Al-Salam App — Privacy Policy

Last updated: August 13, 2026

This policy explains what the Al-Salam mobile app does with your information — in plain language, because there isn't much to explain. The app was designed so that your worship data stays on your phone by default.

Who we are

The Al-Salam app is provided by Mount Pleasant Islamic Center (operating as Masjid Al-Salam / Mount Pleasant Islamic Centre, Brampton, Ontario, Canada), which also serves the Niagara Falls Islamic Center (NFIC) community. We are the "data controller" — the organization responsible for any personal information the app handles. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Questions or concerns: app@mpicbrampton.com.

The short version

• The app works fully without an account, and most of your data never leaves your phone.
• We collect personal information in exactly three cases, all under your control: an optional account (your email address), optional backup/sync (your prayer log), and optional urgent announcement notifications (a notification token for this device).
• We receive anonymous crash reports so we can fix bugs.
• We never sell data, never show ads, never use analytics or advertising trackers, and never collect your location.

What stays on your phone

The following is stored only in the app's local storage on your device. We cannot see it, and it is removed when you delete the app:

• Your prayer tracker history and streaks (unless you turn on backup — see below).
• Your tasbih counts and adhkaar progress.
• Your app preferences (theme, language, selected masjid location, notification choices).
• Cached copies of public content (announcements, timetable, video list) so the app works offline.

Location deserves its own mention: if you grant location permission (asked only when you open the Qibla finder or turn on travel mode), your coordinates are used on your device to calculate prayer times and the qibla direction. Your location is never sent to our servers and we never store it off your device. Two narrow, standard exceptions involve your device's platform, not us:

• In travel mode, the app asks your phone's built-in geocoding service (provided by Apple or Google as part of the operating system) to turn coordinates into a city name for the label on screen. That request is handled by Apple/Google under their platform terms.
• If you type a city name by hand in the Qibla finder, that typed text (not your GPS position) is sent to OpenStreetMap's Nominatim search service to look up the city's coordinates.

Prayer notifications are computed and scheduled entirely on your device — no server is involved and no token is registered; those alerts fire even in airplane mode.

Urgent announcement notifications (optional, off by default)

There is exactly one notification the masjid can send to your phone, and only if you ask for it: Settings → Notifications → Urgent announcements. The switch is off for everyone until you turn it on.

• What we collect when you turn it on: a notification token issued by your phone's operating system (Apple or Google) for this app, plus a random identifier the app generates for your device and the masjid you selected. The random identifier is not your phone's hardware ID or an advertising ID — it means nothing outside our notification list.
• What it is used for: delivering urgent notices only — a janazah, an unexpected closure, a sudden schedule change. It is never used for fundraising, events, or anything routine, and it is never used to build a profile of you or linked to your prayer log.
• You do not need an account. If you happen to be signed in, the record is also tied to your account so that deleting your account deletes it.
• Turning it off deletes it. Switching Urgent announcements off removes the record from our servers. The app does not assume this worked: the server reports back how many records it removed, and if the app could not reach us at all it tries the deletion again the next time you open it. Deleting the app also ends delivery, since the token stops working.
• Who else sees it: delivering a notification necessarily passes it through Apple's or Google's push service and through Expo, which operates the delivery service on our behalf. They receive the token and the notice text — the same words you see on the lock screen.

The optional account and backup

You never need an account to use the app. If you choose to sign in (Settings → Sign in):

• What we collect: your email address. Sign-in is passwordless — we email you a one-time code, so there is no password to store or leak.
• If you also turn on backup/sync (off by default): your prayer log, streaks, and app preferences are copied to your account so you can restore them on a new phone. That is the complete list — nothing else is synced.
• Where it lives: in our database hosted by Supabase, our cloud database provider, protected by row-level security so each account can only read and write its own rows. Supabase processes this data on our behalf and does not use it for its own purposes.
• What we use it for: signing you in and storing your backup. Nothing else — no marketing emails, no profiling, no sharing.

Crash reports

If the app crashes or hits an error, a report is sent to Sentry, an error-monitoring service, so we can find and fix the bug. These reports are deliberately anonymous:

• No user identity is attached — the app strips the user record and scrubs anything that looks like personal information (emails, tokens, phone numbers, addresses, user IDs) before the report leaves your device.
• We collect error reports and anonymous session counts (how many app sessions crashed), not behavioral analytics, and no advertising identifiers.

Public content the app fetches (and what those servers can see)

To show masjid content, the app downloads public, unauthenticated pages and feeds:

• Announcements and iqama times from our database (Supabase).
• The masjid's published daily timetable page (hosted at prayertimedisplay.com).
• The masjid's latest videos from YouTube's public video feed and thumbnail servers. There is no YouTube player or Google SDK inside the app; tapping a video opens it in the YouTube app or your browser, where Google's own privacy policy applies.

Like every request on the internet, these fetches expose your device's IP address to the server being contacted, and those services keep their own standard server logs. The requests carry no account information and nothing about your worship data. We do not log or keep IP addresses ourselves.

Donations

Donations are not processed in the app. The Donate button opens the masjid's own donation page in your phone's browser. Any payment details you enter there are handled by the website and its payment provider under their terms — the app never sees, collects, or stores payment information.

What we never do

• No advertising, and no advertising identifiers (IDFA/AAID).
• No analytics or tracking SDKs.
• No selling, renting, or trading of personal information — to anyone, ever.
• No collection of contacts, photos, messages, browsing history, or precise movements.

Retention

• On-device data: kept until you clear it in the app or uninstall the app.
• Account and backup data: kept while your account exists; deleted when you delete your account.
• Crash reports: retained on Sentry for its standard rolling retention window (measured in weeks, not years), then automatically deleted.

Deleting your data

• In the app: Settings → Delete account removes your account and all backed-up data from our servers. Signing out alone does not delete server data; deletion does.
• On the web: request deletion at https://mpicbrampton.com/app/delete-account.
• By email: write to app@mpicbrampton.com from the address on the account and we will delete it, normally within 30 days.
• Local data: uninstalling the app removes everything stored on the device.

Children

The app is intended for a general audience and is not directed at children. It requires no personal information to use, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

Your rights (PIPEDA)

Under Canadian privacy law you may ask us, at app@mpicbrampton.com, to:

• tell you what personal information we hold about you (for most users: none);
• provide access to it or correct it;
• withdraw consent — turn off sync in Settings, or delete your account entirely.

We will respond within the timelines PIPEDA sets (normally 30 days). If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Changes to this policy

If we change what the app collects, we will update this policy, change the date at the top, and update the privacy details on the App Store and Google Play before the change ships. The most recent such change is the optional urgent announcement notifications described above (MA-2, 2026-08-13) — the first feature in the app that registers anything about your device with our servers.

Contact

Mount Pleasant Islamic Center (Masjid Al-Salam)
160 Salvation Road, Brampton, ON L7A 0W7, Canada
Email: app@mpicbrampton.com
Website: https://mpicbrampton.com