Privacy Policy
Last updated: 13 September 2026
MasjidConnect is committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
MasjidConnect (“MasjidConnect”, “we”, “our”, “us”) is operated by Tahmid Hoque as a sole trader based in England and Wales. We are the Data Controller in respect of personal data collected through our website and platform. This includes our marketing website, admin portal, and the MasjidConnect Community app for iOS and Android.
We are in the process of registering with the Information Commissioner's Office (ICO).
For any privacy-related queries, please contact us at support@masjidconnect.co.uk.
2. Data We Collect
We collect the following categories of personal data when you use MasjidConnect:
Account Data
- Full name of the account registrant;
- Email address; and
- Password (stored as an irreversible cryptographic hash. We never store your plaintext password).
Masjid Data
- Masjid name and address;
- Prayer times and Jamaat schedules;
- Announcements and event information; and
- Any images or files uploaded to the platform.
Display Screen Data
- Screen identifiers (device IDs) generated during pairing;
- Connection status and last-seen timestamps; and
- Device metadata (e.g. browser user agent of the display device).
Payment Data
- Billing name and email address (used to identify your purchase);
- Records of your software licence, installation, hardware, and annual services, and billing history (for your records and HMRC compliance).
- Where your Masjid receives donations via Stripe Connect: donor email, donation amount, campaign, and transaction records (stored for your Masjid's records; payment card details are held exclusively by Stripe).
We do not store payment card details. Subscription card information is held exclusively by Paddle.com, Inc., our Merchant of Record. Donation card details are held exclusively by Stripe when Masjids use Stripe Connect to receive donations.
Enquiry & Installation Data
- Contact details (name, email, phone) and your masjid's address when you contact us or request an installation;
- A postcode you enter into the install-area checker, used to estimate travel for an installation. This is sent to a postcode lookup service to calculate distance (see Data Sharing).
Technical Data
- IP address;
- Browser type and version;
- Session authentication tokens (via essential cookies only); and
- Server access logs (retained for 30 days on a rolling basis).
Community App Data (iOS and Android)
When you use the MasjidConnect Community app, we may process:
- Account data (if signed in): name, email, authentication credentials (JWT in device secure store), as Account Data above. Signed-in features may sync preferences, prayer logs, donation history, and similar account-linked data with our servers.
- Guest / mosque preference data: selected mosque (including without an account) for correct prayer times, announcements, related content. Mosque selection retained across logout.
- Optional guest contact details: name, email, and/or phone entered for convenience (e.g. RSVP or Ask Imam autofill), may be stored locally on device until cleared or signed in.
- App device identifier: random app-generated device ID stored on device and sent as X-Device-ID on API requests for rate limiting and guest association. Not a hardware advertising identifier (no IDFA or AAID).
- Push notification tokens: Expo push token, platform (iOS/Android), device model and device name strings, selected mosque identifier, registered with our backend. Guest tokens mosque-scoped; signed-in tokens account-scoped and unregistered on logout where practicable.
- Notification preferences: prayer reminders, announcements, event reminders, imam answers, emergency alerts (on device; synced when signed in).
- Location (optional): if granted, used to calculate prayer times and Qibla direction. Not used for advertising.
- Motion sensors (optional): if granted, used on-device for Qibla compass.
- Calendar (optional): if granted, may add masjid/Islamic events the user chooses to device calendar.
We do not currently ship third-party advertising or product-analytics SDKs in the Community app; we do not collect payment card details in the app. Third-party content services (e.g. Quran text from Quran.com; realtime updates over our Socket.io service for admin-connected features) are for content/service delivery, not advertising analytics.
3. How We Use Your Data
We use the personal data we collect to:
- Create and manage your Account and provide you with access to the Service;
- Process your purchases and communicate billing information: software licences are handled through Paddle, while installation, hardware, and annual services are invoiced by us;
- Respond to enquiries and arrange and carry out installations you request;
- Send transactional emails, including account confirmation, password resets, subscription invoices, and important service updates;
- Monitor and ensure the security of the platform, detect fraud, and prevent misuse;
- Improve the platform using aggregated and anonymised usage data. We do not use individual user data for analytics;
- Deliver local and remote notifications allowed by the user, including prayer-time reminders, masjid announcements, event reminders, imam answers where available, and emergency alerts;
- Operate the Community app for guests and signed-in users, including mosque selection and content relevant to that mosque;
- Open the chosen masjid's donation or campaign page in the device browser when the user chooses to give — card payments on that page processed by Stripe as under Payment Data, not by a native card form or Apple In-App Purchase inside the app; and
- Comply with our legal obligations, including HMRC record-keeping requirements.
We do not use your personal data for advertising or marketing to third parties. We do not sell your data.
4. Lawful Basis for Processing
Under UK GDPR, we must have a lawful basis for each type of processing we carry out. Our lawful bases are:
- Contract performance (Article 6(1)(b)): Processing your Account data, Masjid data, and screen data is necessary to provide the Service you have signed up for. This also covers delivering the Community app service, security, and rate limiting.
- Legitimate interests (Article 6(1)(f)): We process technical data and server logs to maintain security and improve the platform. Our legitimate interests do not override your rights.
- Legal obligation (Article 6(1)(c)): We retain payment and invoicing records for 7 years as required by HMRC regulations.
- Consent (Article 6(1)(a)): Where device OS permission is required (notifications, location, motion, calendar).
We do not rely on consent as a lawful basis for routine processing. Where we do seek consent (for example, for optional marketing communications), we will make this clear at the time and you may withdraw consent at any time.
5. Push Notifications
With permission, the Community app may send:
- Local notifications scheduled on device (prayer times: minutes before Adhan, at Adhan, at Jamaat where available); and
- Remote push via APNs (iOS) and FCM (Android), delivered using Expo's push infrastructure. Note that on Android, remote tokens require Firebase/google-services configuration in the build; local notifications can still work without it.
Remote notification categories (subject to preferences): announcements, event reminders, imam Q&A answers, emergency alerts.
You can change preferences in-app and/or disable notifications in device settings; you may withdraw permission at any time. On sign-out we unregister your push token where practicable.
6. Data Sharing
We share personal data with the following third-party service providers who act as data processors on our behalf:
- Paddle.com, Inc.. Payment processing and Merchant of Record. Paddle receives billing name, email, and subscription information to process payments and issue invoices. Paddle's own privacy policy applies to data they hold.
- Stripe, Inc.. Payment processing for donations received by Masjids through the platform. When Masjids connect a Stripe account to receive donations, Stripe processes account and identity information. When community members make donations through your masjid, Stripe processes payment card details and related transaction data. Stripe receives this personal data and processes it in accordance with Stripe's Privacy Policy.
- Vercel, Inc.. Hosting of the MasjidConnect website and admin portal on Vercel's edge network.
- Neon, Inc.. PostgreSQL database hosting for all platform data.
- Amazon Web Services (AWS). Cloud storage (S3) for files and images uploaded to the platform.
- Postcodes.io (Ideal Postcodes, UK). When you use the install-area checker, the postcode you enter is sent to this UK postcode lookup service to estimate distance for installation. No other personal data is shared, and the lookup runs only when you choose to use it.
- Expo (Expo Application Services). Delivery of push notification tokens and messages to APNs/FCM for the Community app.
- Apple / Google. Delivery of push notifications on iOS and Android respectively.
We do not sell personal data to any third party. We do not share personal data with third parties for their own marketing purposes.
We may disclose data where required to do so by law, by a court order, or by a regulatory authority.
7. International Data Transfers
Vercel, Neon, Amazon Web Services, and Stripe are US-based companies. Where your data is processed outside of the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR Article 46.
Specifically, data transfers to the US are governed by Standard Contractual Clauses (SCCs) approved for use under UK data protection law. Paddle and Stripe maintain their own Data Processing Agreements and transfer mechanisms covering payments data.
You may request a copy of the applicable Standard Contractual Clauses by emailing support@masjidconnect.co.uk.
8. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
- Active accounts: Data is retained for the duration of your Account.
- Cancelled accounts: Data is retained for 90 days following cancellation to allow you to export your data, after which it is permanently deleted (subject to the exceptions below).
- Payment and invoice records: Retained for 7 years in compliance with HMRC legal obligations.
- Server access logs: Retained on a rolling 30-day basis.
- Community member data: Any data you have entered about your community members (as Data Controller) is deleted within 90 days of your Account closure.
9. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access: You can request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification: You can ask us to correct inaccurate or incomplete data.
- Right to erasure: You can ask us to delete your personal data where there is no compelling reason for us to continue holding it (“right to be forgotten”).
- Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
- Right to data portability: You can request your data in a structured, machine-readable format.
- Right to object: You can object to processing based on legitimate interests.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email support@masjidconnect.co.uk. We will respond within 30 days. We may ask you to verify your identity before processing your request.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully. You can reach the ICO at ico.org.uk or on 0303 123 1113.
11. Data Security
We take the security of your data seriously and implement industry-standard technical and organisational measures, including:
- Encryption of all data in transit using TLS 1.2 or higher;
- Encryption of data at rest;
- Role-based access controls to ensure only authorised personnel can access sensitive data;
- Regular security reviews of our infrastructure and codebase;
- No storage of payment card details. All card credentials are held exclusively by Paddle; and
- Confidentiality obligations for all staff and contractors with access to personal data.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
12. MasjidConnect as Data Processor
When you use MasjidConnect features that involve storing data about members of your community: such as names, email addresses, donation records, or event attendance. The following roles apply:
- Your Masjid is the Data Controller. You determine the purposes and means of processing your community's data and are responsible for ensuring you have a lawful basis for collecting and using it.
- MasjidConnect is the Data Processor. We process that community data solely on your instructions, for the purpose of providing the Service.
By using these features, you confirm that:
- You have informed your community members about how their data will be used;
- You have obtained any necessary consents or have another lawful basis for processing; and
- You have a privacy notice in place for your Masjid's own data processing activities.
13. Children's Data
The MasjidConnect platform is designed for and directed at adult administrators of Islamic organisations. We do not knowingly collect personal data from individuals under the age of 16.
If you believe we have inadvertently collected data from a child under 16, please contact us at support@masjidconnect.co.uk and we will promptly delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law.
Where changes are material, we will notify you via email and/or a banner notification in your admin dashboard, with at least 30 days' notice before the changes take effect. Continued use of the Service after that date constitutes acceptance of the updated policy.
The date at the top of this page shows when the policy was last updated.
15. Contact & Complaints
For any questions about this Privacy Policy, to exercise your rights, or to raise a concern, please contact us:
- Email: support@masjidconnect.co.uk
- Trading as: MasjidConnect
- Operator: Tahmid Hoque (sole trader)
- Business address: 74 Holliers Crescent, Oxford, OX7 7HN
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF