Privacy policy

The data controller is the legal entity shown in the box “Who operates DUNYA” on this page. Until those details are completed, this policy is a draft and DUNYA must not be launched publicly.

DUNYA is designed to work without an account and to collect as little as possible.

• Without an account: your preferences (language, theme, prayer settings, chosen landscape) and your location stay on your device, in local storage. Your location is never sent to us.
• With an account: your email address, an optional display name, your synced preferences (which may include the city you chose for prayer times), Quran bookmarks, favourites, playlists and listening history, followed mosques and notification settings.
• Community features: information you submit about mosques or fundraisers, and abuse reports you file (an email address is optional for guests).
• Security: rate-limiting uses salted, irreversible hashes of network identifiers, kept briefly.
• No analytics or advertising trackers are used by default.

• To provide the service you ask for: your account and sync (performance of a contract).
• To keep DUNYA safe: rate limits, abuse handling, fraud prevention (legitimate interest).
• To send notifications you switched on (consent, which you can withdraw at any time in settings).
• To keep the records of past orders from the former DUNYA Shop, if any, as required by accounting and tax law (legal obligation).

We use a small number of service providers, each bound by a data processing agreement:

• Supabase — database, authentication and file storage, hosted in the European Union (AWS eu-west-1, Ireland).
• Vercel — hosting and delivery of the application.
• Unsplash — landscape photographs are loaded directly from Unsplash’s servers, which therefore see your IP address and browser details when images load.
• Google Maps Platform (Google Ireland Ltd) — maps, city and mosque search; the search terms and the approximate position of the area shown are sent, not your account.
• Quran recitation audio is streamed from the providers of the recordings.
• Push notifications, if enabled, are delivered through your browser vendor’s push service.

Some providers (for example Vercel) may process data outside the European Economic Area. Such transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

• Account data: until you delete your account.
• Past orders from the former Shop, if any: for the period required by accounting law (up to 10 years in France), detached from your account after deletion.
• Abuse reports: as long as needed to handle them and to defend legal claims.
• Rate-limit records: a few minutes to a few hours.

Under the GDPR you may access, correct, delete or export your data, restrict or object to its processing, and withdraw consent at any time. You can delete your account yourself at any time from your profile; deletion is immediate. To exercise these rights, use the data deletion page or the contact page. You may also lodge a complaint with your data protection authority (in France, the CNIL).

Every database table is protected by row-level security, private files (such as mosque claim documents) are only delivered through short-lived signed links, and secrets never reach the browser. No system is perfectly secure; we will notify you and the authorities of any breach as the law requires.

Accounts are intended for people aged 15 and over. Younger users can use DUNYA without an account, or with the consent of a parent or guardian.