Privacy Policy

MasjidNexus is provided by Moosa Salim, an individual developer in Oman, trading as SmartHorizon (“we”, “us”). This policy explains what personal data we handle when you use the MasjidNexus website, the admin portal (on the web and in the iPhone and Android apps), the TV app and the congregation app, and the choices you have.

For questions or requests about your data, email support@masjidnexus.com.

In short

• The congregation app needs no account.
• Our apps and the website send us usage statistics and crash reports through Google’s Firebase and Google Analytics, so that we can fix problems and improve MasjidNexus. We don’t send your name, email address or account with them, you can turn them off, and we never use them for advertising.
• Masjid admins give us an email address and their masjid’s details so that we can run the service.
• We don’t sell personal data, and we don’t use it for advertising.

Who this covers

• Masjid admins: people who manage a masjid in the admin portal.
• Worshippers: people who use the congregation app.
• Website visitors, including anyone who uses the contact form.

TV screens are devices, not people; what they send is described below.

What we collect

Masjid admins

• Your account: your email address, your password (kept by our sign-in provider in a protected, hashed form that we can’t read), an optional display name, your preferred language, and whether you’ve set up an authenticator app. If you sign in with Google or Apple, they give us your name and email address.
• Your masjid: what you enter about it (its names, address, location on the map, time zone, phone, email, website, social links, imam, opening hours, capacity, facilities, donation link and logo), its prayer settings, its screens, and its content (announcements, activities, lectures, slideshow images and Islamic content).
• Your team: the email addresses of the admins you invite, and their roles and permissions.
• Accepting our terms: when you accepted the Terms of Service, which version (with a fingerprint of its exact text) and in which language, which version of this policy you were shown, and for which masjid.
• The activity log: which admin made which change, and when. It doesn’t record IP addresses or devices.
• Support: the messages and screenshots you send through Support in the portal.
• Billing: see Payments.
• Email preferences: which optional emails you’ve turned off.
• Usage statistics and error reports: see Usage statistics and crash reports.
• On your device only: in a web browser, your signed-in session, your “Keep me signed in” choice and your choice about usage statistics; in the iPhone and Android apps, whether you’ve turned on Face ID or fingerprint unlock. Your face or fingerprint never leaves your device: the app only asks your phone to confirm it’s you.

Your masjid’s details are public

What you enter about your masjid, including its contact details, imam, address and logo, is shown in the congregation app and on the website, and anyone can read it. Only enter what you’re happy to publish.

Worshippers

• No account, name or email address. The congregation app creates a random ID for your phone the first time it opens. It isn’t linked to you or to your phone’s hardware.
• The masjids you follow: we store which masjids that random ID follows, so a masjid can see how many followers it has. If the app isn’t opened for 90 days, these records are deleted automatically.
• Notifications: if you turn them on, your phone subscribes to topics for your masjid in Google’s Firebase Cloud Messaging (for example, “this masjid’s announcements, in Arabic”). We don’t keep a notification token for your phone.
• Location: only when you use “Near me”. Your phone’s location is sent to our server to find masjids nearby. It’s used for that search and isn’t stored.
• On your phone only: your followed masjids, language, prayer-alert settings and display choices stay in the app on your phone.
• Usage statistics and crash reports: see Usage statistics and crash reports. You can turn them off in the app’s Settings.
• Support: if you contact support from the app, we receive your email address, your message, any screenshots you attach, and the app version, your phone’s system and version, the app’s language and your main masjid, so that we can help. It reaches us by email and isn’t stored in our database.

TV screens

When a TV is connected to a masjid, the TV app creates a random ID for that screen and sends it with the app version, the screen’s language and orientation, and then a regular “still online” signal. It also sends crash reports, usage statistics and performance data, described below. Nothing is collected about the people who see the screen.

Website visitors

• Google Analytics counts visits and shows us which pages are read and how visitors found the site; see Usage statistics and crash reports.
• Cookies: the website’s only cookies are Google Analytics’ (_ga), and only as you choose in its cookie notice. In your own browser it also remembers your cookie choice, light or dark mode, and whether you closed the language suggestion.
• The contact form: your name, email address, masjid and city, country, phone or WhatsApp number if you give one, the topic and your message. It reaches us by email and isn’t stored in our database.
• A masjid’s page (masjidnexus.com/m/…): to show the masjid’s name, your browser asks our database for its public details.

Usage statistics and crash reports

To find problems and improve MasjidNexus, our apps and website use Google’s Google Analytics (in the apps, Google Analytics for Firebase), Firebase Crashlytics and Firebase Performance Monitoring:

• Usage statistics: which pages or screens are opened (in the apps, the kind of screen, such as “a masjid’s page”, never which masjid or item), when an app is opened, installed or updated and for how long; the app or browser version, device model, operating system, language and screen size; how visitors found the website; and an approximate location (country and city) worked out from the IP address. Google Analytics doesn’t store IP addresses. The statistics are linked to a random ID that Google Analytics creates for the app on that device, or keeps in a cookie in the browser.
• Crash and error reports (apps): what went wrong and where in the app’s code, with the app version, device model, operating system and the device’s state at the time, such as free memory. In the portal on the web, errors are sent to Google Analytics as short descriptions instead.
• Performance data (apps): how long the app takes to start and to show its screens, with the device’s network type and mobile carrier, and its country, worked out from the IP address.

We don’t add your name, email address or account, the masjids you follow or manage, or any advertising ID to any of this, and we never use it for advertising. Google processes it for us, as one of our providers (see Who we share it with).

Your choice:

• Congregation app: on, unless you turn off Usage statistics in Settings.
• Admin portal app (iPhone and Android): on, unless you turn it off in Account & Security on that device.
• Admin portal on the web: off until you accept in its cookie notice; change your choice at any time in Account & Security.
• Website: in the European Economic Area, the UK and Switzerland, no analytics cookies are set until you accept in the cookie notice, and until then Google receives only basic information about each visit, without cookies or identifiers. Elsewhere, it’s on unless you decline. Declining turns Google Analytics off completely. Change your choice at any time with Cookie settings at the foot of every page.
• TV app: always on. A TV is a device, not a person, and nothing is collected about the people who see it.

Protection against spam

To stop the contact forms being misused, we keep a code made from the sender’s network (IP) address with a secret key that changes every day, with the time, for about a day. The code can’t be turned back into the address.

How we use it

• To provide MasjidNexus: run the portal, show a masjid’s times on its screens and in the app, and send the emails the service needs (sign-in codes, security notices, billing, deletion and support).
• To keep accounts secure: two-step sign-in, checking new passwords against known data breaches, and preventing abuse.
• To answer your questions and support requests.
• To send optional emails (tips, monthly summaries and notices of iqama changes). You can turn them off at any time, with the link in each email or in the portal.
• To find and fix crashes and errors, and to see how MasjidNexus is used so that we can improve it.
• To meet legal, tax and accounting obligations.

Legal bases

Where data-protection laws apply, such as Oman’s Personal Data Protection Law, the EU GDPR or the UK GDPR, we rely on:

• contract, to provide the service to masjids and their admins;
• legitimate interests, to keep the service secure, prevent abuse and improve it (including usage statistics and crash reports in the apps), in ways you would reasonably expect;
• consent, for notifications and location in the congregation app, which you can withdraw in the app or in your phone’s settings, and for analytics cookies on the website and in the portal on the web, which you can withdraw in their cookie settings;
• legal obligation, to keep payment and tax records.

Payments

Payments are handled by Paddle.com, our Merchant of Record. Paddle collects your card or other payment details, your billing details and tax information under its own privacy policy. We never see or store card details. We receive and keep your subscription’s status and renewal date, the amount, tax, currency and invoice number of each payment, and Paddle’s references for your subscription and customer record.

Who we share it with

We use these providers to run MasjidNexus. They process data on our behalf, only to provide their service.

We may also share data when the law requires it, or to protect the rights and safety of our users or ourselves.

International transfers

Our providers process data in several countries, including Singapore (our database), the United States and the United Kingdom. Where the law requires it, we rely on the safeguards these providers offer for international transfers.

How long we keep it

• Accounts and masjids: for as long as they exist. If a masjid doesn’t subscribe after its free trial, its data is kept for 90 days after the trial ends; after a paid subscription ends, for 12 months. In that time it can subscribe and carry on; after it, we may delete the masjid and its data, emailing its admins at least 30 days before. You can delete it at any time; see Account deletion.
• Your acceptance of our terms: kept while your account exists, and for 6 years after it’s deleted, as a record of what was agreed.
• After a deletion request: you have 30 days to change your mind; then we permanently delete the masjid or account, and cancel a deleted masjid’s subscription. We keep payment, invoice and tax records (as the law requires), support conversations, a log of the emails we sent, and a record that the deletion took place.
• Logins without a masjid: deleted after 90 days without one (we email a week before), or straight away if you delete it yourself. A login made for an invitation that’s withdrawn before it was ever used is deleted with the invitation.
• The congregation app’s follow records: deleted when you unfollow or clear the app’s data, or after 90 days without the app being opened.
• Spam-protection hashes: about a day.
• Usage statistics: 14 months in Google Analytics. Crash reports: 90 days. Performance data: up to 60 days (30 days for data linked to an IP address).

Security

All connections are encrypted. Each masjid’s data can be reached only by its own admins, which the database itself enforces. Every password sign-in needs a second step (a code by email, or an authenticator app), new passwords are checked against known breaches, and our service keys stay on our servers. No system is perfectly secure, but we work to protect your data, and we’ll tell you if a breach affects you, as the law requires.

Your rights

Depending on where you live, you can ask to see, correct, export or delete your personal data, to object to or limit how we use it, and to withdraw your consent. Admins can correct most details, and delete their account or masjid, themselves in the portal. For anything else, email support@masjidnexus.com and we’ll answer within 30 days. If you’re not satisfied, you can complain to your data-protection authority.

Children

The admin portal is for adults acting for a masjid. The congregation app can be used by anyone; it has no accounts and doesn’t ask for anyone’s name, email address or age.

Changes to this policy

If we change this policy, we’ll update the date at the top, and tell admins by email or in the portal when the change is significant.

Contact

Moosa Salim, trading as SmartHorizon, Oman. Email: support@masjidnexus.com