Privacy Policy

Qiblify Inc (“Qiblify,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your choices, when you use qiblify.com, app.qiblify.com, our display screens, donation pages, kiosk applications, the Qiblify+ mobile app, and related services (the “Service”).

1. Who is responsible for your data

• For an Organization’s account and content, Qiblify is the data controller.
• For a Donor’s information collected through an Organization’s donation pages, the Organization is the controller and Qiblify is its processor — we handle that data on the Organization’s behalf to run the donation and send receipts.

2. Information we collect

From Organizations (account holders):

• Name, email, phone, role, and the organization’s name, address, logo, brand color, and tax ID (EIN) you provide.
• Login and authentication data (via Supabase Auth).
• Content you create — announcements, campaigns, prayer settings, images.
• Billing details for your subscription (processed by Stripe; we do not store card numbers).

From Donors:

• Name and email (if you choose to provide them, e.g. for a receipt).
• Donation amount, fund/category, frequency, and date.
• Payment information — handled entirely by Stripe. Qiblify never receives or stores your full card number. We may store a card’s last four digits and card brand as returned by Stripe, for receipts and support.

Automatically:

• Basic device, log, and usage data, and cookies needed to run the Service and keep you signed in.

From Qiblify+ mobile app users: see Section 9.

We do not knowingly collect sensitive categories of personal data beyond what is necessary to process a donation, and we never ask Donors for information a donation does not require.

3. How we use information

• To operate the Service — process donations, move the live campaign bar, send receipts and year-end statements, run display screens.
• To authenticate users and secure accounts.
• To provide support and communicate about the Service.
• To bill Organizations for subscriptions.
• To improve reliability and prevent fraud and abuse.
• To comply with legal, tax, and accounting obligations.

We do not sell personal information. We do not use donor data for advertising, and we do not display third-party ads in the Service.

4. How information is shared

We share data only with service providers that help us run the Service, and only as needed:

• Stripe — payment processing and payouts. Card data lives with Stripe.
• Supabase — database, authentication, storage, and realtime hosting.
• Email provider (e.g. Resend) — to send receipts and account emails.
• Aladhan API — prayer-time calculations. No personal data is sent to Aladhan; only location/time parameters for prayer times.
• Vercel — application hosting and delivery.
• Sentry — crash, error, and performance diagnostics for the web app and the Qiblify+ mobile app, configured not to collect personal information by default.
• Expo (EAS) — delivers updates to the Qiblify+ mobile app and runs the push-notification service that hands notifications to Apple and Google for delivery to your phone.

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice where required).

We never sell, rent, or trade donor data, and we do not share one Organization’s donor list with any other Organization.

5. Data storage and security

Data is stored on our providers’ secured infrastructure in the United States. Access is scoped per organization using row-level security, so an Organization can only see its own data. We use encryption in transit, restricted access, and other safeguards. No system is perfectly secure, but we work to protect your information and to keep card data out of our systems entirely (it stays with Stripe).

6. Data retention

We keep account and donation records for as long as an account is active and as required for tax, accounting, and legal purposes (donation and receipt records are typically retained for several years). Organizations may request export or deletion of their data, subject to records we must retain by law.

Legal acceptance records. When someone accepts our Terms of Service, this Privacy Policy, or an Order Form, we keep a record of the acceptance: which document and version, the plan and price shown, the date and time, the email address used, and the IP address and browser (user agent) the acceptance came from. These records are evidence of what was agreed and when, for the organization and for us. They are kept after an account is deleted: deleting your account removes the link between the record and your account, but the record itself, including the email address and IP address, stays.

• Why we keep it (legal basis): our legitimate interest in establishing, exercising, and defending legal claims; performing our agreement with the organization; and complying with tax, accounting, and other legal obligations.
• How long (retention period): while the account or subscription is active and for seven (7) years after the account is deleted or the last acceptance was recorded, whichever is later. After that the record is deleted or de-identified.
• What it is used for: proving what was agreed and when, and resolving disputes. We do not use it for marketing or analytics, and we never sell it.

7. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights:

• Donors: contact the Organization you gave to, or email admin@qiblify.com and we will route your request to the right Organization.
• Organizations: use your dashboard or email admin@qiblify.com.

You can unsubscribe from non-essential emails at any time. Transactional emails (like receipts) are part of the Service.

8. Recurring donations

If you set up a recurring gift, we retain the information needed to process it (via Stripe) until you cancel. You can cancel anytime through the manage link in your receipt or by contacting support.

9. Qiblify+ mobile app

Qiblify+ is our app for congregants (iOS and Android): prayer times, Qibla, your masjid’s announcements, the Qur’an, and giving. You can use it without an account. This section describes what the app itself collects; the rest of this Policy applies as well.

Account. Signing in is optional. If you sign in, you can use your email (we send a one-time code) or Sign in with Apple; where it is offered, Google sign-in works the same way. We store the email address and account identifier the sign-in method gives us, and, for signed-in users, your home masjid and the masjids you follow so they travel with you between devices. If you hide your email with Sign in with Apple, the relay address Apple provides is what we keep.

Device location. Location is optional. The app asks for permission only when you tap a feature that needs it, and only for while you are using the app. It uses your location for three things: finding masjids near you, calculating prayer times for where you are when you are away from your home masjid, and the Qibla direction. The Qibla direction is worked out on your phone and is never sent anywhere. For nearby masjids and away-from-home prayer times, the app sends your coordinates to our own servers, and to no one else, while you are using one of those features. To calculate prayer times, our servers round the coordinates to about 110 meters (about 360 feet) and send only that rounded point to the Aladhan prayer-time service (see Section 4), never with your name, account, or device. We keep the rounded point together with that month’s prayer times in a cache, so people nearby get their times without asking Aladhan again; the cache is not linked to you, your account, or your device. Like any request to our servers, a request that carries coordinates passes through our hosting and error-monitoring providers (Vercel and Sentry, see Section 4), whose logs may record it. We do not keep a history of where you have been, and we never sell your location or use it for advertising. The app does not use location in the background: it does not request background location, and it is built with background location turned off on both iOS and Android. “Janazah & community notices near you”, in the app’s notification settings, is off until you turn it on. While it is on, the app sends an approximate location, rounded on your phone to about 1 km (a little under a mile), with its notification registration, so notices can be relevant to your area; turning it off removes it. You can withdraw location permission at any time in your phone’s settings, and the app keeps working with a city you choose instead.

Push notifications. If you allow notifications, the app registers a push token (a delivery address issued by Apple or Google through Expo’s push service) with our servers, together with a random install identifier the app creates. That identifier is never a hardware serial number or an advertising ID. Tokens are used only to deliver the notifications you chose. Turning notifications off in the app removes the registration, and uninstalling the app invalidates the token. Adhan and event reminders are scheduled on your phone and are not sent to us.

Crash and performance diagnostics. The app uses Sentry to report crashes, errors, and performance so we can fix problems. A report includes the error, the app version, and the device model and operating system version. Sentry is configured not to collect personal information by default, and session replay is off. Diagnostic context for the giving flow records at most the masjid, the fund, and the amount, never your name, email, or card details.

App updates. When it launches, the app checks for updates to its code and assets through Expo’s update service (EAS Update). That check sends the app’s runtime version, release channel, and current update identifier, and nothing about you.

What is stored on your device. So the app works offline, it keeps on your phone: your sign-in session (in the device’s secure keychain), the random install identifier, your preferences (language, home and followed masjids, notification, adhan, and privacy choices, onboarding progress), recently viewed masjids, cached prayer times and masjid details, your Qur’an reading position and bookmarks, and a private, encrypted, device-only record of your own gifts. If you start a bank-account gift that is awaiting verification, the app keeps only a reference to it and Stripe’s verification link, never your account or routing numbers. Card and bank details are entered into Stripe’s own fields and never reach our servers. Apart from the home and followed masjids a signed-in account syncs, these items stay on your phone, are not uploaded to build a profile of you, and are removed when you delete the app.

No ads, no tracking. The app shows no advertising, contains no advertising or analytics SDK, does not read your device’s advertising identifier, and does not track you across other companies’ apps or websites. We never sell your data.

Deleting your account and data. In the app, go to Profile > Account to export your data (one JSON file) or delete your account. You can also email admin@qiblify.com from the address on your account. Deleting your account removes it and the data linked to it. Donation and receipt records are kept by the organization you gave to and by us for as long as tax, accounting, and legal rules require, and legal acceptance records keep the email address and IP address they were made with, for the period and on the legal basis stated in Section 6. If you never signed in, there is no account to delete: turn notifications off to remove the push registration, and delete the app to clear everything it stored on your phone.

10. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

11. International users

The Service is operated from the United States. If you use it from elsewhere, you understand your information will be processed in the U.S.

12. Changes to this Policy

We may update this Policy. Material changes will be posted here with a new effective date and, where appropriate, notified to Organizations.

13. Contact

Qiblify Inc
Minneapolis, MN, USA
Email: admin@qiblify.com