Privacy Policy

This Privacy Policy applies to personal information processed in connection with:

• Our public websites and marketing pages (including https://duha.appand related domains);
• The Duha masjid / organization admin dashboard and APIs (subscription software for Islamic centers and nonprofits);
• The Duha community mobile applicationsfor iOS and Android (the “Community App,” including bundle identifiers such as app.duha.ios and app.duha.android), including push notifications, in-app giving, prayer times, events, messaging, identity verification, and related features;
• Customer support, onboarding, billing, and communications related to the above.

Together, these are the “Services.” If a product feature has additional privacy notices (for example in-app permission prompts), those notices apply in addition to this policy.

Organization accounts. When a masjid, Islamic center, or other organization (“Organization”) uses Duha to store member, donor, volunteer, student, family, clinic, or similar records, that Organization generally determines why and how that Customer Content is processed. In that case the Organization is the controller (or equivalent) of Customer Content, and Duha processes it on the Organization's instructions to provide the Services.

Duha accounts & product data. We are the controller of account, billing, support, security, and product-analytics data we collect about administrators, website visitors, and Community App users for our own operations (for example login emails, device diagnostics we collect, push tokens, and marketing site analytics where enabled).

If you are a community member and believe an Organization has entered your information into Duha, contact that Organization first for access or deletion requests about Customer Content. You may also contact us at contact@duha.appand we will help route the request as appropriate.

Depending on how you interact with the Services, we may collect:

A. Information you provide

• Account and profile details (name, email, phone, date of birth, gender, avatar, bio, timezone, organization affiliation, and role). Community App sign-in is typically via Google Sign-In or Sign in with Apple through Firebase Authentication; you may also verify a phone number with a one-time code. Dashboard accounts may use email or other credentials we offer;
• Organization details (name, address, branding assets, tax or nonprofit identifiers you choose to supply);
• Content you upload or create (messages, events, media, forms, member/donor records, school and family data, consulting questions, applications, and similar Customer Content);
• Identity and eligibility documents you choose to submit for features that require verification (for example driver's license or ID barcode data, passport or residency documents, photos used for face matching in travel/Umrah flows, or food-bank / membership eligibility checks);
• Support requests, feedback, and survey responses;
• Marketing preferences and newsletter sign-ups on our website;
• Mobile numbers and messaging preferences when you or an Organization enroll you in SMS or voice communications (including opt-in / opt-out status).

B. Information collected automatically

• Log and usage data (pages or screens viewed, features used, timestamps, referring URLs, approximate location derived from IP);
• Device and browser data (device type, OS, app version, browser, language, crash and performance diagnostics);
• On the Community App: a stable install identifier, push notification (FCM) tokens, and device diagnostic fields needed to register your device and deliver notifications (see Section 4);
• Cookies, local storage, and similar technologies on our websites (see Section 10).

C. Information from others

• Organization administrators who invite you or import your contact details;
• Parents, guardians, or family members who add you or a minor to school, family, or program records;
• Identity providers (Google, Apple, Firebase) and payment or subscription platforms when you connect those methods;
• App stores (Apple / Google) for purchase or install metadata where applicable.

The Community App is designed for end users of participating Organizations (prayer times, announcements, events, giving, messaging, school, and related community features). In addition to Section 3, the app may process the following.

A. Sign-in and session. You typically authenticate with Google or Apple via Firebase. We exchange a Firebase credential for a Duha API session token stored in secure on-device storage. Signing out clears the token, related preferences we control, and push subscription state where applicable.

B. Device permissions. Features may request OS permissions only when needed. You can deny or revoke them in device settings; features that do not need that permission continue where possible.

• Location (when in use) for prayer times, nearby masjid discovery, Qibla, and similar location-aware features. We do not require background location for core use;
• Camera, photo library, and microphone for profile photos, posts, chat attachments, document capture, and similar uploads you initiate;
• Notifications (including local prayer reminders and exact-alarm scheduling on supported Android devices) and remote push via Firebase Cloud Messaging;
• Face ID / biometrics on supported devices to confirm identity for certain sensitive actions (for example Organization elections). Biometric templates are handled by the device OS; we receive a success/failure result, not your biometric raw data;
• Contacts. The Community App does not currently request access to your device contacts. If that changes, we will update this policy and request permission at the time of use.

C. Device identifiers and diagnostics. We may register a stable install UUID, FCM push token, OS type, whether the device is physical, app version, and device diagnostic metadata so we can deliver notifications, secure sessions, and troubleshoot issues. We may use Firebase Analytics, Firebase Performance Monitoring, and limited Crashlytics error reporting. Where Apple requires App Tracking Transparency, we will request permission before tracking across apps or websites owned by other companies for advertising purposes.

D. On-device storage. The app stores auth tokens in secure storage, and preferences (including prayer notification schedules), caches, and temporary upload files locally. Uninstalling the app removes local data; server-side account, donation, message, and Organization Customer Content may remain until deleted under Section 9 or by your Organization.

E. Feature-specific data. Depending on which Organization features you use, the app may process:

• Prayer times, Qibla, and related location-derived schedules;
• Donations, shop orders, event tickets, hall bookings, and receipts;
• Circles or community chat messages and media (including content synced via cloud messaging infrastructure such as Firestore), optionally with location metadata you attach when sending;
• Private consulting / Ask Imam / fatwa messages and paid consulting bookings;
• School and family records for minors (name, date of birth, photos, notes, attendance, and allergy or health-related notes Organizations collect for program safety)—typically submitted by parents, guardians, or Organization staff;
• Identity verification for KYC, membership, food-bank grants, or travel/Umrah (government ID or passport images/barcode data and, where enabled, automated face or document checks via verification providers such as AWS);
• Free clinic appointment requests; janazah (funeral) requests; marriage or similar applications;
• Organization election participation, which may require on-device biometric confirmation;
• Content you share via the system share sheet (for example prayer times, posts, or QR images).

App Store / Google Play listings and in-app permission dialogs describe the purposes for which permissions are requested.

WAQTO LLCoperates the Duha Communication Hub messaging program. Organizations may use Duha to send SMS text messages and automated voice calls to people who have opted in to receive those communications (for example prayer reminders, event announcements, program updates, and urgent community alerts). Messages are sent by WAQTO LLC on behalf of the Organization using WAQTO LLC's messaging infrastructure (including carrier partners such as Twilio).

Message frequency. Message frequency varies by Organization and program. Recipients typically receive a low volume of messages (for example up to four SMS messages per month for routine updates), with higher frequency only when the Organization sends time-sensitive or emergency notices. Exact frequency depends on the programs you join and the Organization's practices.

Message and data rates may apply. Standard message and data rates from your wireless carrier may apply to SMS and voice communications. WAQTO LLC and the Organization do not charge you a separate fee for receiving these messages, but your carrier may.

Mobile information is not shared for third-party marketing. WAQTO LLC does not sell, rent, or share mobile phone numbers or SMS/voice opt-in data with third parties or affiliates for their own marketing or promotional purposes. Mobile numbers are used only to deliver messages you (or your Organization, with your consent) requested, to operate and secure the Services, to honor opt-out requests, and as otherwise described in this Privacy Policy (including sharing with messaging carriers and subprocessors solely to transmit those messages).

Opt out and help. You may opt out of WAQTO LLC / Duha Organization SMS at any time by replying STOP to a message. Reply HELP for assistance. You may also update messaging preferences in your Community App or Organization profile where available, or contact WAQTO LLC / Duha at contact@duha.app. Opting out of SMS does not cancel other Services or email communications unless you also unsubscribe from those channels.

We use personal information to:

• Provide, operate, maintain, and improve the Services;
• Authenticate users, prevent fraud and abuse, verify eligibility where a feature requires it, and keep the Services secure;
• Process subscriptions, donations, in-app purchases, and related receipts or reporting for Organizations;
• Deliver prayer reminders, chat, events, school, consulting, and other features you or your Organization enable;
• Send transactional messages (security alerts, billing, product updates). Marketing emails are sent only where permitted and with opt-out available;
• Deliver SMS, voice, and Community App notifications you or your Organization configure, subject to your consent and device settings;
• Analyze aggregated or de-identified usage to improve reliability and product design;
• Comply with law and enforce our Terms of Service.

We do not sell personal information as that term is commonly understood, and we do not share personal information for cross-context behavioral advertising except where a specific integration you enable requires it and we disclose that at the time. If you are a California resident, we do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

We may share personal information with:

• Service providers / subprocessors who process data for us under contract, including (as applicable): hosting and API infrastructure; Google / Firebase (authentication, cloud messaging, analytics, performance, storage, and messaging databases used by certain app features); Stripe (card and wallet payments); Apple / Google / RevenueCat (App Store and Google Play billing for subscriptions); Google Maps (maps and location display); AWS or similar providers for document or face verification where those flows are enabled; Twilio and carriers for SMS/voice; and email, support, and security vendors;
• Your Organization and its authorized admins when you use features tied to that Organization (including Community App activity visible to admins per their configuration);
• Professional advisors and authorities when required by law, legal process, or to protect rights, safety, and security;
• Business transfers in connection with a merger, financing, or sale of assets, subject to appropriate confidentiality.

We do not grant unrestricted public access to Customer Content. Organization admins control roles and sharing within their workspace. As stated in Section 5, we do not share mobile numbers with third parties for those parties' marketing.

Card and wallet payments. Subscription billing for Organizations, donations, shop checkout, consulting fees, and similar flows are typically handled by third-party payment processors such as Stripe (including Apple Pay / Google Pay where enabled). Those processors process payment credentials under their own privacy policies. Duha receives transaction status, amounts, payer identity information needed for receipts and Organization ledgers, and similar metadata—not full card numbers where the processor tokenizes payments.

In-app subscriptions (Community App). Optional Duha Premium or similar subscriptions may be billed through the Apple App Store or Google Play via RevenueCat. Apple or Google processes the payment; we receive entitlement and purchase metadata needed to unlock features. Store account privacy practices are governed by Apple or Google.

Organizations are responsible for the tax, nonprofit, and donor communication practices applicable to funds they collect through Duha. Duha is generally not the charity recipient of community donations unless a Duha-operated campaign expressly states otherwise.

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Customer Content is retained according to the Organization's account status and our retention schedules; deleted data may persist in encrypted backups for a limited period. Identity documents and verification results are retained only as needed for the feature, fraud prevention, and legal obligations.

We implement administrative, technical, and organizational measures designed to protect personal information (access controls, encryption in transit, monitoring). No method of transmission or storage is 100% secure; please protect your devices and linked Google or Apple accounts.

Depending on your location, you may have rights to:

• Access, correct, or delete personal information;
• Export or receive a copy of certain data;
• Object to or restrict certain processing;
• Withdraw consent where processing is consent-based;
• Opt out of marketing emails via the unsubscribe link;
• Opt out of Organization SMS by replying STOP, or request help by replying HELP;
• Control cookies via browser settings (some cookies are required for login and security);
• Control Community App permissions (notifications, location, camera, etc.) in your device settings;
• Manage or cancel App Store / Google Play subscriptions in your store account settings.

Account deletion (Community App and Duha-controlled data). To request deletion of your Duha Community App account or Duha-controlled personal information, email contact@duha.app from the email associated with your account (or use our contact form). We may need to verify your identity. We will delete or anonymize Duha-controlled account data within a reasonable period, subject to legal retention needs. Organization Customer Content (for example school records, donations shown to the masjid, or chat retained for the Organization) may remain until that Organization deletes it or instructs us to do so; we will help route those requests.

For California residents, you may also have rights under the CCPA/CPRA to know, delete, and correct personal information, and to opt out of sale or sharing (we do not sell or share as described in Section 6). We will not discriminate against you for exercising privacy rights.

The Services are not directed to children under 13 (or the minimum age required in your jurisdiction) for Duha's own marketing or account creation. We do not knowingly collect personal information from children under 13 for Duha's own purposes.

Organizations may use Duha for youth programs (for example weekend school or family features). In those cases, parents, guardians, or Organization staff typically submit minors' information (name, date of birth, photos, attendance, allergy or other program-safety notes, and similar fields). That information is Organization Customer Content. Organizations are responsible for obtaining any parental consents and providing any notices required by law (including COPPA or state equivalents) before collecting children's data.

If you believe we have collected a child's information inappropriately, contact contact@duha.app.

Duha is operated from the United States. If you access the Services from another country, your information may be processed in the U.S. or other countries where we or our processors operate. Those countries may have different data-protection laws than your own. Where required, we use appropriate safeguards for cross-border transfers.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we post a revision. Material changes may also be communicated by email, in-product notice, or Community App notice where appropriate. Continued use of the Services after an update means you acknowledge the revised policy.

WAQTO LLC (Duha platform)
Website: https://duha.app
Privacy inquiries: contact@duha.app
General contact: Contact form · contact@duha.app

Related: Terms of Service