g., account creation date, last login)

2.2 Credentials and Access Data

• Password (stored in encrypted form via our authentication provider)
• Session tokens and authentication state
• Password reset tokens (temporary, for account recovery)

2.3 Social Sign-In Data

When you sign in using Google or Discord OAuth, we receive information that those providers share with us according to their permissions and your settings. This may include your name, email address, profile picture, and unique identifier from the provider. We do not control what data these providers share; please review their respective privacy policies.

2.4 Settings and Preference Data

• Theme preference (light, dark, or system)
• Language and display preferences
• Notification settings (e.g., prayer reminders)
• Prayer calculation method and madhab
• Prayer time offsets and adjustments
• Selected reciters, translations, and Quran display options
• Other in-app preferences you configure

2.5 Location-Related Data

To provide accurate prayer times and location-specific features, we may collect and process:

• Country, city, state, or region
• Timezone
• Approximate or precise geographic coordinates (when you enable location services or search for a location)

You can choose to enter a location manually or use browser/device location. We use this data solely to calculate prayer times and display relevant content. Prayer times are calculated on your device. Your location reaches our servers only when you are signed in (it is saved with your settings so they follow you between devices) or when you turn on prayer-time push notifications (we store the coordinates and timezone with your notification subscription so reminders arrive at the right time).

2.6 Worship and Habit Tracking Data

When you use our prayer tracking and habit logs, we may collect:

• Prayer logs (prayer name, time, type, quality, completion status)
• Streaks and historical completion statistics
• Daily habit entries (e.g., Quran reading, dhikr, tahajjud)
• Fasting log entries (Ramadan and voluntary fasts, taraweeh)

This data is sensitive as it may reveal religious practice. We process it only to provide the features you choose to use and to personalize your experience.

2.7 Quran, Dua, and Content Interaction Data

• Bookmarked verses, duas, and content
• Selected reciters, translations, and tafsir preferences
• Article views, podcast plays, and listening history
• Recent activity and progress (e.g., Quran reading progress)
• Daily dua selections

2.8 Community and Feedback Data

• Feature requests (title, description, status)
• Bug reports (title, description, severity, screenshots)
• Comments, upvotes, and interactions on feedback items
• Optional image attachments you upload with feedback

2.9 Scholar Application Data

If you submit a scholar application, we collect:

• Application statements and qualifications
• Educational background and years of study
• Expertise areas, languages spoken, and madhab
• Supporting documents and attachments you upload

This data is used solely for reviewing and processing your application and is handled with additional care given its sensitivity.

2.10 Communication and Marketing Preference Data

• Opt-in or opt-out choices for product updates and announcements
• Email communication history (e.g., support correspondence)

2.11 Technical and Usage Data

• Device type, browser type, and operating system
• IP address and general geographic region
• Log data (e.g., access times, pages visited, actions taken)
• Error reports and crash information
• Cookies, local storage, and session storage data
• Analytics events where analytics runs (see section 10)

When you create an account we record which platform you signed up on, how you found Prayr (for example a search engine or a link), your country, and the days you use Prayr and on which platform, to understand how Prayr is used. Separately, we count how often features are used (for example “opened the Qur'an reader”) without knowing who. We never record what you pray or read.

2.12 Prayr Mobile Apps (iOS and Android)

The native apps use the same account and the same data as the website. In addition:

• Crash and diagnostic reports: when the app crashes or hits an error, it sends a short technical report to Prayr's own servers (see section 2.13). You can turn this off in the app under Settings → Privacy → Send crash reports.
• Push notification tokens: if you allow notifications, the device push token issued by Apple (APNs) or Google (Firebase Cloud Messaging) is stored with your account so we can send reminders. It is removed when you sign out, turn off notifications or delete your account.
• Location: used on your device to calculate prayer times and the qibla direction. It is sent to us only in the cases described in section 2.5.
• App version: the app tells our servers its platform and version (for example “ios/1.2.0”) so we can keep old versions working and ask you to update when needed.

2.13 Crash and Error Reports

When the Prayr app crashes or hits an error, it sends a short technical report to Prayr's own servers so we can find and fix the problem. We do not use a third-party crash-reporting service. A report contains:

• what went wrong: the error message, the technical trace of where it happened in our code, and whether the app closed;
• the screen it happened on and the last few screens you opened (their addresses only, which can show, for example, which surah or du’a page was open);
• the app version, the platform (iOS or Android), the operating system version and the device type (the make and model of an Android phone, or only whether it is an iPhone or an iPad);
• a random installation identifier created by the app, which is not your device's hardware or advertising identifier;
• your account ID, if you are signed in.

Before a report leaves your device, and again when we store it, we remove email addresses, sign-in tokens and passwords, the query part of web addresses, precise numbers such as coordinates, and long numbers such as phone numbers. Reports do not include your prayer log, habits, fasting log, du’a or Qur'an progress, bookmarks or location. We use your IP address only briefly, to limit abuse of the reporting service, and do not store it with the report.

Reports of the same error are grouped: when it happens again on the same app version, the newest report replaces the details of the previous one, and we keep a count. Only Prayr administrators can view reports. A grouped report is deleted automatically once that error has not occurred for 90 days. Crash reports are not included in Download my data, because a grouped report describes an error in the app, counted across everyone who hit it, rather than content of yours. If you delete your account, reports you sent stay until they are deleted, but are no longer linked to you.

Crash reports are on by default in the app. To turn them off, go to Settings → Privacy → Send crash reports; nothing is recorded while they are off, and reports waiting on your device are deleted. The website and the desktop app do not send crash reports.

3. How We Use Your Information

We use the information we collect to operate, maintain, and improve the Service. Specifically, we use your information to:

• Create, manage, and secure your account and sessions
• Authenticate your identity and prevent unauthorized access or abuse
• Provide prayer time calculations based on your location and preferences
• Power prayer tracking and habit logging
• Deliver Quran recitation, audio, translations, and tafsir content
• Provide duas, dhikr, podcasts, and Islamic articles
• Operate the zakat calculator and related tools
• Personalize your experience (theme, language, notifications, content recommendations)
• Process scholar applications and manage related review workflows
• Operate the feedback board, bug reports, and community features
• Maintain security, detect and prevent fraud, and troubleshoot technical issues
• Analyze usage patterns to improve usability, performance, and feature quality
• Send service-related communications (e.g., password resets, important notices)
• Send product updates and announcements (only if you have opted in)
• Comply with legal obligations and enforce our Terms of Service

4. Legal Bases for Processing (GDPR and Similar Laws)

Where applicable under data protection laws (such as the GDPR in the European Union and UK), we process your personal data based on one or more of the following legal bases:

• Performance of a contract: To provide the Service you have requested and to fulfill our obligations under our Terms of Service.
• Legitimate interests: To operate and improve the Service, maintain security, prevent abuse, and analyze usage for product improvement, where such interests are not overridden by your rights.
• Consent: For optional features (e.g., marketing communications, and analytics in the EU, the EEA, the UK and Switzerland) where we have obtained your explicit consent.
• Explicit consent for worship records (GDPR Art. 9(2)(a)): Prayer logs, habits and du’a progress can reveal your religious beliefs. We ask for your explicit consent before storing them with your account (when you create an account or import data saved on your device) and record when you gave it. You can withdraw it at any time by deleting your account; as a guest, these records stay on your device only.
• Legal compliance: To comply with applicable laws, regulations, court orders, or government requests.

5. Third-Party Services and Data Sharing

We work with third-party service providers to deliver the Service. These providers may have access to your information only to the extent necessary to perform their functions. Depending on our configuration and the features you use, these may include:

• Authentication and database: Supabase (and related infrastructure) for user authentication, database storage, and backend services.
• Cloud storage: AWS S3, Cloudflare R2, or similar providers for file uploads (e.g., profile images, feedback attachments, scholar application documents).
• Analytics: Google Analytics, to count page visits and a few account events such as sign-in: after you allow it in the EU, the EEA, the UK and Switzerland, and on by default elsewhere (section 10). It never receives what you log (prayers, habits, du’as, Qur'an reading). It sees the country you visit from, not your exact location.
• Email and workflows: Email service providers for transactional emails, password resets, and optional marketing communications.
• Location and content APIs: Services used for location lookup, prayer time calculations, and Islamic content delivery.
• OAuth providers: Google and Discord, when you choose to sign in with them.
• Push delivery: your browser's push service, Apple Push Notification service and Firebase Cloud Messaging, to deliver the reminders you turn on.
• Crash reporting: none. Crash and error reports go only to Prayr's own servers and database (see section 2.13).

We require our service providers to protect your information and use it only for the purposes we specify. We do not sell your personal information to third parties.

We may also disclose your information if required by law, court order, or government request; to protect the rights, property, or safety of Prayr, our users, or the public; or in connection with a merger, acquisition, or sale of assets (with appropriate notice where required).

6. International Data Transfers

Prayr may be operated and supported using infrastructure and service providers located in multiple countries. By using the Service, you understand that your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States and other jurisdictions where our service providers operate.

Where required by law (e.g., for transfers from the European Economic Area or UK), we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) or other mechanisms approved by relevant data protection authorities.

7. Data Retention

We retain your information for as long as necessary to provide the Service, maintain your account, resolve disputes, enforce our terms, comply with legal obligations, and protect platform integrity. Retention periods vary by data type:

• Account and worship data: kept while your account exists. When you delete your account it is erased immediately (see section 7.1).
• Guest data: stays on your device and is never sent to us unless you sign in and choose to import it.
• Push subscriptions: kept until you turn notifications off, the subscription stops working, or you delete your account.
• Crash reports: deleted automatically once the error they describe has not occurred for 90 days (section 2.13).
• Days you used Prayr: deleted after 13 months. Sign-up details (platform, how you found Prayr, country) are kept with your account. Feature counts hold nothing about you.
• Feedback and community content: kept while the content is published. If you delete your account it stays without your name (section 7.1).
• Uploaded files: profile pictures, bug-report screenshots and scholar-application documents are deleted with your account. Images inside community posts and published articles stay with that content.
• Deletion records: after an account is deleted we keep its former ID, a one-way hash of its email address and the date, so we can confirm the deletion if asked. Records of moderation actions taken on an account are kept for safety and legal purposes.
• Backups: encrypted database backups expire on our hosting provider's rolling schedule. We do not restore deleted accounts from them.

7.1 Deleting your account

You can delete your account yourself inSettings → Profile → Delete account, on the web or in the app. Deletion is immediate and permanent: your sign-in, profile, prayer log, habits, fasting log, du’a progress and bookmarks, settings, notifications, push subscriptions, community memberships, scholar applications, private feedback messages and uploaded pictures are erased, and you are signed out everywhere. Feature requests, bug reports, comments, community posts and published articles you wrote stay, without your name. Crash reports you sent stay, no longer linked to your account, until they expire (section 2.13). If you cannot sign in, seeprayr-app.com/delete-account.

7.2 Downloading your data

In Settings → Profile → Download my data you can download everything stored with your account as a machine-readable JSON file, once an hour.

When data is no longer required for legitimate business or legal purposes, we delete or de-identify it in accordance with our operational and legal requirements.

8. Security

We implement administrative, technical, and organizational measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption in transit and at rest (where applicable), access controls, secure authentication practices, and regular security assessments.

However, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

9. Religious and Sensitive Data

Prayr is a faith-centered platform. Certain features, such as prayer logs, habit tracking, and scholar applications, may reveal information about your religious beliefs or practices. In some jurisdictions, this may be considered "special category" or "sensitive" data under data protection laws.

We process this data solely to provide the features you choose to use. We do not use it for profiling, advertising, or purposes unrelated to the Service. You should use these features based on your own comfort level and in accordance with your local legal context.

10. Cookies, Local Storage, and Similar Technologies

We use cookies, local storage, session storage, and similar technologies to keep you signed in, remember your preferences, maintain application state, and improve the Service.

Analytics (Google Analytics). In the EU, the EEA, the UK and Switzerland, and wherever we can't tell your country, it loads only after you allow it in the banner we show on your first visit. Everywhere else it is on by default, and a short notice says so. You can turn it off below or in Settings → Privacy at any time; that choice is kept on your device. Advertising storage, ad user data and ad personalisation are always off. We tell the regions apart by the country our hosting provider (Cloudflare) attaches to each request; we don't keep your IP address for this.

Where analytics runs, we also keep on your device how you first arrived (the referring site's name and any campaign tags, never full web addresses) until you create an account. Prayr's own feature counts store nothing on your device.

Analytics is not running on this site, so there is nothing to allow or turn off.

You can control cookies and local storage through your browser settings. Disabling or blocking these technologies may affect Service functionality (e.g., you may need to sign in repeatedly, or preferences may not be saved).

11. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your information in certain circumstances.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time.

You can download your data and delete your account yourself at any time (sections 7.1 and 7.2). To exercise any other right, contact us at support@prayr-app.com. We may need to verify your identity before processing your request. You may also have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction.

12. California Privacy Notice (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: You can request information about the categories and specific pieces of personal information we have collected about you.
• Right to delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to correct: You can request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell personal information in the traditional sense. We do not share personal information for cross-context behavioral advertising in a way that would constitute a "sale" or "sharing" under California law.
• Right to limit use of sensitive personal information: You can request that we limit our use of sensitive personal information to certain purposes.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a request, contact us at support@prayr-app.com. We will respond within the timeframes required by applicable law.

13. Children's Privacy

The Service is not intended for children under the age at which parental consent is required under applicable law (typically 13 in the United States and 16 in the European Union, though this varies by jurisdiction). We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information without appropriate parental or guardian consent, please contact us at support@prayr-app.com, and we will take steps to delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Service. When we make material changes, we will update the "Last Updated" date at the top of this policy and may provide additional notice (e.g., via email or an in-app notification) where appropriate.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

15. Contact Us

For questions about this Privacy Policy, to exercise your privacy rights, or to raise any data protection concerns, please contact us at:

Email: support@prayr-app.com

Website: https://prayr-app.com

We will respond to your inquiry as promptly as possible and in accordance with applicable law.