Privacy policy
Amaal ZA is a free app for South Africa. It shows masjids, their salaah times and their public notices to anyone, without an account. People who have been registered by their masjid can also sign in to use the tools their masjid runs for its members.
This page explains what information the app uses, why, who can see it, and what you can do about it. It follows the Protection of Personal Information Act (POPIA).
Amaal ZA is run by Ahmed Sami Shaik, an individual developer in South Africa, who is the responsible party for the information described here.
Questions or requests: privacy@amaalza.com
If you use the app without an account
We do not ask who you are, and we keep no record of you.
- Masjids and salaah times. The directory is public. The list is saved on your phone so it opens without signal.
- Your location. If you tap Near me, the app asks your phone for your location to sort the list by distance. Your location is used on your phone only. It is never sent to us or to anyone else.
- Your chosen masjid and saved masjids. These are kept on your phone only.
- Salaah reminders. These are set by your phone itself. Nothing is sent to us.
- Hearing when a masjid's times change. If you turn this on, your phone joins that masjid's channel at Google's notification service (Firebase Cloud Messaging) directly. Google gives your phone an address for this. We keep no record of your phone and cannot tell who is on a channel.
- Searching on Google Maps or opening directions. This opens Google Maps or your maps app with what you typed or the masjid's place. What those apps do is covered by their own policies.
If you have an account
Accounts are by invitation only. A person responsible at your masjid registers you, and you activate the account yourself with a code. When you activate, the app asks for your consent and records the date.
What we keep
- Your name and mobile number.
- Your email address, only if you add one, so you can reset your password yourself.
- Your role and the masjid you belong to.
- The records entered about your participation in your masjid's programmes, such as attendance, by you or by the person responsible for you.
- For each phone on which you turn notifications on: an address from Google's notification service, the masjid it follows, and your notification settings.
- When you gave consent, and a history of changes to your account, such as when it was registered or a role was given.
These records show religious practice. POPIA treats that as special personal information, which is why we ask for your explicit consent and limit who can see it.
Why we keep it
Only to run the programmes of your masjid: to know who its members are, to keep its registers, and to tell you about notices and changes. We do not use it for advertising, we do not sell or share it for marketing, and the app has no adverts, payments or public profiles.
Who can see it
- You.
- The people responsible for you at your masjid, and those responsible for the area it belongs to.
- Nobody else. Your records are never shown in public, and people at other areas cannot see them. The person who looks after the app as a whole sees totals only, not individual records.
There are no rankings of individual people.
Notifications
A notification on your lock screen says only what kind it is, for example "New notice". The detail is fetched inside the app after you unlock it.
Information saved on your phone
So the app works without signal, some of what you may see is saved on your phone in an encrypted store. It is erased when you sign out, and when another person signs in on the same phone.
Who helps us run the app
We use these services. Each receives only what it needs for its task.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Stores the app's data and handles sign-in. The data is kept in London, United Kingdom. | Everything listed under "What we keep" |
| Google Firebase Cloud Messaging and Apple's push service | Deliver notifications to your phone | Your phone's notification address and a short generic message with reference numbers, never your records |
| Google Maps | Shows the map | The area of the map you look at. Not your location. |
| Sentry | Reports when the app crashes, so we can fix it. Kept in the European Union. | Technical details of the crash, with personal information removed |
| Resend | Sends the email with your code when you add an email address or reset your password | Your email address and the code |
| Google Play and the Apple App Store | Deliver the app to your phone | What their own policies describe |
App updates are delivered from our own server, which keeps no record of your phone.
Because the data is stored in the United Kingdom, your information is kept outside South Africa. The United Kingdom has its own data protection law, and the services above are bound by contract to protect the information they handle for us.
How long we keep it
For as long as you have an account. When you delete your account, your name, mobile number, email address, roles, consent and your own records are deleted. Registers that included you keep their other people, so a session you attended counts one person fewer. A note that an account was deleted is kept, without your name or number. Routine backups are overwritten within 30 days.
Your choices and rights
- See your information. In the app: My account, then My data. You can share a copy from there.
- Correct it. Change your name or email address under My account, or ask the person responsible at your masjid.
- Delete it. In the app: My account, then Delete my account. If you cannot use the app, see the account deletion page at https://amaalza.com/delete-account or write to privacy@amaalza.com.
- Withdraw consent. Deleting your account withdraws it.
- Turn off notifications. In the app under My account, Notifications, or in your phone's settings.
We answer requests within 30 days.
You may also complain to the Information Regulator of South Africa: https://inforegulator.org.za
Children
Accounts are for people of 18 and older. The person who registers a member confirms this. The public part of the app collects no information from anyone.
Security
Information travels encrypted between your phone and the servers. Access to records is enforced by rules in the database itself, so a person can only read what their role allows. Sign-in screens do not reveal whether a mobile number has an account.
Changes to this policy
If this policy changes in a way that affects how your information is used, the app asks for your consent again. The date at the top shows when it last changed.