Privacy Policy

Our Commitment

Sacred Sayings Ltd operates Muslim Maps and is the data controller for personal data processed through the Muslim Maps website (muslimmaps.app) and the Muslim Maps apps for iOS and Android (together, the “service”). This policy covers both, and explains our account, location, contribution and usage data practices. Contact us at muslimmapsuk@gmail.com or through our contact page.

Information We Collect

Personal information

• Account ID, email address and any name supplied when you register or sign in with email, Google or Apple
• Profile details and public/private visibility choices you provide
• Reviews, ratings, comments and place suggestions you submit
• Places you log as visited, with any notes and photos you add to them
• Photos and other content you upload
• Contact enquiries, including your name, email, optional phone number and message. A signed-in enquiry may also be associated with your account ID.

Usage information

• Pages and places you view, account-based Recently Viewed history, saved places and guides, collections and their memberships
• Search queries and preferences
• Technical information such as device or browser details, IP address and security or request logs processed by our service providers
• Your device location, only when you use Near Me, Detect location or other location features and allow it. It is used to show nearby places and is not stored on your profile.

Mobile App

• Location: used only while the app is open, and only when you use Near Me or other location features. It is not stored on your profile.
• Photos and camera: the photo library (and camera, where offered) is used only when you add photos to a review, a visit or a place submission.
• Sign-in: by email, Google or Apple. Your sign-in session is kept in secure storage on your device. Some preferences and device-saved items are kept on the device.
• Maps and search: maps come from Google Maps and search uses Algolia.
• Advertising: the app has no advertising or advertising ID tracking.
• Optional notifications: mobile push notifications are being introduced for supported iOS and Android app versions. We send them only to opted-in devices after you grant notification permission. You can turn them off in the app or your phone settings and continue using the service without them.
• Deletion: you can request account deletion in the app’s account settings as well as on the website.

How We Use Data

Service provision

• Provide and maintain the website and apps
• Process place submissions, edits, reviews, uploaded photos and support requests
• Store and retrieve your saves, collections, visits and account settings across devices
• Support sign-in, account verification and account recovery

Improvement and safety

• Measure website usage and improve the service
• Screen uploads and help prepare or translate place information using automated tools
• Respond to support enquiries
• Keep the service secure and prevent abuse

Retention & Deletion

Account records, saves, collections and visits are kept while your account is active. You can request account deletion in Privacy Settings on the website or Account settings in the Muslim Maps app.

• 30-day reactivation period. We show the date your request becomes ready for processing. You can still sign in and reactivate until your request is processed. Your public profile and public visits are hidden immediately; private data stays unchanged until processing.
• Manual completion. After the 30-day period, an authorised administrator manually processes your request, removes your personal account records and sign-in account, and removes non-retained uploaded files from our storage providers. Staff process your account when the 30-day reactivation period ends, at the latest by the next working day. Working days are Monday to Friday, excluding England and Wales bank holidays. File removal is tracked separately until completed.
• What stays. Published reviews, approved photos and approved place listings stay without your name, shown as from a former member. A non-public anonymised identity record is retained only to preserve those contributions.
• Archive copy. Before processing, we keep a private copy of Download My Data content plus the deletion request. Only super administrators can access it. The archive is permanently purged 1 year after processing. During that year it is kept to handle disputes and legal claims, prevent abuse and meet legal obligations. Staff receive reminders for purge deadlines.

Staff may process early at your request or pause processing for a dispute or legal obligation. You may contact us for the progress of your request.

Data Protection

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including:

• HTTPS connections to our services
• Account-scoped access rules for private records
• Upload validation and server-side request checks
• Permission checks for staff tools; deletion archives are limited to authorised staff
• Sign-in sessions in the app kept in the device’s secure storage

No system can guarantee absolute security.

Information Sharing

We do not sell, trade or rent your personal information. We share it only in these limited circumstances:

With your choice

A public profile can show your name, initials and profile details. A visit appears publicly only when you choose to show that visit on your profile, your profile is public and you have no pending account-deletion request. Its notes and photos are shared only when you also choose to share those details. Making your profile private hides its public page and visits; it does not hide separately published reviews or contributions. Saved places, guides and collections remain private to your account.

Visit photos are held in private storage and accessed using temporary authorised links. A link already issued may remain usable until it expires, and we cannot withdraw copies already downloaded by someone you shared with. Review and place-submission photos are stored at public image addresses, even while awaiting moderation; moderation controls whether they appear on public pages, not whether someone with the direct image address can access them. Do not upload confidential material as a review or place-submission photo.

Service providers

Hosting, authentication, database and storage providers (including Lovable Cloud, Amazon Web Services and Cloudflare) process the records needed to run the service. Cloudflare delivers and resizes public images. Google provides maps and place lookups, and Google Analytics measures website usage (the app does not use it). Google and Apple process sign-in when you choose an available sign-in option. Algolia receives search queries to return places, guides and help results. AI services may receive submitted images for screening and place information for drafting or translation. Providers may process technical data such as IP addresses and device details.

Legal requirements

When required by law or to protect our rights and safety.

Providers may process data outside the UK. Contact us for information about the providers handling your data and the safeguards for a particular transfer.

Your Privacy Rights

Depending on the legal basis and circumstances, UK data protection law gives you these rights:

• Access: request a copy of your personal data
• Correction: update or correct inaccurate information
• Deletion: request deletion of your account in Privacy Settings or in the app, as described under Retention & Deletion
• Portability: use Download My Data in Privacy Settings to download your account records as JSON, including saved guides and collection memberships. Photos are referenced by their links; image files are not included.
• Objection and restriction: object to or ask us to limit how we use your data
• Visibility: change Public profile in Privacy Settings and choose whether to share notes and photos on individual visits
• Consent: where processing relies on consent, you can withdraw it at any time

To exercise these rights, email muslimmapsuk@gmail.com or use our contact page. We normally respond within one month. You can also complain to the UK Information Commissioner’s Office or your local data protection authority.

Cookies & Tracking

The website uses browser storage for sign-in sessions, the access gate, display preferences and cached settings. The app keeps its sign-in session in secure device storage and some preferences and device-saved items on the device.

The website loads Google Analytics to measure page views, searches and interactions. It can use cookies and receive technical information about your browser and connection. The website does not currently provide an analytics consent control; accepting the Terms is not consent to non-essential tracking. The app does not use advertising identifiers or third-party marketing analytics. The iOS and Android apps send crash and performance diagnostics (device model, operating system, app version, session and network timing, and the addresses of services contacted) to Expo, our app infrastructure provider, to find and fix errors. No account details are attached to these diagnostics.

You can manage cookies and site storage in your browser, but blocking essential storage may affect sign-in. Google offers an Analytics opt-out browser add-on.

Policy Updates

We update this policy when our data practices change and show the revised date and version at the top. The same policy applies to the website and the apps, and material changes will be highlighted. An update does not by itself give consent for a new use of your data.

Optional Mobile Notifications

Optional mobile push notifications may include Muslim Maps news and updates about places and guides. They are not website browser notifications. Where available in your app version, you choose whether to opt in and grant your phone's notification permission. We use your consent for these optional notifications; you can withdraw it in the app or disable notifications in your phone settings without losing access to the service.

We store your account-linked Expo device token, device platform and opt-in preference to address notifications. Expo Push Service and Apple Push Notification service (iOS) or Google Firebase Cloud Messaging (Android) process device tokens, notification title, message and destination data, and technical delivery information. Notification data includes identifiers used to associate receipt and opening events with a campaign. These providers may process information outside the UK; contact us for information about applicable transfer safeguards.

We record sending attempts, provider acceptance and delivery errors, and actual receipt or opening events reported by the app. We use these account-linked events to measure notification results, including unique opens; provider acceptance alone is not proof that your phone received a notification. Background receipt events are not always available.

Notification contents may be visible on your lock screen depending on your phone settings. Device registrations are removed on sign-out or account switching when the app can contact the service; opting out stops further sending to that registration. Pending account-deletion requests are excluded from sending. Account-linked notification records are removed during account-deletion processing under the Retention & Deletion section. Withdrawing consent does not affect processing that already took place.

App Update Notices

Supported app versions may show an optional notice linking to an available Apple App Store or Google Play update. This in-app notice is separate from Expo push notifications and does not require push-notification permission. You can continue using the app without following the store link.

When implemented in your app version, the app reports when the notice is shown and when its store button is tapped. These records contain the platform (iOS or Android), release version, event type and timestamp; no account ID or device token is stored with the update event. Our service providers may separately process normal connection and security information. We use aggregate event counts and click percentages to understand update-notice engagement. They do not prove a download or installation, or count unique people or devices. Opening the store also involves Apple's or Google's services.