Privacy notice

Who we are

Salahtime helps Muslims discover nearby mosques and community-verified prayer times. The service is self-hosted by TomorrowTools on operator-controlled hardware and may be accessed globally. See also our security & transparency page.

Data we collect

• Location (browser): used to show nearby mosques and distances. Guest browsing does not persist your location on our servers.
• Mobile number: verified via OTP, stored as a one-way hash for authentication and abuse prevention.
• Google sign-in: optional, for favourites only unless you also verify your mobile number.
• Account email: used for sign-in, account recovery, and replies you request. It is not shown in default administrator user analytics; access is restricted to authorised support and security purposes.
• Contributions: mosque additions, schedule updates, and moderator requests you submit.
• No user-location analytics: we do not create country or city analytics from your account, searches, or map location.
• Advertising: the Android app shows ads (a Google AdMob banner on the home screen). AdMob may collect the advertising ID and usage signals under Google's policies to serve and measure those ads. You can dismiss a shown banner. We do not sell your personal data. Ad revenue pays for servers, maps, and keeping the app available.

International users (US, EU, UK, etc.)

Where GDPR, UK GDPR, CCPA/CPRA, or similar laws apply, you may have rights to access, correct, delete, or restrict processing of your personal data, and to lodge a complaint with your local supervisory authority.

We process data on lawful bases including consent (OTP verification), legitimate interests (fraud prevention and app integrity), and performance of a service you request (showing mosque times).

We do not sell personal data. Third-party processors (for example Google Maps/sign-in and Cloudflare) are used only as needed to operate the service. Account emails are not shown in default administrator lists; privileged admin access uses multi-factor authentication.

Retention

• Account data is kept while your account remains active.
• Read in-app notifications are purged after 90 days.
• Anonymous client platform signals are purged after 90 days.
• Soft-deleted accounts are hard-deleted after 30 days.
• Admin security audit events are retained up to 24 months.

Contact & account deletion

For privacy requests, email [email protected].

To delete your account and associated data, use the in-app Account → Delete account flow, or visit salahtime.tomorrowtools.dev/delete-account.