Nura privacy policy

Last updated: [EFFECTIVE DATE]

Nura ("the app") is provided by [COMPANY NAME] ("we", "us"), [ADDRESS]. We are the data controller for the personal data described here. Contact us at [CONTACT EMAIL].

The short version: prayer times and the Qibla are worked out on your phone. We don't show ads, we don't use advertising IDs and we don't sell your data. Usage analytics are off unless you turn them on.

What stays on your phone

Your location. When you allow location access, the app uses it on your phone to calculate prayer times and the Qibla direction. Your current position is not sent to us, except for the mosque search described below.
Prayer and notification settings, the adhan schedule and Quran reading progress are stored on your phone. If you have an account, your settings also sync to it (see below).
Zakat calculations. The amounts you enter and your saved calculations never leave your phone. Only the date of your Zakat anniversary syncs to your account, if you have one.
Downloaded Quran audio is stored on your phone.

What we collect, and why

Your account (optional)

You can use the app without an account. If you create one (with email, Sign in with Apple or Google), we store:

your email address and a securely hashed password if you choose one (or the identifier Apple or Google gives us);
your name, if you give one or your Apple or Google account shares it;
your language and your marketing choice (below);
the things you choose to sync: prayer and notification settings, saved places, favourites (verses, duas, mosques, reciters), Quran bookmarks and their notes, tasbih counts and your Zakat anniversary date.

Saved places include the place's name and coordinates. If you save a place (for example "Home") while signed in, it is stored in your account so it appears on your other devices. Your current GPS position is never saved unless you save it as a place yourself.

We use this data to run your account and keep your devices in sync (legal basis: performance of our contract with you). Account data is stored with our database provider, Supabase ([SUPABASE REGION]).

Marketing emails (only if you opt in)

If you tick the box to receive news from us, we store that choice and when you made it, and we may email you about Nura. You can opt out at any time in the app (Account) or with the link in any email (legal basis: consent). [EMAIL PROVIDER] sends our emails.

Mosque search

To find mosques near you, the app sends your current coordinates to our server, which looks up nearby mosques and returns the list. The coordinates are used only to answer that request: we don't store them or write them to our logs. Mosque data comes from OpenStreetMap.

Halal food map

The halal food map works like mosque search: your coordinates go to our server only to find places near you and are not stored or logged. Places come from OpenStreetMap, from the businesses themselves and from our users. Some businesses pay to be Nura partners: they get a "Nura partner" badge, photos and an offer line in the halal map, and nothing else. Partners are never ranked higher. For each partner we count, per day, how often its place was shown on the map and opened: counts only, with nothing about who saw it. The app doesn't send anything that identifies you for this.

If you report a problem with a place, we store the place, your reason, any note you write and your account ID, so we can look into it and stop duplicate reports (legal basis: our legitimate interest in accurate listings). Businesses never see who reported them. Reports are kept for [REPORT RETENTION, e.g. 12 months after they are closed].

Business accounts (the business portal)

If you sign up a business on our website, we store your email address (for the sign-in code), the place you claimed, your listing's content (description, offer, opening hours, photos) and your halal certificate, which only our moderators see (legal basis: performance of our contract). Payments for partner listings are handled by Stripe: Stripe receives your billing details and card; we receive only a customer ID and the subscription status, never card numbers. Stripe's privacy policy: https://stripe.com/privacy. A business account is separate from app use: the email you use for the portal isn't shown in the app.

City search

City search uses a database built into the app. Only if a city isn't found there does the app send the text you typed (not your location) to an online place-search service, [GEOCODING PROVIDER], to look it up.

Maps

The Qibla map and mosque map load map images ("tiles") from MapTiler. Like any web request, MapTiler receives your device's IP address and the map area being shown. MapTiler's privacy policy: https://www.maptiler.com/privacy-policy/

Quran translations and recitations

Translations and recitations come from the Quran Foundation (Quran.com) through our server. Recitation audio is streamed from the Quran Foundation's audio servers, which receive your device's IP address. We don't send them any account information.

Subscriptions

Payments are handled by Apple (App Store) or Google (Google Play). We never see your card details. We use RevenueCat to check whether you have an active subscription. RevenueCat receives an app user ID (a random ID, or your account ID once you sign in), your purchase history for Nura and basic device information (such as the operating system and app version) (legal basis: performance of our contract). RevenueCat's privacy policy: https://www.revenuecat.com/privacy/

Crash reports

When the app or our server crashes or hits an error, a crash report is sent to Sentry so we can fix it. Crash reports contain technical information only: the error, the app version, the device model and operating system. We remove personal data before a report is sent: no name, no email, no account ID, no IP address and never your location. Crash reporting doesn't depend on the analytics setting below (legal basis: our legitimate interest in a working app). Sentry's privacy policy: https://sentry.io/privacy/

Analytics are off by default. If you turn on "Share anonymous usage data" in Settings, the app sends a small set of events to PostHog (hosted in the EU): for example which onboarding step you reached, when the subscription screen was shown, when a trial started and which features were opened. Events carry a random ID, the app version and the platform. They don't include your location, your email or any advertising ID. Until you sign in, events are anonymous; once you sign in they are linked to your account ID (never your email). You can turn analytics off at any time; the app then stops sending events and deletes the random ID (legal basis: consent). PostHog's privacy policy: https://posthog.com/privacy

What we don't do

We don't show ads or pop-ups and we don't use advertising IDs (IDFA or Google Advertising ID). The "Nura partner" badge in the halal food map marks a business that pays for a richer listing; it is never placed in banners, pop-ups or notifications.
We don't sell or rent your personal data, and we don't share it for advertising or tracking.
We don't track you across other companies' apps or websites.

Service providers

We use these providers to run the app. They process data on our behalf and only for the purposes above:

Supabase: database, accounts and sign-in.
Fly.io: hosting for our server (London).
RevenueCat: subscription status.
Sentry: crash reports.
PostHog (EU): usage analytics, only with your consent.
MapTiler: map tiles.
Stripe: payments for business partner listings (businesses only).
Quran Foundation: Quran translations and recitations.
[EMAIL PROVIDER]: sign-in and marketing emails.
Apple and Google: Sign in with Apple, Google sign-in, payments and app distribution.

Some providers may process data outside the UK and the European Economic Area. Where they do, we rely on adequacy decisions or standard contractual clauses.

How long we keep data

Account data: until you delete your account.
Mosque search coordinates: not kept.
Crash reports: [CRASH REPORT RETENTION, e.g. 90 days].
Analytics events: [ANALYTICS RETENTION, e.g. 12 months].
A record that an account was deleted (with no name or email) is kept for [DELETION LOG RETENTION] to show we handled the request.
Business accounts: while the listing is active, then [BUSINESS DATA RETENTION, e.g. 30 days] for photos and certificates; payment records as long as tax law requires.
Account deletion requests made on our website (the email address you enter and when you sent it): until we have handled the request, then for [DELETION REQUEST RETENTION, e.g. 90 days].

Your rights

You can delete your account and its data at any time in the app (Account → Delete account) or at [ACCOUNT DELETION URL]. If you ask on the website, we email the address you entered to confirm the request before deleting anything (legal basis: legal obligation). Under UK and EU data protection law you also have the right to access, correct, export or restrict your data, and to object to processing. Email [CONTACT EMAIL] to use these rights. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

Nura is a general-audience app and is not directed at children under 13. We don't knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact [CONTACT EMAIL] and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top and, for significant changes, tell you in the app.

Contact

[COMPANY NAME], [ADDRESS]. Email: [CONTACT EMAIL].