Deen Mate ("we", "us", "the app") is an Islamic companion app operated as part of the DeenMate platform. We care deeply about your privacy and treat every piece of data you share with us as an amanah (trust). This policy explains what we collect, why we collect it, who can see it, how long we keep it, and the controls you have over it.

If you do not agree with this policy, please do not use the app. By creating an account you confirm that you have read and understood this document.

1. Who is responsible for your data

The controller of your personal data is the Deen Mate team. For any privacy question, correction request, deletion request, or complaint you can email [email protected].

2. What data we collect

2.1 Account information

• Full name, username, email address (or phone number where enabled).
• Password — stored only as a bcrypt hash. We never see or store your plain-text password.
• Date of birth and gender, used to enforce age restrictions and to show culturally-appropriate defaults (for example, marriage-related fields).
• Preferred language and theme so the app remembers your choice across devices.

2.2 Profile fields you choose to share

• Bio, profile picture, cover photo, work, education, hometown, current city, marital status, religious affiliation (madhhab), and social links.
• Every one of these fields has a visibility control — Public, Friends only, or Only me. You can also lock your entire profile so only accepted friends can see it.

2.3 Content you create

• Posts, photos, comments, reactions, shared posts, saved posts, and feelings.
• Private messages, voice notes, and audio/video call metadata (start time, end time, duration, missed / declined status). Message content in one-to-one chats is only visible to you and the recipient.
• Blood donation availability, blood requests, and the location range you agree to be searchable in.
• Islamic activity that you log — prayer completions, tasbih counts, zakat calculations, Qur'an bookmarks and reading progress.

2.4 Device and security signals

• IP address, browser or device user-agent, approximate device fingerprint, and login timestamps — used only for security, fraud prevention, rate-limiting and to send you login alerts on new devices.
• Push-notification tokens (only if you enable notifications).
• 2FA data if you enable it — email OTP hashes, TOTP secret (encrypted), and optional face-recognition embeddings computed on your device.

2.5 Location

• Coarse or precise location is used only to compute your prayer times, Qibla direction, nearby mosques and (if you opt in) blood-donor matching.
• You may skip GPS entirely and pick a district manually. Location is never shared with third parties or shown on your public profile unless you explicitly enable the "Show my city" field.

2.6 Cookies and local storage

• We use first-party cookies and localStorage/IndexedDB for authentication tokens, session persistence, cached Qur'an pages for offline reading, preferences and query cache.
• We do not use third-party advertising cookies, tracking pixels, or cross-site retargeting.

3. What we never do

• We never sell, rent or trade your personal data to third parties.
• We never share your private messages, call recordings, or private profile fields.
• We do not run ad-tracking or behavioural retargeting on ibadah screens (Prayer, Qur'an, Tasbih, Dua, Hadith).
• We do not use your data to train third-party AI models. Any AI features run through providers under strict processing agreements.

4. Why we process your data (lawful bases)

• Contract — to create your account and deliver the features you request (prayer times, Qur'an, community, messaging).
• Consent — for optional features such as push notifications, location, blood-donor listing, face-login, and marketing emails. You can withdraw consent at any time.
• Legitimate interest — to keep the platform secure, prevent abuse, and moderate haram content.
• Legal obligation — when required by law to retain or disclose specific records.

5. Who can see your data

• You — always, in full.
• Other users — only what your privacy settings allow. Locked profiles show just your name, avatar, cover photo and a "This profile is locked" notice.
• Deen Mate staff — only a small number of authorised administrators, and only when needed to investigate abuse or a support request.
• Service providers — trusted infrastructure partners (hosting, push notifications, email delivery, S3-compatible storage, WebRTC signalling, optional AI). They act as processors under contract and cannot use your data for their own purposes.
• Law-enforcement — only in response to a valid, legally binding request, and only the minimum required.

6. Content moderation and NSFW guard

To keep the community aligned with Islamic values, images and text you upload are automatically scanned for nudity, violence and other haram content before they are published. This scanning happens either on your own device or on our servers and is used solely to accept or block the upload — it is never sold or shared. Reports from other users are reviewed by human moderators.

7. Data retention

• Account and profile data are kept while your account is active.
• When you delete your account, personal data is permanently removed within 30 days, except items we must keep by law (e.g. security logs for a limited period).
• Backups are rotated regularly; deleted content is purged from backups within the standard backup cycle.
• Posts you delete are removed immediately from public view and permanently within 30 days.

8. Security measures

• Passwords are hashed with bcrypt; sensitive tokens are stored server-side and revoked on logout.
• Optional 2-Factor Authentication via email OTP or Google Authenticator TOTP, plus optional face-login.
• All traffic is encrypted end-to-end in transit with TLS 1.2+.
• Brute-force lockouts, per-account rate-limits, device fingerprinting, and login alerts for new devices.
• Uploads pass through MIME validation, EXIF stripping, and NSFW scanning.
• Regular security scans and an audit log of sensitive actions (login, password change, 2FA changes, admin actions).

No online service can promise absolute security, but we work continuously to protect your data and will notify affected users without undue delay if a breach ever occurs.

9. Your rights and controls

You can, at any time, from Settings inside the app:

• Access and export a copy of your data.
• Correct any profile field.
• Restrict visibility per field to Public, Friends, or Only me.
• Lock your entire profile.
• Delete individual posts, photos, messages or your entire account.
• Withdraw consent for notifications, location, blood-donor listing, or face-login.
• Object to a specific use of your data by writing to us.

Depending on where you live (EU/UK GDPR, California CCPA, Bangladesh DPA, etc.) you may have additional statutory rights, including the right to lodge a complaint with your local data-protection authority. We will honour all valid requests without discrimination.

10. Children

Deen Mate is not directed at children under 13 (or the equivalent minimum age in your country). Accounts found to belong to a child under this age will be removed. Parents who believe their child has registered can contact [email protected] for immediate deletion.

11. International transfers

Our servers may be located in countries different from yours. When we transfer data internationally we rely on standard contractual clauses or equivalent safeguards to keep your data protected.

12. Third-party services

Deen Mate integrates a small number of trusted providers, for example: hosting/CDN, push notifications, transactional email, object storage, WebRTC signalling for calls, and optional AI providers. These processors receive only the minimum data required to deliver their function and are bound by data-processing agreements. Links to non-Deen-Mate websites are provided for convenience only; their privacy policies apply to their own sites.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced in-app with a banner and, where required, by email before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision.

14. Contact us

For privacy questions, data-access requests, or complaints, email [email protected]. For general help, use the Contact page.

"Indeed, Allah commands you to render trusts (amanaat) to whom they are due." — Surah An-Nisa 4:58