Privacy Policy

Last updated: November 4, 2026 · Privacy v2.3

To display a saved place as a street or neighbourhood, Umma can use your phone's geocoding service with its coordinates, without your Umma account. Labels are cached on your phone, not on Umma's servers.

Effective date: October 25, 2026

Umma is operated by Yousef Kassim of Texas, pending formation of Lifta Holdings, LLC, a Texas limited liability company, which will assume this policy when it is formed ("Umma," "we," "us"). This policy explains what Umma collects, why, who sees it, and the controls you have. It applies to the Umma app for iPhone and Android, the Umma masjid tools, and the ummapro.com website.

Short version: your worship is yours. Prayer logs, check-ins, journeys and Quran progress are private by default. Nothing is shared unless you choose to share it. Masjids only ever see anonymized, banded counts. We have no ads, we never sell your data, and we never share it with advertisers or data brokers.

Questions: [email protected]

1. Religious information is sensitive, and we treat it that way

Using a prayer app can reveal that you are Muslim and how you practice. Laws in many places, including the EU and UK GDPR, the Saudi Personal Data Protection Law and the Texas Data Privacy and Security Act, treat religious belief as sensitive data. We process it only to provide the features you turn on, with your consent, which you can withdraw at any time in Settings. We never sell it, never use it for advertising, and never share it with anyone you did not choose.

2. What we collect

Umma Search

Umma Search can use Claude, an AI model made by Anthropic, to understand searches in your own words. Your search text is sent to Anthropic without your name, account, location or device. Claude only maps your words to roots and themes — the verses always come from Umma's own index, and Claude never writes Quran text. Powered by Claude.

AI matching is optional and requires your consent. You can turn it off in Settings → Quran → Search privacy; the Quran index remains available without AI. Umma does not log query text. Identical searches may use a 24-hour cache keyed by a hash; that cache holds numeric verse references, not your query text. Rate limits and a shared AI budget may temporarily return search to the ordinary index.

Craft a dua

If you choose to use Craft a dua, you review your story and optional answers before sending them to Anthropic to compose your personal words. A separate optional intake step sends the story you choose to share to suggest questions. Skipped or removed answers are not sent for crafting. The optional recipient-name field stays on your phone and is replaced with a placeholder before a request is sent. Do not include names, addresses or other identifying details in free text.

Umma does not send your account, location or device metadata to the model. Umma does not store or log your request or the composed dua on its servers; short-lived counters enforce usage and spending limits. Saved crafted duas and edits are encrypted on your device; crafted-dua backup is not currently enabled. Editing stays on your phone. Copying and any available sharing are your actions, never automatic. Reminders are scheduled locally with neutral text. Quran and prophetic duas come from the reviewed library, not AI-generated scripture. Child profiles cannot use crafting. Sources that are still drafts cannot be used in production.

Account

• Name, email, and a sign-in identifier from Apple or Google, or an email code if you choose that. We never see your Apple or Google password.
• A display name and optional avatar.
• Your home region, set from your device's country when you sign up, used to decide which of our servers holds your data (see §8).
• Subscription status (Free, Pro, Pro Family) from the App Store or Google Play. We do not receive your card number.

You can use most of Umma without an account. Signing in turns on private backup so your data follows you across devices.

Worship activity you log or Umma records for you

• Prayers marked complete, missed and make-up (qada) prayers, voluntary prayers, fasting days and make-up fasts, tasbeeh counts, good deeds, points and stars.
• Prayer Mode sessions and, if you turn it on, rakah detection: motion readings from your phone, watch or earbuds, processed on the device to count rakahs. Raw motion data stays on the device and is discarded after each prayer; only the result (which prayer, how many rakahs, standing or seated) is kept.
• Tawaf and sa'i counts when you use the Mecca features.
• Quran reading position, bookmarks, private notes and memorization progress. If a recitation-feedback feature is offered and you use it, your recitation audio is processed to score accuracy and is not kept after scoring unless you save it or send it to a teacher you chose.

Location

Umma asks for location once, at setup. You can decline; prayer times and the masjid directory then use a city you pick, and automatic check-ins, journeys and the map stay off. You can change this any time in Settings or in your phone's settings.

If you allow it, Umma uses location for: - Prayer times and Qibla, calculated on your device. Your position is not sent to us for this. - Nearest masjids and directions. We send an approximate position, rounded to about 100 m, to our servers and to Apple Maps for travel times. No account identity is sent to Apple. - Weather at your location, sent to Apple WeatherKit without your identity. - Automatic masjid check-ins (background location, "Always"). Umma sets geofences around masjids near you and records a check-in when your phone enters one. This is why Umma asks for "Always" location: the phone has to notice when you arrive even when the app is closed. Check-ins are stored under your account as masjid + time. Exact coordinates are not stored. You can turn check-ins off and keep everything else. - Journeys (opt-in, separate switch). When on, Umma records your route to the masjid for points and personal stats. Routes are stored under your account and shown only to you. Community comparisons use totals and percentiles, never routes. - Your prayer map. Places you logged a prayer, shown only to you.

Calendar

Calendar today and tomorrow, soft guard, one-time intentions and one repeating prayer intention are free. Pro adds later days, unlimited repeating intentions, aspirations, suggestions, busy write-back and Pray together. Calendars are read on your device. Event titles and categories never leave your phone; aspirations stay encrypted on this device and are not backed up. Umma writes only busy blocks when you turn that on. Pray together shares busy intervals, not event titles.

Pro adds convenience and insight, never access to worship: Salah Calendar planner; Makeups planner; extended Insights and history (month, year and trends); detailed prayer weather and weather reminders; Ramadan sky and sky share image.

Excused Days (optional)

Excused Days is optional and off by default. Private cycle settings, logs and related records are encrypted on your device with an owner-specific random key. A separately consented account backup contains client-encrypted ciphertext, not your recovery key. The ciphertext is linked to your account; encryption does not make health-related data unlinked. Recovery on a new phone requires your separately saved recovery key. These tools are unavailable to child and parent-managed profiles until independent privacy and consent are configured.

Family managers, parents, staff, teachers and masjids have no cycle-log view. Sisters sharing starts Off for each invite-only, admin-approved circle. If you choose to share availability, the service stores account-linked free-day flags that may imply health information; authorized members see only thresholded overlap and names where explicitly permitted, not cycle reasons or other members' raw flags. Flags expire at Eid and are removed on withdrawal or removal. Privacy controls can withdraw flags and erase encrypted cloud copies without the recovery key.

Sharing and community

• Circles: what you share with a circle (prayers, check-ins, points, deeds, streaks, duas) is controlled per circle and per item, and everything is off by default. Check-ins shared with a circle show the masjid name, never coordinates.
• Public posts: dua requests or deeds you mark Public are visible to other Umma users.
• Community counts: masjids show a banded community size (for example "100–250 people this week") built from check-ins and Main Masjid choices. Small counts are hidden. No individual can be identified.
• Live khutbahs: if you listen to a masjid's live khutbah, the masjid sees only rounded listener counts, never who listened. You can turn off "Count me in masjid audience."
• Tags and invitations: if you invite someone who is not on Umma, the message is sent from your own phone or as one email with your first name and a download link. We keep their contact only to deliver that invitation and credit referral rewards.

Children

Umma has no minimum age. Anyone under 13 (or the age of digital consent where they live) uses a child profile attached to a parent's account, created only after the parent gives verifiable consent. For child profiles: - We collect only what the feature needs: the profile name, worship activity the child logs, and Quran progress. - We do not collect precise location from a child profile. Automatic check-ins and journeys are off and cannot be turned on. - A child's activity is visible only to the parent and to adults the parent approves, such as a Quran teacher. - No advertising, no public posts, no public profile. - Parents can review, export or delete a child's data from the Family screen or by emailing [email protected].

We comply with the U.S. Children's Online Privacy Protection Act (COPPA). If we learn we collected personal information from a child without parental consent, we delete it.

Giving

When you donate through Umma, the payment is processed by Stripe. We receive the amount, the recipient, the date and a payment reference, and keep them for your giving history and receipts. Card details go to Stripe, not to us. Your name is shared with a masjid only if you choose to share it. Recurring and automatic giving rules you set (for example Jumu'ah, the last ten nights, or "whenever I visit a masjid") are stored under your account so Umma can run them.

Masjid tools

If you claim a masjid page, we collect your name, role, the masjid's contact details and verification information, and keep a record of edits you make. Masjid managers see only aggregate, banded community data, never a list of attendees, individual check-ins or locations.

Verified scholars, reciters and mu'adhdhins

If you apply for a verified profile, identity checks are run by Stripe Identity. We keep the verification result and a record of the check, and delete ID images once a decision is made. If you record a voice sample for verification, we keep a voice signature only to match your later uploads.

Waitlist and website

On ummapro.com we count visits ourselves, without cookies or third-party analytics. We record the page, the referring site, your approximate location (country, state or region, and city) and device type, operating system and browser, and a daily identifier that cannot be linked across days. We measure how long a page is visible while you are active and how far it is scrolled, without cookies. We don't store your IP address. Browsers sending Do Not Track or Global Privacy Control are not tracked.

If you join the waitlist on ummapro.com, we keep your email (and, for masjids, the masjid name and city) to tell you when Umma launches. You can unsubscribe from any email. The website does not use advertising cookies or trackers.

Device and usage

• Device type, OS version, app version, language, time zone and crash reports.
• Which features are used and how often, as event counts, to understand what works. We do not use third-party advertising SDKs.
• Push notification tokens, so we can deliver notifications you turn on. Prayer-time reminders are scheduled on your device; our server sends only social and masjid notifications.

What Umma does not collect

• Your contacts. We never upload your address book.
• Photos, except a photo you add to a masjid page.
• Audio, except recordings you choose to make.
• Camera images in the Qibla camera view, which is shown live and never captured.

3. Why we use it

We do not use your data for advertising, and we do not build profiles for anyone else.

4. Who we share it with

• Other users: only what you chose to share, with the people you chose.
• Masjids: anonymized, banded counts; messages you send to a masjid you listed as your Main Masjid; donations you make, with your name only if you choose.
• Service providers, bound by contract to use data only for us: hosting and infrastructure (Replit, Cloudflare and, as we grow, Fly.io, Neon and Amazon Web Services), sign-in (Clerk), payments (Stripe, Apple, Google), identity checks (Stripe Identity), live audio (LiveKit), weather (Apple WeatherKit), map rendering and address lookup (Mapbox), travel times (Apple Maps), email delivery (Resend), and crash reporting.
• Donation recipients: what they need to issue a receipt, if you ask for one.
• Legal: if required by law, to protect users, or in connection with a merger or acquisition, with notice to you.

We never sell personal data and never share it with advertisers or data brokers.

5. Your controls

• Privacy settings in the app: location, background check-ins, journeys, calendar, Excused Days, every sharing switch, and notifications.
• Export your data from Settings → Privacy.
• Delete a single record (each check-in or prayer has Undo), a whole feature's data (for example all journeys), or your entire account from Settings → Privacy → Delete account. See how to delete your account. Deletion removes your data from our active systems within 30 days and from backups within 90 days, except giving records we must keep for tax and anti-fraud purposes (kept 7 years, then deleted).
• Sign out without deleting: your data stays backed up until you delete it.
• Child profiles: parents control all of the above for each child.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict use of your personal data, to object to certain processing, to withdraw consent, and not to be treated differently for exercising these rights. This includes rights under the California Consumer Privacy Act, the Texas Data Privacy and Security Act and similar U.S. state laws, the EU and UK GDPR, and the Saudi Personal Data Protection Law. To use any of them, use the in-app controls or email [email protected]. We respond within 30 days (45 in California). You can appeal a decision by replying to our response. We do not sell or share personal data for cross-context behavioral advertising, so there is nothing to opt out of on that front.

7. Retention

8. Where your data lives

Accounts with a United States home region are held in the United States. When Umma launches in the Gulf, accounts with a Gulf home region will be held in the Gulf region, and this section will be updated. Some providers (for example Apple, Google, Stripe and email delivery) process data in the United States regardless of home region, under standard contractual safeguards.

9. Security

Data is encrypted in transit (TLS) and at rest. Excused Days uses random, owner-specific client encryption keys protected on the device, not keys derived from account identifiers. Backup ciphertext and explicitly shared Sisters flags are identity-linked. The server never receives the recovery key. Native device authentication and screen protection require the updated native app; browser preview cannot provide biometric security. No system is perfectly secure. Release privacy and store disclosures require owner review.

10. Changes

We will post changes here and, for material changes, tell you in the app before they take effect. Continued use after that date means you accept the updated policy.

11. Location permissions and Salah Focus

If Prayer Mode ends without a log, an encrypted recovery note is kept on your device until you answer it or the prayer window ends. It contains session times, an end reason, available counts and source names, never raw motion or audio. A current masjid presence lease can quiet Umma during Jumu'ah and show a phone-away reminder; this adds no location collection. Developer validation can save notification attempts, Live Activity updates and Watch haptic timestamps locally, without notification text. You configure Salah Focus yourself; Umma cannot lock your phone or silence other apps.

Optional Apple Health: Prayer Mode can use a temporary Mind and Body workout to open your paired Apple Watch and keep motion sensing on during prayer. Umma always discards the workout. If you turn on Mindful Minutes, a confirmed, logged prayer can write its minutes to Apple Health; Undo removes the sample. Umma requests write access only and reads no Health data. Umma does not send Health data to its servers, use it for advertising or marketing, or include it in Umma backups or an app-managed iCloud store. Apple's own Health syncing and device backups are controlled by your Apple settings.

When you allow it, live location is used for nearby masjids and journey estimates. Automatic arrival check-ins require your separate background-location choice and precise access. A saved permission preference is not an operating-system grant. Salah Focus is optional and configured by you in Apple Settings. Umma's Focus filter and notification quiet periods stay on your device; we do not read your texts or other apps' notifications, and these settings are not sent to our servers. Umma cannot turn Focus on or silence other apps itself.

Sun Qibla Day notices are scheduled on your device; no location leaves it.

Siri can read today's prayer times and your logged count from your phone; nothing is sent to Umma's servers.

In a vehicle Umma uses your speed, direction of travel and phone motion on your device to show the Qibla; nothing is stored after the trip.

Saved-room Bluetooth signal fingerprints stay encrypted on the device and are excluded from Umma backups. Umma does not read Wi-Fi identifiers. Camera Qibla views do not save or upload frames. Room photos and AR room view are not enabled in this version.

Watch Qibla receives the phone's location rounded to 0.1 degrees. When the iPhone is not nearby, the watch may use its own approximate location; that location stays on the watch and is not saved.

A parked heading expires after two hours. Optional turn-cue summaries stay in your private prayer entry on this device, excluded from backups, sharing and points.

12. Third-party content and attributions

Quran text is supplied by Tanzil, unchanged. Pickthall’s The Meaning of the Glorious Koran is public domain. Full content credits and licence notices are available in Settings → About → Attributions.

If Umma links to an outside podcast, it opens in that podcast's own app or site; Umma doesn't host or re-host the audio.

© OpenStreetMap contributors. The OSM-derived masjid directory data is available under the Open Database Licence (ODbL) on request: [email protected]. Overture and Foursquare source credits are retained.

13. Optional Watch Quiet Sense

This experimental option is off by default. If you turn it on, watchOS holds accelerometer recordings in its system recorder for up to three days. Umma checks the samples in memory on your watch and discards them after each pass. Only posture events pass to your paired phone for a suggestion and optional local validation; they are excluded from Umma backups and are never sent to our servers. Umma does not write, upload, sync to a cloud service or back up the raw recordings. Turning the option off stops Umma's analysis, event transfers and recording renewals; watchOS finishes any recording already requested because its API has no immediate-stop operation. Low Power Mode pauses Umma's analysis and renewals. There is no continuous workout for this option.

Optional unwell-day marks, private Jumu'ah cards and their excuse choices stay on your device and are excluded from ordinary backups. Private prayer tallies are not shared or used in challenges. Points are encouragement, not a measure of reward.

14. Mind, Body, and Soul + Nafs

This optional section keeps growth picks, walkthrough answers, wellness goals, manual steps and workouts, and its preferences encrypted on your device, separately for each account. They are excluded from sync, backups, private commands, usage statistics, logs and crash reports. Apple Health connection is a placeholder in this update; the section requests no Health data. Comparison and circle-name choices are stored only and do not share wellness data or your name yet. We never sell these answers or use them for ads. This is device storage, not a claim of end-to-end encrypted backups.

15. Umma Map

Mapbox provides the native map. Opening a map sends Mapbox the map area requested, your IP address, access-token and SDK/network information, and the identifiers its SDK needs for billing. It does not receive your Umma account ID, prayer records or saved places. Looking up an address sends that address and, when available, a rounded nearby search area to Mapbox. Masjid directory searches use Umma's directory instead.

Mapbox Navigation computes routes from the trip's start and destination and uses your current location for guidance. These requests do not include an Umma account ID, saved-place record or worship data. Umma keeps monthly Free-trip counters and opaque request receipts to prevent double counting, never route or destination history. Optional Mapbox telemetry follows the same off-by-default switch before navigation starts; essential routing, SDK/session and billing traffic still occurs. Recent destinations and optional parking notes stay on your device.

Optional Mapbox location and usage telemetry is off by default. You can change “Help improve maps (Mapbox)” in Settings → Privacy → Umma Map. Turning it off does not stop the network requests needed to display maps or Mapbox's billing requests. Umma keeps operational counts of map loads and navigation trips, using a random map-installation identifier and your account when signed in, to manage allowances and estimated costs; these counts contain no coordinates, searches or worship history. Saved places stay on your device, encrypted in the native app, and are not synced or included in private backups. No contacts access is used.

Location minimization: private check-ins and the address and coordinates of your Main Masjid stay on your phone and are excluded from private backups. Backups retain its ID and name; a new device retrieves public directory details. Items you explicitly choose to share follow your circle sharing settings. Prayer-place coordinates are not backed up. Firsts for an area use an anonymous claim without an account, with a one-time random token and an approximate cell key; our application does not log the claim's IP address. Only the earned badge, without the cell, may be included in your backup. Masjid Firsts remain linked to your account.

Tags and Safety Check: circle members can tag you only while you allow tags. The sender does not include a masjid unless they choose “Add where”. You can remove a tag, block its sender, or use Safety Check to make your shared items private, leave circles silently and end Rafiq sessions. Existing copies another person has already seen cannot be recalled.

16. Contact

Umma (Yousef Kassim; Lifta Holdings, LLC, in formation) Texas, United States [email protected]