Last updated
This policy covers the Qadaar mobile app for iPhone and Android (listed in the stores as “Qadaa” and “Qadaa Calculator - Qaza”) and the website qadaar.io. Qadaar is developed and operated by BA Solutions, LLC, Tacoma, Washington, USA (“we”, “us”). We decide what personal data Qadaar processes and why; in the terms of the EU and UK GDPR, we are the controller.
Questions, requests and complaints: info@qadaar.io, or see our contact page.
If you live in Washington State or another US state with a consumer health data law, our Consumer Health Data Privacy Policy also applies to you.
The short version
- You can use Qadaar without an account. Then your prayer, qadaa and fasting data stay on your phone.
- If you sign in with Google or Apple, the data you enter is stored in the cloud so it survives a new phone and syncs between devices.
- Some of that data is sensitive: it can reveal your religion, and the qadaa calculator and fasting log can hold information about menstruation, pregnancy, childbirth and breastfeeding. We use it only to do the calculations and show your records back to you.
- We use Firebase Analytics and Crashlytics to learn which features are used and to fix crashes. Analytics sees which features you use, and your gender and city. It never receives your cycle, pregnancy or fasting-reason data, or what you read, log or count.
- There are no ads in Qadaar. We do not sell your data or share it for advertising.
- You can delete your account and data in the app at any time: Menu → Delete account. See Delete your account.
What we collect, and why
If you use Qadaar without signing in
The app keeps your settings, calculations, logs and location on your device. Nothing of it is sent to us. Only the analytics and crash data described under analytics and crash reports leaves the device, together with the requests described under location and Qur’an recitation.
If you sign in
| Data | Where it comes from | What it is used for |
|---|---|---|
| Name, email address, and, for Google, profile picture; a user ID | Google or Apple, when you sign in | Your account, and letting you sign in on another device |
| Qadaa calculator profile: gender, date of birth, age at puberty, when you started praying regularly; for women, whether your cycle is regular, its length and interval, whether you have given birth, and the days of postnatal bleeding (nifas) for each child | You | Calculating how many prayers and fasts you have to make up |
| Your qadaa counters | You | Tracking what you have made up |
| Fasting log: dates, the reason for a missed fast (illness, travel, menstruation, postnatal bleeding, pregnancy, breastfeeding, or other), and any notes you write | You | Your list of fasts to make up |
| Prayer log: which prayer, the date and time you marked it, and your time zone | You | Your prayer history and statistics |
| Dhikr counters, prayer-time settings | You | Keeping your settings and counts on every device |
The calculator profile and qadaa counters are stored in Google Firebase (Cloud Firestore). The fasting log, prayer log, dhikr and prayer-time settings are stored on our servers at Amazon Web Services in Stockholm, Sweden.
Religious belief and health information are special categories of data under the GDPR and “consumer health data” under Washington law. We process them only to provide the features you use and never use them for advertising. The contents of your calculator profile, logs and counters are never sent to analytics, but because Qadaar is a religious app, the analytics record that you use it, and which of its features, can itself indicate your religion.
Location
Prayer times and the Qiblah direction are calculated from your location. With your permission, the app reads your phone’s location and keeps the coordinates on the device; they are not sent to our servers. To show the name of your city, the app asks your phone’s built-in geocoding service, which is run by Apple on iPhone and by Google on Android, under their own privacy policies. You can instead type a city, which is looked up the same way. The city and country code are recorded in analytics (see below), not your coordinates.
Qur’an text and recitation
The Qur’an text is served by our servers; the request carries no personal data. Recitations are streamed or downloaded directly from the audio servers of the Quran Foundation and QuranicAudio, which therefore receive your IP address, as any website you open does.
Analytics and crash reports
We use Google Firebase Analytics to see which screens and features are used, so we know what to improve. It records events such as “opened the Qur’an” or “added a fasting entry” (not the entry itself), device and app details, an app-instance identifier, and an approximate location that Google derives from your IP address. It also records these attributes: your gender, app language, whether you are signed in, the prayer-time calculation method, and the city and country the app detected.
We use Firebase Crashlytics to receive crash reports: what failed, the device model and OS version, and the app state at the time. Our servers send error reports and performance traces to Sentry. These record what failed and how long requests took, along with the IP address and user agent of the request. They never include the content of your data or your sign-in token.
Qadaar does not use the advertising identifier on either platform and does not track you across other companies’ apps or websites.
Notifications and widgets
Prayer reminders are scheduled on your phone. We do not use push notifications, so no notification token is created. Home-screen widgets read data stored on the device.
Donations
The “Support us” link opens a payment page run by Stripe. Stripe collects your payment details; we never see your card number. Stripe tells us the amount, the date and the name and email address you give it. See Donations in the Terms.
Contacting us
If you email us, we keep the message and your address to answer you and to keep a record of requests such as deletion requests.
The website
qadaar.io sets no cookies, stores nothing in your browser and runs no analytics or tracking. It is served by Amazon CloudFront, which processes your IP address to deliver the pages; we do not keep access logs of the website.
Legal bases (EU, UK and similar laws)
- Providing the app and your account (sign-in, sync, calculations, logs): performance of our contract with you.
- Religious belief and health information: your explicit consent, given by choosing to enter and save that information. You can withdraw it by deleting the entries or your account.
- Crash reports: our legitimate interest in keeping the app working.
- Analytics: our legitimate interest in improving the app. We are adding a switch to turn analytics off in the app. Analytics data is not linked to your name or email, so until the switch is there we cannot find or remove it by your email address.
- Security, for example limiting abusive requests: our legitimate interest.
- Records we must keep, for example of payments: legal obligation.
Who processes your data
We do not sell personal data, and we do not share it with anyone for their own purposes. These service providers process it for us, under contracts that limit them to our instructions and require them to protect it at least as well as this policy does:
| Provider | What for | Where |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Analytics, Crashlytics, Remote Config) | Sign-in, storing the calculator profile, analytics, crash reports | USA and other countries |
| Apple (Sign in with Apple) | Sign-in | USA |
| Amazon Web Services | Our servers and database; hosting qadaar.io | Sweden (servers); worldwide edge network (website) |
| Functional Software, Inc. (Sentry) | Server error reports and traces | Germany |
| Stripe | Donations | USA and other countries |
We may disclose data if the law requires it, for example under a valid court order, and to a successor if BA Solutions, LLC or Qadaar is sold or merged, in which case this policy continues to protect it.
International transfers
BA Solutions, LLC is a US company, and our providers operate in several countries. When data from the EU, UK or another country with transfer rules goes outside it, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses and their UK equivalent.
How long we keep it
| Data | Kept |
|---|---|
| Account, calculator profile, logs and settings | Until you delete them or your account |
| Our server logs (which include IP addresses) | 1 day |
| Database backups | 1 day |
| Crash reports | Up to 90 days |
| Server error reports and traces (Sentry) | Up to 90 days |
| Analytics events | Up to 14 months |
| Emails with us | As long as needed to handle your request, then up to 2 years |
| Donation records | As long as tax law requires |
When you delete your account, the sign-in account and the data in Firebase are deleted immediately, and the records on our servers within 30 days. Backups roll over within a day after that.
Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it;
- stop using it for analytics, once the app has the switch described above.
You can delete most of it yourself in the app. For anything else, email info@qadaar.io from any address and tell us the email address of your Qadaar account. If you used Sign in with Apple with “Hide My Email”, that is the @privaterelay.appleid.com address listed in your Apple ID settings under Sign in with Apple. To confirm the account is yours, we write to that address and ask you to reply. We answer within 30 days, and tell you if we need longer, as some laws allow.
EU and UK. You also have the right to data portability, to restrict processing, and to withdraw consent at any time without affecting what was done before. You can complain to the data protection authority where you live, although we would like the chance to fix the problem first.
Washington and other US states. See the Consumer Health Data Privacy Policy for your rights over health data, including how to appeal a decision. We do not sell or “share” personal data for cross-context behavioural advertising, as California law defines it.
Do Not Track. Do Not Track is a browser signal. qadaar.io has no tracking for it to switch off, and the app does not track you across other companies’ apps or websites (see analytics).
Security
Data is encrypted in transit (HTTPS/TLS) and at rest in Firebase and in our database. Access to production systems is limited to the people who run them. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Children
Qadaar is a general-audience app and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, write to us and we will delete it.
Changes
If we change this policy, we publish the new version here with a new date. If a change is significant, for example a new use of your data, we will tell you in the app or on this site before it takes effect.
Contact
BA Solutions, LLC, Tacoma, Washington, USA. Email: info@qadaar.io.