1. Who we are and what this covers

Qurba (“Qurba”, “we”, “us”) is a community-powered directory that helps Muslims discover and support masjids and Muslim-owned businesses near them. This Privacy Policy explains what the Qurba iOS app and the website at qurba.us (together, the “Service”) collect, why, who it is shared with, and the choices you have. It pairs with our Terms of Use.

Qurba is intended for users in the United States and Canada. The app may be downloadable elsewhere, but it is designed for U.S. and Canadian users, and we handle data to a baseline consistent with U.S. state privacy laws and Canada's PIPEDA.

2. A note on religious affiliation

Qurba is built for the Muslim community. Using the app, searching for Muslim-owned businesses, posting reviews or following others can reveal or imply that you are Muslim. Some privacy laws treat religious affiliation as sensitive information.

We want to be upfront: we do not ask you to state your religion, and we do not require it. We treat the fact that you use Qurba with care. We minimise what we collect, we never sell your data, and we never use it to target you with advertising across other apps or websites.

3. Information we collect

Information you give us

Account details. An email address and password when you create an account, or your name and email address from Google or Apple if you sign in with them (with Sign in with Apple you can hide your address behind an Apple private-relay email). We store a unique user ID for your account and, for email accounts, whether the address has been verified.
Profile. A display name or username (you are not required to use your legal name) and, optionally, a first and last name, profile photo, bio and phone number.
Content you share. Reviews, ratings, photos, halal-status votes, community vouches, masjid classifications, saved lists, follows, and business or location submissions (“your content”).
Business claims. Where owner tools are available and you claim a listing: the business contact information you provide and, where applicable, halal-certification documents you upload (for example a photographed certificate, the certifying body and its expiry date). See Section 8.
Messages to us. Anything you send when you contact support or report a problem, along with the reply address and category you choose. Support requests automatically include your app version, device model, OS version and language so we can help faster.

Information collected automatically

Device and technical data. Device type, operating system, app version, language and IP address.
Usage data. Which screens and features are opened, and searches and interactions within the app, through Google Firebase Analytics, so we can understand engagement and improve the app. Analytics is tied to a per-install identifier, not to advertising identifiers.
Location, in the moment. When you use location features, the app reads your current location to show what is nearby. Section 4 describes exactly how this works.
Push token. An identifier that lets us send you notifications, if you turn them on.
Moderation signals. We apply automated filtering to content you submit, for example profanity detection on text, and automated image screening (Google Cloud Vision SafeSearch) on photos before they are published. Flagged items are held for a person to review.
Trust signals. To weigh votes, vouches and reports, we consider whether an account's email is verified, how it signed in, and how long it has existed.

4. How location works (and what we don't do)

Location is the most sensitive thing the app touches, so here is the plain version:

In the moment, then forgotten. When you use the app, it checks your current location to answer “what's near me”, to calculate prayer times and distances, and to sort what needs your help nearby, then discards it. We do not build a history of where you have been.
A coarse area for community features. To offer a city-level leaderboard and nearby needs, the app may store a coarse area code (a geohash covering several city blocks) for your account, refreshed occasionally. It is not a precise location and not a trail.
Prayer times use your coordinates. To calculate prayer times, the app sends your coordinates (and nothing else, no account information) to the Aladhan prayer-times service. The request returns that day's times and is not tied to your identity.
Never in the background. The app never checks your location when it is closed or running in the background.
Saved locations stay on your device. If you set a saved location (for example a home area), it is stored on your device, not on our servers.
The location we keep is what you deliberately attach. For example, the business location tagged in a submission, or a list you choose to share with someone.
Photos are re-encoded on upload. Photos are compressed and re-encoded before storage, which removes embedded metadata, including any GPS coordinates the original photo contained.

5. How we use your information

We use information to:

run and provide the Service: accounts, listings, maps and search, reviews, halal-status and community-vouch systems, follows, lists, Khair points, prayer times and directions;
keep Qurba safe and trustworthy: detect and prevent fake reviews, spam, fraud and abuse, and moderate reported content;
communicate with you: verification and account emails, replies to support requests, and push notifications you have enabled;
improve the app, using usage data;
meet legal obligations and enforce our Terms of Use.

What we don't do: we do not sell your personal information and we do not “share” it for cross-context behavioural advertising. We do not use advertising identifiers or track you across other apps and websites. Any promoted content is contextual, based on what you are browsing in the moment, not built from a profile of you.

6. What other users can see

Display name, not legal name. Your reviews appear under your display name or username.
Reviews are public. A directory only works if reviews are visible. Your reviews, ratings and photos appear on the listing they are about.
Your profile is visible to other users. Your display name, username, photo, bio, reviews, submissions count, and follower and following lists can be viewed by other users of the app.
Leaderboard. If you earn Khair points, your display name, role and standing may appear on the community leaderboard.
Vouches and votes are counted, not attributed. Other users see totals and the resulting status, not how you personally voted.
Never shown to other users: your email address, phone number, saved locations, precise location, or support messages.

Service providers who run the Service on our behalf

Google Firebase: our backend: Authentication (login), Firestore (database), Cloud Storage (photos), Cloud Functions, Cloud Messaging (push notifications), Installations and Analytics (usage). Google processes this data on our instructions under its data-processing terms.
Google Cloud Vision: automated screening of photos before publication.
Typesense: our search provider. Search queries and the map area you are searching are processed to return results.
Apple Maps (MapKit): maps, place details, directions and “near me” search, under Apple's terms.
Google Places: place search and autocomplete when you submit a place; your search text is processed by Google to return suggestions.
Aladhan: a prayer-times service that receives your coordinates (without account information), as described in Section 4.
Resend: delivers our transactional emails (verification codes, account notices, support replies).
Vercel: hosts this website and the link-preview image service (Section 15).
Sign-in providers. If you sign in with Google or Apple, those providers process your sign-in per their own terms and your settings with them.

Others

Other users: the parts of your content and profile described in Section 6.
Anyone you share a link with: if you share a place, list or profile from the app, the link opens a public page that shows what the app already shows publicly.
Legal and safety: we may disclose information if required by law, or to protect the safety, rights or property of users, the public or Qurba (for example, responding to reports of illegal content).
A change of ownership: if Qurba is ever merged into or acquired by another organisation, your information would transfer under this policy, and we would tell you first.

We do not share your information with advertisers or data brokers, and we do not sell it.

8. Business claiming and verification

Owner tools (claiming a listing, replying to reviews) are not offered to everyone at all times. Where they are available and you claim a listing, we collect what is needed to confirm your connection to the business and to display accurate status information: business contact details you provide; for certified-halal claims, the certification documents you upload, the certifying body and the certificate's expiry date; and for owner-assured claims, your confirmation that the information is accurate. Certification documents are used to review and display the listing's status and are not shown publicly. Claiming a business does not transfer ownership of the listing or its reviews.

9. Children

Qurba is for users 13 and older. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it. If you believe a child under 13 is using Qurba, please contact us (Section 16).

10. How long we keep information

Account and profile data: kept while your account is active.
In-the-moment location: not retained (Section 4). A coarse area code, where used, is overwritten when it refreshes and deleted with your account.
Your content: kept until you delete it or your account.
Support messages: kept for up to two years so we can follow up on recurring issues.
Analytics: Firebase Analytics retains event data for up to 14 months.
On account deletion: we delete or de-identify your personal information, except where we must keep something to meet a legal obligation or resolve a dispute. See Delete your account for exactly what happens.

11. Your choices and rights

Access, correct or delete your information, edit or remove your content, and delete your account from within the app (Profile → Settings → Manage account) or by contacting us.
Permissions. You control location, camera, photo and notification access in your device settings. The app works with these turned off, with reduced functionality.
Notifications. Turn push notifications off at any time in the app or in iOS Settings.
Sign-in privacy. With Sign in with Apple you can hide your email address from us entirely.

12. U.S. state and Canadian privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other U.S. states with privacy laws, or Canada), you may have rights to know what personal information we hold about you, to access or receive a copy of it, to correct it, to delete it, and to opt out of its sale, sharing for targeted advertising, or use in profiling with legal effects. We honour these baseline rights for all U.S. and Canadian users, whether or not a law requires it in your state or province, and we will not discriminate against you for exercising them.

For California residents: in the past 12 months we have collected the categories described in Section 3 (identifiers, contact information, user content, coarse and momentary geolocation, device and usage information, and inferences limited to trust signals) for the purposes in Section 5, and disclosed them only to the service providers in Section 7. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not knowingly collect information from anyone under 16 for those purposes. You may designate an authorised agent to make a request on your behalf; we will verify the request through your account email.

To make a request, email privacy@qurba.us or use Contact Support in the app. We respond within 45 days (30 days for Canadian requests) and may ask you to confirm the request from your account email. If we decline a request, we will explain why, and you may appeal by replying to our decision.

13. How we protect information

We rely on Google Firebase's security infrastructure and reasonable safeguards to protect your information: encryption in transit and at rest, database rules that limit what any account can read or write, server-side checks on every sensitive write, and least-privilege access for the team. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to limit what we collect in the first place.

14. Where your information is processed

Qurba is directed to users in the United States and Canada. Your information, including data handled by our service providers, is processed in the United States. By using Qurba, you understand your information may be processed there. If you use Qurba from elsewhere, you do so on your own initiative and are responsible for local compliance.

15. This website

No cookies, no analytics. qurba.us sets no cookies and runs no analytics or advertising scripts. A browser preference such as your colour scheme is read by your browser, not sent to us.
Server logs. Our hosting provider (Vercel) keeps short-lived request logs (IP address, user agent, pages requested) for security and operations.
Link previews. When someone shares a link from the app, the website draws the preview image using only information that is already public in the app. It never reads private data.
App Store. Links to the App Store take you to Apple, whose privacy policy applies there.
Email. If you email us, we keep the correspondence as described in Section 10.

16. Changes and contact

We may update this policy as the app evolves. If we make material changes, we will notify you in the app or by email and update the date at the top of this page. Earlier versions are available on request.

For questions, requests or reports: privacy@qurba.us, support@qurba.us, or Contact Support in the app (Profile → Settings → Contact Support).