Adaa Privacy Policy
Effective date: 23 September 2026
Contents
- 1. Who we are
- 2. Summary
- 3. The data we process and why
- 4. Special category and sensitive data
- 5. Legal bases for processing (EEA and UK users)
- 6. Where your data is stored and who processes it
- 7. How long we keep data
- 8. Security
- 9. Using Adaa without an account (guest use)
- 10. Device permissions
- 11. Children
- 12. Your rights
- 13. Deleting your account and data
- 14. Changes to this policy
- 15. Contact
This Privacy Policy explains how personal data is collected, used, stored and protected when you use Adaa, a mobile application for keeping a personal record of your namaaz (daily prayers), available for Android and, in future, iOS (the "App"). It also explains the rights you have and how to use them.
Please read it together with the account deletion page: https://ambadri.github.io/adaa-privacy/delete-account/
1. Who we are
Adaa is developed and operated by Abbas Murtaza Badri, an individual developer resident in India ("we", "us", "our").
For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws, we are the controller of the personal data described in this policy.
Contact: adaa.official.app@gmail.com
We aim to reply to every privacy question or request within 30 days.
2. Summary
- Adaa works without an account. If you do not sign in, everything you record stays on your device and we never receive it.
- If you sign in, your records are synced to a private cloud database so you can use them on more than one device. Only your own signed-in account can read them.
- Some of what you record is sensitive: your prayer record relates to your religious practice, and Uzur records relate to menstruation, which is health data. We use it only to provide the App's features to you.
- We do not sell your data, share it with advertisers, or use it for advertising or profiling. The App contains no advertising, analytics or crash-reporting software.
- You can delete your account and all synced data at any time from inside the App, or by emailing us.
3. The data we process and why
3.1 Data you enter in the App
| Data | Purpose | Where it is kept |
|---|---|---|
| Name | Personalises the App (greeting, initials) | Your device; your account if signed in |
| ITS number (optional) | Community identifier you can enter during setup or later in Profile, if you have one; used only to personalise your profile. You can leave it out, or remove it at any time, and the App works the same. We do not check it against any external system. | Your device; your account if signed in |
| Date of birth (only if you entered it in an earlier version of the App; the App no longer asks for it) | Kept with your profile so it is not lost; not used for anything | Your device; your account if signed in |
| Gender | Decides whether the Uzur feature is offered | Your device; your account if signed in |
| Misaaq date (optional) | Calculates the number of namaaz expected since your Misaaq | Your device; your account if signed in |
| Prayer record (for each date and namaaz: prayed or missed, and when the mark was last changed) | The core purpose of the App: your prayer log, statistics and qaza count | Your device; your account if signed in |
| Qasr days (the dates and namaaz you mark as Qasr) and, if you used an earlier version of the App, Qasr trips (trip dates, distance from home, and your answers to the Qasr questions such as length of stay, whether you own property there, and whether a blood relative is present) | Shows when shortened (Qasr) prayers apply | Your device; your account if signed in |
| Uzur periods and Uzur days (start and end dates of menstruation) | Marks those days as excused rather than missed | Your device; your account if signed in |
| Your usual Uzur length (optional) | Suggests the end date of a new Uzur period | Your device only |
| Home location (latitude, longitude, place name and time zone) | Calculates namaaz times and the Qibla direction | Your device; your account if signed in |
| A "current location" you set by hand (optional) | Used for namaaz times only when GPS cannot find you | Your device only |
3.2 Account data (only if you sign in)
| Data | Purpose |
|---|---|
| Email address | Identifies your account and lets you sign in |
| Account identifier (a random ID created by our authentication provider) | Links your synced records to your account |
| Sign-in method and the identifier your sign-in provider gives us (Google or Apple) | Lets you sign in with that provider |
| Basic profile details returned by Google when you sign in with Google (your name as shown on your Google account and a link to your Google profile photo) | Recorded automatically with your account by our authentication provider. The App does not display or otherwise use them. |
| Sign-in session tokens | Keep you signed in on your device |
| Sign-in and security records (for example the time of a sign-in and the IP address it came from) | Keep the service secure and prevent abuse |
We do not use passwords. You sign in with Google, with Apple (on iOS), or with a one-time code sent to your email address. When you sign in with Apple you may choose to hide your email address; we then receive only the private relay address Apple creates.
3.3 Data used on your device but not collected
- Your precise location (GPS). When you allow it, the App reads your location while it is open, to calculate namaaz times for where you are, to point the Qibla compass and to work out how far you are from home. These readings are used on your device and are not stored or sent to us. Only the home location you choose to save is kept (see 3.1).
- Place names from coordinates. To show the name of your home city, the App uses your phone's built-in geocoding service (provided by Google on Android and Apple on iOS), which receives the coordinates for that lookup.
- Notifications. Namaaz reminders are scheduled and shown by your device. We do not use a push-notification service and hold no notification token for your device.
3.4 Data sent to services when you use certain features
- City search. When you search for a city by name, the text you type is sent to the Open-Meteo geocoding service to find that place. Your device's location is never sent. Like any website, the service receives your IP address with the request. If Open-Meteo cannot be reached, your phone's own geocoding service is used instead.
- App updates. The App checks for updates to its content through Expo's update service (EAS Update). Each check sends technical information: the platform (Android or iOS), the App version, the update channel, and a random identifier created for this installation of the App. It contains no information you have entered in the App.
3.5 Data we do not collect
We do not collect your contacts, photos, files, messages, microphone or camera data, advertising identifier, browsing history, or payment information. We do not track you across other apps or websites. We do not collect your location in the background.
4. Special category and sensitive data
Two kinds of data in the App receive special protection under data protection law:
- Health data. Uzur records are dates of menstruation. This is data concerning health.
- Data revealing religious beliefs. Your prayer record, your Misaaq date, Qasr and Uzur records and your ITS number (if you enter one) relate to your religious practice.
Under US state privacy laws, this information and your precise home location are "sensitive personal information".
We process this data only to provide the App's features to you, and:
- we never sell it, share it for advertising, or use it to infer anything about you beyond what the feature needs;
- it is never written to Google Health Connect, Apple Health or any other health service;
- when synced, it is readable only by your own signed-in account, which is enforced by the database itself (row-level security) and not only by the App;
- Uzur is not shown on your lock screen in notifications.
Our legal basis for processing this data is your explicit consent, which you give by choosing to enter it and, for synced data, by choosing to sign in. The Uzur feature is optional, and you can withdraw your consent at any time by deleting the records, by signing out, or by deleting your account. Withdrawing consent does not affect processing that took place before you withdrew it.
5. Legal bases for processing (EEA and UK users)
| Purpose | Legal basis |
|---|---|
| Providing the App's features and, if you sign in, your account and sync | Performance of a contract with you (GDPR Art. 6(1)(b)) |
| Processing health data and data revealing religious beliefs | Your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)) |
| Keeping the service secure, preventing abuse, keeping sign-in records, checking for App updates | Our legitimate interests in running a safe and working service (GDPR Art. 6(1)(f)) |
| Answering your requests and keeping a record that a deletion request was completed | Legal obligation (GDPR Art. 6(1)(c)) and our legitimate interests |
We do not use automated decision-making that produces legal or similarly significant effects on you. The App calculates things like namaaz times and your scores, but only as information for you.
6. Where your data is stored and who processes it
We do not sell, rent or trade personal data, and we do not share it with third parties for their own purposes. We use the following service providers, which process data on our behalf or provide a function you choose to use:
| Provider | What it does | Data involved |
|---|---|---|
| Supabase, Inc. | Hosts the cloud database, sign-in and the account deletion function | Account data and all synced records (only if you sign in) |
| Sign in with Google (Android); Gmail is used to send one-time sign-in codes by email | Your email address and Google sign-in details; the email address the code is sent to | |
| Apple | Sign in with Apple (iOS) | Your Apple sign-in identifier and email or private relay address |
| Expo (650 Industries, Inc.) | Delivers App updates | Technical update-check information (see 3.4) |
| Open-Meteo | City search | The city name you type and your IP address |
| Google Play and the App Store | Distribute the App | Handled under their own privacy policies; we receive only statistics and crash reports that do not identify you |
Our database is hosted by Supabase in the Mumbai, India region (AWS ap-south-1). Supabase runs on Amazon Web Services infrastructure. Supabase encrypts stored data at rest and all connections between the App and our services use encrypted HTTPS/TLS.
International transfers. We and our providers may process your data in countries other than your own. Your cloud data is stored in India, and some of our providers (such as Expo and Google) may process technical data in the United States. Where the GDPR or UK GDPR applies, transfers outside the EEA or UK are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing terms, or by another lawful transfer mechanism.
Legal requests. We may disclose data if we are required to do so by law, or where it is necessary to protect the rights, property or safety of users or others. We will only disclose what is legally required.
7. How long we keep data
| Data | How long |
|---|---|
| Data on your device | Until you delete it in the App, clear the App's storage, or uninstall the App |
| Synced records and profile | While your account exists. When you clear a mark, a record that it was cleared (the date and namaaz, not the old mark) is kept so your other devices remove it too. |
| Account data | Until you delete your account |
| After you delete your account | Removed from our live database immediately. Copies in our provider's routine backups are overwritten within 7 days. |
| Sign-in and security records | Up to 90 days |
| Sign-in code emails (in our sending mailbox) and emails you send us | Up to 90 days, except as below |
| Record that we completed a deletion or other rights request (your email address, the request and the date) | Up to 12 months, to show that we completed it |
We do not currently delete inactive accounts automatically. If that changes, we will update this policy first.
8. Security
We protect your data with measures that include:
- encryption in transit (HTTPS/TLS) for every connection the App makes;
- encryption at rest in our database;
- database rules (row-level security) on every table, so one account can never read or change another account's records;
- server-side account deletion, so the privileged key needed to delete an account never leaves our server;
- no passwords to leak: sign-in is by Google, Apple or a one-time email code.
No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.
Your device. Data on your device is protected by your phone's own security. Your phone's system backup (for example Android backup to your Google account, or iCloud backup) may include the App's data, under your own settings and your backup provider's terms; we cannot access those backups.
Exported files. The "Export data" feature creates a file containing everything the App holds about you, including Uzur (health) data and your home location. The file is not encrypted. Once you save or share it, it is under your control, so please keep it safe.
9. Using Adaa without an account (guest use)
You can use Adaa without signing in. In that case:
- everything you record is stored only on your device;
- nothing you record is sent to us, and we have no copy;
- we cannot recover your data if you lose your device, clear the App's storage or uninstall the App;
- to delete your data, clear the App's storage or uninstall the App.
The only network requests the App makes without an account are the city search and update checks described in section 3.4, and the phone's geocoding service described in section 3.3.
10. Device permissions
| Permission | Why | If you say no |
|---|---|---|
| Location (precise and approximate, only while the App is in use) | Namaaz times for where you are and the Qibla compass | The App uses your saved home location or a location you set by hand. You can also set home by searching for a city. |
| Notifications | Namaaz reminders, and the Prayed or Missed buttons on them | You receive no reminders; everything else works |
The App never requests background location. You can change either permission at any time in your device settings.
11. Children
Adaa is intended for people aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are under the age at which you can consent to data processing in your country (in some EEA countries this is 16), please ask a parent or guardian before creating an account.
If you believe a child under 13 has created an account, contact us and we will delete it.
12. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to certain processing;
- data portability: receive your data in a machine-readable format;
- withdraw consent at any time, where processing is based on consent;
- not be discriminated against for exercising your rights;
- complain to a data protection authority, such as your local supervisory authority in the EEA, the UK Information Commissioner's Office (ico.org.uk), or the authority in your country.
Many of these you can do yourself in the App:
| Right | In the App |
|---|---|
| Access and portability | Profile, then Export data (a JSON file with your profile, prayer record, Qasr and Uzur records) |
| Correction | Profile, then edit your details; change any mark on the calendar |
| Deletion | Profile, then Delete account; or clear individual prayer marks and Qasr days, and delete Uzur periods |
| Withdraw consent / stop syncing | Profile, then Sign out (removes the account's data from that device) |
For anything else, email adaa.official.app@gmail.com from the email address of your account. We may need to confirm that the request comes from you before acting on it. We respond within 30 days (one month under the GDPR), and will tell you if we need longer as the law allows. There is no charge.
US state privacy rights (including California). We do not sell or "share" personal information (as those terms are defined in the California Consumer Privacy Act, as amended by the CPRA), and we have not done so in the past 12 months. We use sensitive personal information only to provide the App's features you request, so no "limit the use" request is needed. The categories of personal information we collect are described in section 3, their sources (you, your device, and your sign-in provider) and purposes in sections 3 and 5, and the categories of service providers we disclose them to in section 6. You may use an authorised agent to make a request; we may ask for proof of the authorisation.
India. Where the Digital Personal Data Protection Act, 2023 applies, we act as the Data Fiduciary and process your personal data on the basis of your consent, which you may withdraw at any time as described above. You may ask us for a summary of your personal data and how it is processed, and ask us to correct, complete, update or erase it. You may also nominate another person to exercise your rights if you die or become unable to act. Grievances can be sent to our grievance contact, Abbas Murtaza Badri, at adaa.official.app@gmail.com; we will respond within the time the law requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
13. Deleting your account and data
In the App: open Adaa, tap your profile button (your initials) at the top right of the Home screen, scroll to your account section and tap Delete account, then confirm. This immediately and permanently deletes your account and every record synced to it, and wipes the App's data from that device.
Without the App: email adaa.official.app@gmail.com from your account's email address with the subject "Delete my account". We will complete the deletion within 30 days and confirm by email.
Full details, including exactly what is deleted and what is kept, are on the account deletion page: https://ambadri.github.io/adaa-privacy/delete-account/
14. Changes to this policy
We may update this policy when the App or the law changes. We will change the effective date at the top, and for material changes we will give notice in the App or in the App's release notes before the change takes effect. Where the law requires your consent to a change, we will ask for it.
15. Contact
Questions, requests or complaints about privacy:
- Controller and grievance contact: Abbas Murtaza Badri, India
- Email: adaa.official.app@gmail.com