MinaraPrivacy Policy
Last updated: November 2, 2026Who is responsible
Minara is a product of YZO Labs, a French simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register (RCS) under number 105 133 094, 229 rue Saint-Honoré, 75001 Paris, France (“Minara”, “we”). YZO Labs is responsible for the personal data described here: the “controller”, in the words of the EU General Data Protection Regulation (GDPR). See also our legal notice.
For any question or request about your data, write to support@minarafoundation.com. We have not appointed a data protection officer: all requests go to this address.
This policy covers the website minarafoundation.com, the Minara app for iPhone and Apple Watch, the Minara app for Android, and the dashboard mosques use to run their page. Where one of them works differently, we say so.
The short version
- You can use prayer times, the Qibla, the Knowledge library and the mosque directory without an account.
- Your location, the prayers you mark as done, your routine progress and your settings stay in your browser or on your phone.
- If you create an account, we keep your email address and what you choose to sync: the mosques you follow, your favourite duas and your routines. You can delete it at any time from the Account page or in the app.
- People who manage a mosque give us more: who they are and proof that they run it, so that nobody can take over a mosque’s page.
- With your consent, we use Google Analytics on the website and Firebase Analytics in the iPhone app to understand how Minara is used. We don’t sell data, show ads or build advertising profiles.
When you visit the website
Kept in your browser only
Your settings (city and coordinates, calculation method, time format, display preferences), the prayers you mark as done, your routine progress and, when you’re not signed in, your favourites, routines and followed mosques are saved in your browser’s local storage. They are not sent to us. You can erase them at any time by clearing this site’s data in your browser.
Your location
You can type a city or let your browser share your position. Prayer times are then calculated in your browser. A few services receive coordinates or what you type, to make the rest work:
- Mapbox turns coordinates into a place name, finds the places you search for and draws the maps.
- timeapi.io gives the time zone of a place.
- Our server, when you look for mosques nearby: it receives the area shown on the map, or your approximate position, to search our directory and OpenStreetMap. It doesn’t store it, and it asks OpenStreetMap’s Overpass service about whole map squares, never about you.
Requests to Mapbox and timeapi.io come straight from your browser, so these services also see your IP address, as with any website you load.
Language
We remember the language you choose in a cookie called NEXT_LOCALE, for one year. On your first visit, our host tells us which country your IP address is in, only to open the French site for French-speaking countries. We don’t keep it.
Technical logs
Like any website, our host Vercel processes your IP address, your browser type and the addresses you request (which, for the mosque search, can include map coordinates) to deliver the site, keep it secure and fix errors. These logs are kept for up to 6 months.
Reporting a problem with a mosque
If you report a problem on a mosque’s page, we keep the reason, your message, the mosque concerned, your language, any photos or PDF files you attach and, if you give it, your email address so we can reply. Only the Minara team reads it. To limit abuse, reports with attachments are counted per sender for an hour using a keyed hash of your IP address that changes every day; the address itself is never stored, and the count is deleted after a day.
Being told when a mosque joins
On the page of a mosque that isn’t on Minara yet, you can ask to be told when it joins. If you’re signed in, we use your account’s email address. If you’re not, you give us an email address: we keep it with the mosque concerned and your language, and send a link to confirm it’s yours. The only purpose is to send you one email when that mosque joins Minara. Our legal basis is your consent, which you confirm by opening the link. If you don’t open it within 48 hours, we delete the address. Once the email has gone out, we delete the address too; only the number of people who waited is kept. Every email has a “Remove me from this list” link that deletes your entry at once, and you can also write to us. To limit abuse, sign-ups are counted per sender for an hour using a keyed hash of your IP address that changes every day; the address itself is never stored. Emails are sent through Resend.
If you create an account
An account is optional. It keeps your mosques and your Knowledge library in sync between the website and the app.
Signing in
You can sign in with your email address (we email you a one-time code or link), with Apple or with Google. Sign-in is run by Supabase. We receive your email address and an account identifier; with Google, Supabase also keeps the name and profile picture link Google shares. With Apple, you can hide your real address behind an Apple relay address. We never see your Apple or Google password. On the website, session cookies keep you signed in.
What is synced
- The mosques you follow: for each one, its name, city and position, whether it’s your home mosque and whether you want its notifications.
- Two settings: whether to use your mosque’s times, and your iqamah reminder.
- Your Knowledge library: favourite duas, the routines you create (names, descriptions and reminder settings), your changes to the Morning routine and the order of your routines.
Your location, prayer marks, routine progress and other settings are not synced: they stay on each device. We use synced data only to provide the sync you asked for.
Deleting your account
Deleting your account, on the Account page or in the app’s settings, erases your followed mosques, synced settings, favourites and routines, then your login. In the app, if you signed in with Apple, we also ask Apple to revoke Minara’s access. What is saved on your devices stays until you remove it. If you also manage a mosque, your login is kept because it opens your dashboard: write to us to have it removed.
In the Minara app
The app works like the website, with a few additions. Prayer times, alarms, widgets, the Apple Watch app and Prayer Lock all run on your device. Prayer Lock uses Apple’s Screen Time: Apple doesn’t let us see which apps you choose to block, and nothing about it leaves your phone.
Usage statistics (iPhone)
The iPhone app uses Google’s Firebase Analytics. It records events such as opening the app or a tab, setting an alarm, starting or finishing a routine, and marking a prayer as done or not done (with the prayer’s name and date). Google adds a random identifier for your installation, your device model, iOS and app versions, your language and an approximate location (country and city, worked out from your IP address). We don’t link these events to your account or email address, and we only collect them with your consent (see “Why we may use your data”).
Notifications
Notifications go through Google’s Firebase Cloud Messaging and Apple’s push service. The app subscribes your device to a few channels: one for your language, one for news from Minara, and one for each mosque you follow with notifications on. Google holds the address used to reach your device; we don’t store it. You can turn notifications off for each mosque in the app, or entirely in your phone’s settings.
Contacting support
The iPhone app’s support form sends us the category and your message, a screenshot if you attach one, your device model and iOS version, the app version, your language, the city set in the app and, if you give it, your email address. Screenshots are kept in private storage, and a copy of the message reaches our support inbox by email. Firebase App Check confirms the request comes from the genuine app.
Android
The Android app doesn’t include Firebase: no usage statistics and no notifications sent by Minara. Its support form opens your email app with the same details, so the message is sent from your own mailbox. [to confirm: still true when the Android app is released]
If you manage a mosque
Mosque administrators use the dashboard to publish their mosque’s page, prayer times and news. This needs more information.
Your dashboard account
Your name, email address and password (kept only in hashed form by Supabase) or one-time sign-in codes; your role in each mosque (owner, admin, editor, treasurer or viewer); and the invitations you send to your team (the person’s email address and role, sent to them by email).
What you publish
Your mosque’s details (name, address and position, contact email and phone, website, description, facilities), prayer times, announcements, events (including speakers’ names), posts and their photos. Once published, they are public on the website and in the app. Please only publish names and photos of people who agree to it.
Proving that you run the mosque
So that nobody can take over a mosque’s page, whoever creates or claims one sends a verification request. It can contain:
- your role in the mosque, your statement that the request is accurate and, if you act on someone’s behalf, that person’s name and contact details;
- the organisation’s legal name, phone, website, country and registration number;
- what an official register returns for that number. Only the number is sent:
- French associations and companies: the government’s Recherche d’entreprises service;
- charities in England and Wales: the Charity Commission’s register;
- an email proof: we send a code to the mosque’s address and keep only a hashed copy of it;
- a website proof: our server visits the mosque’s website to find a code we gave you;
- photos of the mosque and documents (such as statutes or a bill), kept privately in our database and seen only by the Minara team that reviews requests.
We email you as your request progresses, and our team is told about new requests.
Reading a timetable automatically
If you ask the dashboard to read a timetable from a PDF or a photo, the file is sent to Anthropic (the Claude AI) to pick out the times. Only the times you confirm are saved. [to confirm: how long Anthropic keeps API data under your agreement, and that it isn’t used for training]
Records kept for accountability
Actions in the dashboard (for example changing an iqamah time or voiding a transaction) are logged with the name and identifier of the person who made them. When a published notice or post is edited, the date of the edit is shown publicly and the previous version is kept for moderation.
Accounts, screens and followers
If your mosque keeps its accounts on Minara, the entries you type (which may name donors or suppliers) are stored for your mosque and visible only to your team. For each TV screen, we keep a device code, its name and when it was last online. You only ever see how many people follow your mosque, never who they are. [to confirm: for the entries a mosque types, such as its accounts, the mosque decides what it records and Minara stores it on its behalf; consider a data processing agreement with mosques]
Why we may use your data
The GDPR asks us to name a legal basis for each use. Ours are:
- Providing the service you asked for (contract): your account and its sync, the mosque dashboard, answering your requests.
- Our legitimate interests: keeping Minara secure and working, checking who runs a mosque, keeping a record of dashboard actions and edits, fixing reported problems.
- Your consent: notifications (asked by your phone), sharing your location (asked by your browser or phone), analytics cookies on the website (asked by our cookie banner), the email telling you a mosque has joined (confirmed by the link we send) and, as explained below, religion-related data.
- Legal obligations: when a law or an authority requires us to keep or hand over information.
Using a Muslim prayer app can reveal your religion, which the GDPR treats as sensitive. If you use Minara without an account, none of this leaves your browser or phone. Where it does, we rely on your explicit consent (Article 9(2)(a) GDPR):
- for the prayer-marking statistics of the iPhone app;
- for the routines, library and followed mosques synced with your account.
On the website, we ask for this consent with a checkbox the first time you sign in, before anything is synced, and we record when you gave it and which version of this policy you agreed to. [to confirm: consent screen in the app] You can withdraw this consent at any time, by changing your choice in the app or by deleting your account. We use this information only to provide Minara, never for advertising or profiling, and we never sell it.
Data outside the European Union
Our database is in the EU, but Vercel, Google, Apple, Mapbox, Resend and Anthropic are American companies and may process data in the United States. These transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses. [to confirm for each provider, and where timeapi.io is based]
How long we keep it
- In your browser or the app: until you clear it or uninstall the app.
- Your account and synced data: until you delete your account. If you don’t use it for 3 years, we email you a warning, then delete it.
- Support requests and mosque reports (including any attachments): 2 years after they are closed.
- “Tell me when it joins” email addresses: until the email announcing that the mosque has joined is sent, then deleted; 48 hours if the address is never confirmed. You can remove yours at any time from the link in each email.
- Verification documents and photos: while the mosque is on Minara, plus 1 year after it leaves, so we can show who verified it and how if that is ever questioned. For a rejected request: 1 year after the rejection.
- Mosque dashboard data: while the mosque is on Minara. When a mosque leaves, its page goes offline at once and its data is kept for 1 year so it can come back where it left off, then deleted, except what the law requires us to keep. A mosque can ask us to delete everything straight away.
- Activity log and edit history: as long as the content or the mosque exists, plus 1 year.
- Financial records kept in the dashboard’s accounts: 10 years where the law requires it (French accounting rules).
- Usage statistics: 14 months.
- Analytics cookies: 13 months at most.
- Your cookie choice: 6 months.
- Server logs: up to 6 months.
Your rights
Under the GDPR, you can:
- get a copy of your data and know how it’s used;
- have it corrected if it’s wrong;
- have it erased;
- limit its use, or object to a use based on our legitimate interests;
- receive the data you gave us in a reusable format;
- withdraw your consent at any time, without affecting what was done before;
- under French law, leave instructions about what happens to your data after your death.
Much of this you can do yourself: delete your account on the Account page or in the app, clear your browser’s data, turn notifications off, refuse analytics cookies through “Cookie settings”. For anything else, write to support@minarafoundation.com, if possible from the address linked to your account. We answer within one month and may ask you to confirm who you are.
If you think we haven’t respected your rights, you can complain to the CNIL in France, or to the data protection authority of your country.
Children
Anyone can use Minara, whatever their age: prayer times, the Qibla and the library need no account. Because an account and analytics rely on consent, where the law of your country sets an age (between 13 and 16 in the EU and the UK, 13 in the US), people under that age need a parent’s agreement to create an account or accept statistics. If you think a child has done so without it, write to us and we will delete the data.
Security
Connections to Minara are encrypted (HTTPS). Passwords are handled by Supabase and never kept in plain text, email codes are stored hashed, and verification documents and support screenshots are private and shown only to our team. Our database is meant to be reached only by our own server, not directly from browsers or apps. [to confirm: once every table has row-level security switched on] No system is perfectly safe: if a breach put your data at risk, we would tell you and the authorities as the law requires.
Changes to this policy
When we change this policy, we update the date at the top of this page. If a change matters, we will also tell account holders, by email or in the app, before it applies. [to confirm]
Contact
Questions, requests or concerns: support@minarafoundation.com, or see our Support page.