# Privacy Policy

> What Suhba collects, where it is stored and why. No ads, no tracking, no data selling, and your worship stays private unless you choose to share it.

- URL: https://suhba.win/privacy
- Language: en
- Last updated: 2026-09-27
- Publisher: TODO: Legal name of the publisher (you or your company) — TODO: Postal address (street, city, postcode, country)
- Contact: support@suhba.win · Privacy: privacy@suhba.win

This Privacy Policy explains how the publisher named at the top of this page (“Suhba”, “we”, “us”) handles personal data when you use the Suhba app for iPhone and Android and the website suhba.win. It takes effect on 27 September 2026.

## In short

- We collect only what the app needs to work: your sign-in details, your profile and settings, the activities you record, and what you take part in within circles.
- Your reflections, private notes, detailed daily history, profile photo and prayer location stay on your phone. We never receive them.
- Your location is used on your phone to calculate prayer times and the Qibla direction. It is never sent to our servers.
- There are no ads, no analytics, no crash-reporting tools and no tracking across apps or websites. We never sell or share your personal data.
- You decide who sees what: only you, your circle, or anyone with your link. In each circle you choose whether companions see your activity, only your daily totals, or nothing.
- You can export your data and delete your account from the app at any time. Deletion from the app takes effect immediately.
- Because Suhba is a worship app, your data can reveal your religious beliefs. We treat all of it as sensitive.
- Questions: [privacy@suhba.win](mailto:privacy@suhba.win).

## Who we are

The publisher named at the top of this page is the controller of your personal data, meaning the party responsible for it. Its contact details are shown in the box above. For anything about privacy, write to [privacy@suhba.win](mailto:privacy@suhba.win).

## The data we collect

### When you sign in

You sign in with Google (iPhone and Android) or with Sign in with Apple (iPhone). Suhba has no passwords. From your sign-in provider we receive:

- your name;
- your email address (if you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead);
- a link to your profile photo;
- the provider’s identifier for your account.

### Data stored on our servers

Our servers are operated by Supabase, Inc. The legal bases below are those of the EU and UK General Data Protection Regulation (GDPR). “Contract” means we need the data to provide the service you asked for. “Explicit consent” is explained under [Sensitive data](#sensitive-data).

| Data | Where it is stored | Why we use it | Legal basis |
|---|---|---|---|
| Account: email, name, profile photo link, sign-in provider ID | Our servers | To create your account, sign you in and recognize you on your devices | Contract |
| Profile basics: display name, bio, visibility choices | Our servers | To show your profile only to the people you choose | Contract |
| Onboarding answers: your intention, daily rhythm, language and time zone | Our servers | To suggest a suitable program and plan your day in your local time | Contract; explicit consent |
| The status of your scheduled activities, when you record them | Our servers | To keep your plan in sync, show your progress and count toward circle goals you take part in | Contract; explicit consent |
| Titles of programs and activities you create | Our servers | To show and schedule your own programs | Contract |
| Subscription status | Our servers and RevenueCat | To unlock the app while your subscription or trial is active | Contract |
| Circles: name and description, membership and role, invite codes, shared goals and contributions, khatma assignments | Our servers | So the circle works and its members can see it | Contract; explicit consent |
| Encouragements: who sent which message to whom, and when | Our servers | To deliver encouragements and show your encouragement history | Contract |
| Admin actions in circles (audit log) | Our servers | To keep circle administration accountable and to investigate misuse | Legitimate interests (a safe, fair service) |
| Messages you send us (support, privacy, safety) | Our email inbox | To answer you, handle reports and keep people safe | Legitimate interests; legal obligation |

### Data that stays on your phone

Some data never leaves your phone. We cannot see it, and it is not stored on our servers:

- your reflections and private notes;
- your detailed daily history;
- the profile photo you choose from your phone;
- your saved prayer location;
- your preferences (such as language, numerals, appearance, reminders and prayer settings).

Uninstalling the app removes this data. Before you do, you can save a copy with **Export my data** (see [Your rights](#your-rights)).

### Location

Suhba asks for your location only while you are using the app (“while using the app” permission). Your phone uses it to calculate prayer times and the Qibla direction, and the chosen city is saved on your phone. **Your location is never sent to our servers.**

To turn your position into a city name, or when you search for a city, your phone uses its built-in geocoding service from Apple (iPhone) or Google (Android), under their privacy policies. If you prefer, you can refuse location access and type a city instead.

### Notifications

Reminders are local notifications scheduled on your phone: prayer reminders, activity reminders (which show the activity’s title) and encouragements (“Encouragement from {name}” with one of a few fixed phrases). We do not collect push notification tokens.

### Purchases

Subscriptions are sold through the App Store and Google Play. Apple or Google processes your payment under its own privacy policy. **We never receive your payment card details.** RevenueCat, Inc. processes your subscription status for us, linked only to an internal account ID: it does not receive your email or card details.

### What we do not do

- No advertising and no advertising SDKs.
- No analytics and no crash-reporting SDKs.
- No tracking across other companies’ apps or websites.
- No sale of personal data and no “sharing” of it for cross-context behavioral advertising.

### Sensitive data

Using a worship app, and recording prayer, Qur’an and adhkar, can reveal your religious beliefs. Data protection laws treat this as sensitive (“special category”) data. We process it only to provide the features you use, on the basis of your explicit consent. You can withdraw that consent at any time by deleting the relevant data or your account; this does not affect processing that took place before.

## How we use your data

We use your data only to:

- provide the app: sign-in, syncing your plan, programs, circles, khatma, goals and encouragements;
- check whether your subscription or trial is active;
- answer your messages and handle requests about your data;
- keep Suhba safe: enforce our [Terms of Service](/terms) and [Community Guidelines](/community-guidelines), investigate reports and meet legal obligations, including child-safety reporting.

We do not use your data for advertising or profiling, and we make no automated decisions that have legal or similarly significant effects on you.

## Who can see your data

### Your visibility settings

Your profile, your stats and your activities each have their own setting, which you change in **Edit profile**:

| Setting | Who can see it |
|---|---|
| Private | Only you |
| Circle | Your circle companions |
| Public | Anyone with your profile link |

### Inside a circle

- For each circle, you choose whether companions see **your activity**, **only your daily totals**, or **nothing**.
- Your display name is visible to the members of your circles.
- The circle’s khatma progress is visible to its members.
- An encouragement is visible only to the person who sent it and the person who received it.
- Circle admins can remove members and change roles, and their admin actions are logged. They do not see more of your worship than your settings allow.
- There are no public rankings. Comparing members within a circle is opt-in and off by default.

### Share cards

Share cards are images created on your phone, with a verse or up to 120 characters of your own words. They are shared through your phone’s share sheet and are not stored by us. Once you share one, the app you share it to handles it under its own policies.

### Disclosure for legal reasons

We disclose personal data to authorities only when the law requires it, or when it is necessary to protect someone from serious harm, for example when we report child sexual abuse material (see our [Child Safety Standards](/child-safety)). If Suhba’s business is transferred to another organization, your data may be transferred with it; this policy will continue to protect it, and we will tell you in advance.

## Service providers

These companies process personal data so that Suhba can work. Supabase, RevenueCat and Vercel act on our instructions. Apple and Google provide sign-in, app stores and geocoding as independent services under their own terms.

| Provider | What it does for Suhba | Data involved | Privacy policy |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and server functions | All the data stored on our servers | [supabase.com/privacy](https://supabase.com/privacy) |
| RevenueCat, Inc. | Subscription status | Internal account ID, purchase and subscription status | [revenuecat.com/privacy](https://www.revenuecat.com/privacy) |
| Apple Inc. | Sign in with Apple, App Store payments, geocoding on iPhone | Sign-in details, purchases, the location or city being looked up | [apple.com/legal/privacy](https://www.apple.com/legal/privacy/) |
| Google LLC | Google sign-in, Google Play payments, geocoding on Android | Sign-in details, purchases, the location or city being looked up | [policies.google.com/privacy](https://policies.google.com/privacy) |
| Vercel, Inc. | Hosting of the suhba.win website | IP addresses and technical request data in server logs | [vercel.com/legal/privacy-policy](https://vercel.com/legal/privacy-policy) |

Messages you send to our @suhba.win addresses are held by our email service provider.

## International transfers

Our servers are operated by Supabase, Inc., and our service providers are based in the United States and may process data in other countries. When personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on recognized safeguards, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) or an adequacy decision covering the provider. You can ask for more information at [privacy@suhba.win](mailto:privacy@suhba.win).

## How long we keep data

| Data | How long |
|---|---|
| Your account and the data linked to it on our servers | As long as you have an account. Deleted immediately when you delete your account in the app, or within 30 days of a verified request by email |
| Backups | Overwritten within 30 days |
| Purchase records | Kept by Apple, Google and RevenueCat as the law requires (for example, for tax and accounting) |
| Messages you send us | As long as needed to handle your request and meet our legal obligations |
| Website server logs | A short period set by Vercel for security and delivery |
| Data on your phone | Until you delete it or uninstall the app |

If the law requires us to preserve specific information, for example evidence linked to a child-safety report, we keep only that information, and only for as long as required.

## Your rights

Wherever you live, you can:

- **access** your data and get a copy of it;
- **correct** it: most of it you can edit directly in the app;
- **delete** it: delete your account in the app, or see [Delete your account](/delete-account);
- **take it with you** (portability): **Export my data** in the app saves the data on your phone as a JSON file, and you can ask us for a copy of the data on our servers;
- **object** to processing based on our legitimate interests, or ask us to **restrict** it;
- **withdraw your consent** at any time, without affecting earlier processing;
- **complain** to a data protection supervisory authority, such as the one in the country where you live or work (in the UK, the Information Commissioner’s Office). We would appreciate the chance to help first.

To use these rights, write to [privacy@suhba.win](mailto:privacy@suhba.win) from the email address linked to your account, so we can verify that the account is yours. It is free. We reply within one month, and if a request is complex we may extend this as the law allows, telling you why.

### California residents

This section applies under the California Consumer Privacy Act, as amended by the CPRA.

- **What we collect.** In the past 12 months we have collected the categories described above: identifiers (email address, account and provider IDs), personal records (name), commercial information (subscription status), and content you create in the app. Worship records may reveal religious beliefs, which California treats as sensitive personal information. Our website host processes IP addresses in server logs.
- **Sources.** You, your sign-in provider (Apple or Google), and the app stores through RevenueCat.
- **Purposes.** The purposes described in [How we use your data](#how-we-use-your-data). We disclose personal information only to our service providers, for these business purposes.
- **No sale or sharing.** We do not sell personal information, and we do not share it for cross-context behavioral advertising, including that of consumers under 16. There is nothing to opt out of, and we treat a Global Privacy Control signal as a valid request anyway.
- **Sensitive personal information** is used only to provide the service you request, so no separate right to limit its use is needed.
- **Your rights.** You can ask to know what personal information we collected, used and disclosed, and ask us to delete or correct it. You can use an authorized agent; we will verify the request with you. We will not discriminate against you for using your rights. We answer within 45 days, extendable once by 45 more days if we tell you.

Residents of other US states with privacy laws have similar rights, and can use them in the same way.

## Children

Suhba is intended for people aged 13 and older, or the minimum age of digital consent in their country if it is higher (for example, 16 in some EU countries). A person below that age but at least 13 may use Suhba only if a parent or guardian sets it up and supervises its use. Families are welcome to use Suhba together, with parents responsible for how their teenagers use it.

The app does not check ages, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact [privacy@suhba.win](mailto:privacy@suhba.win) and we will delete it.

## Security

- Data is encrypted in transit (TLS) and encrypted at rest by our hosting provider.
- Row-level security in the database means each person can reach only the data they are allowed to see.
- Access by our team is limited to what each task requires (least privilege).

No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.

## This website

The suhba.win website uses **no cookies and no analytics**. Our hosting provider, Vercel, Inc., processes IP addresses in server logs to deliver the site and keep it secure. Links to the App Store or Google Play take you to those stores, which have their own privacy policies.

## App Store privacy labels summary

This summary matches the “App Privacy” details the publisher declares on the App Store. All data below is used for app functionality only.

| Category | Data types | Linked to you | Used for tracking |
|---|---|---|---|
| Contact Info | Email address, name | Yes | No |
| User Content | Profile, circle content | Yes | No |
| Identifiers | User ID | Yes | No |
| Purchases | Subscription status | Yes | No |

- **Data Not Linked to You:** none.
- **Tracking:** none. Suhba does not track you across other companies’ apps or websites.

## Changes to this policy

We will update this policy when the app or the law changes. We will publish every change on this page with a new “Last updated” date. If a change significantly affects how we use your data, we will tell you in the app or by email before it takes effect.

## Contact

- Privacy questions and requests: [privacy@suhba.win](mailto:privacy@suhba.win)
- Everything else: [support@suhba.win](mailto:support@suhba.win)
- Our postal address is in the box at the top of this page.