Privacy Policy

Who we are

Mizan is published by Wassim Kanze, a self-employed developer established in Belgium (company number BE 1036.343.347), the controller of your data. Contact for any question about your data: contact@wassimkanze.dev.

1. Data we process

• Account: email address and sign-in identifier, created when you sign up with email and password, Apple or Google. Your password is handled by Google Firebase Authentication: we never have access to it.
• Profile: first name, last name, optional display name, friend code (derived from your identifier), account creation date.
• Profile photo (optional): the photo you choose, re-encoded without its metadata (including GPS position) and stored on Firebase Storage; if you sign up with Google, your Google account photo is used by default.
• Prayers: the prayers you mark as completed, day by day. They reveal a religious practice: we treat them as sensitive data.
• Social features: your friends, friend requests, reminders you send, shared streaks, the people you block and the reports you make (reason chosen from a list).
• Supporter status: whether you have an active supporter subscription. Payments (tips and subscription) are processed by Google Play or the App Store: we never receive your payment data.
• Technical identifiers: your device’s notification token (Firebase Cloud Messaging) and, if you turn on discreet validations, a random installation identifier.
• Location (optional): your position, approximate or precise depending on the permission you grant, is used to compute prayer times and the Qibla direction. The Qibla direction is computed on your device. For prayer times, your coordinates are sent to the Aladhan service (api.aladhan.com) without any account identifier. If you choose a mosque, only its public identifier is sent to Mawaqit (mawaqit.net). Your location is never stored on our servers.
• Period tracking (optional): see point 6 below.
• On your device only: gender, preferences, Quran reading progress, dhikr, period history, the scanned QR code image (decoded on the device). This data is not sent to our servers and is excluded from Android backups.

2. Why, and on what basis

• To provide the service you ask for (account, prayer times, tracking, social features, notifications, supporter status): performance of the contract (terms of use).
• Location, notifications, photo and discreet validations: your consent, given in the app or in your device settings. You withdraw it for location and notifications in your device settings, and for discreet validations by deleting your periods or your account (the app offers no other way). The photo stays on your profile until you replace it or delete your account.
• Sensitive data (religious practice, inference of periods): your explicit consent. It is used only to run the app.
• Security and abuse prevention (request rate limits, reports, blocks): our legitimate interest in protecting users and the service.
• We do no advertising, profiling or audience measurement: no analytics or advertising tool is built into the app.

3. Service providers and third parties

We do not sell or rent your data. It is only passed to:

• Google Firebase (Google): authentication, Cloud Firestore database, photo storage, server functions, notifications (Firebase Cloud Messaging). Google acts as our processor and automatically collects some technical data (IP address, app version, Firebase installation identifier).
• Google Play and the Apple App Store: payments, subscriptions and review prompts.
• Google and Apple: signing in with your Google or Apple account, when you choose it.
• Aladhan (api.aladhan.com), an independent third-party service: receives your coordinates to compute prayer times. It receives them without your name or account identifier, but with your device’s IP address, like any internet request. We do not control what Aladhan keeps.
• Mawaqit (mawaqit.net), an independent third-party service: receives the identifier of the mosque you choose.
• Apple Push Notification service (iPhone): delivers notifications.

4. What other users can see

• Any signed-in user who has your friend code (or QR code) can see your display name, profile photo and supporter badge, in order to send you a friend request.
• Your friends can also see your completed prayers, your progress and your shared streaks. Automatically validated days look like ordinary validations, with no reason shown.
• Your location, email address, reports, block list and period tracking data are never visible to other users.

5. Where your data is

Your data is hosted by Google Firebase in the United States: the Cloud Firestore database in the nam5 multi-region, server functions in the us-central1 region. These transfers outside the European Union rely on Google’s safeguards: the EU–U.S. Data Privacy Framework and the European Commission’s standard contractual clauses. Aladhan and Mawaqit are independent services whose hosting we do not control. All communications are encrypted (HTTPS). The database security rules limit every read to what point 4 allows.

6. Period tracking (optional)

Period tracking is only active for users who turn it on. Your period history stays on your device, separated per account, excluded from backups, and is never synced or shared with your friends.

• Discreet validations: only after your explicit consent in the app, the affected days and that day’s prayer times are sent to our server (Google Firebase) so your prayers can be validated automatically at their time, even when the app is closed.
• This information is treated as sensitive data. It is stored in an area only the server can access: neither your friends nor the app can read it. No reason or medical label is recorded.
• The affected days and their prayer times are kept on the server while the schedule is active, and the history of automatic validations for at most 30 days.
• Your friends only see validated prayers, like on any other day, with no indication of why.
• You can correct or delete a period at any time; the matching automatic validations are then cancelled. Deleting your account also deletes this data.

7. Retention

• Account, profile, prayers, friends, reports and notification identifiers: as long as your account exists. They are deleted as soon as you delete your account.
• Database backups: one a day, deleted automatically after 14 days. Deleted data may therefore remain in them for at most 14 days.
• Anti-abuse counters: deleted automatically, usually within 48 hours.
• Our host’s technical logs: at most 30 days.
• Deletion requests received by email: kept for 1 year as proof that they were handled.
• Data on your device: until you delete your account, uninstall the app or clear its data.

What may remain after you delete your account is detailed on the “Delete your account” page.

Delete your account →

8. Your rights

Under the GDPR, you may access your data, correct it (your name at any time in the app), ask for its portability, object to processing based on our legitimate interest, withdraw your consent (location and notifications in your device settings, discreet validations by deleting your periods) and delete your account:

• in the app: “Prayers” tab → Settings → “Delete my account”;
• without the app: see https://mizan-app.dev/delete-account.

For any other request, write to contact@wassimkanze.dev. You may also lodge a complaint with the Belgian Data Protection Authority or the authority of your country (for example the CNIL in France).

Delete your account →

9. Notifications

Notifications are optional and can be turned off in your device or app settings. Prayer reminders are scheduled on your device. Notifications from your friends (reminder, friend request) contain their name and go through Firebase Cloud Messaging (Android) or Apple Push Notification service (iPhone). Your notification token is registered when you sign in and removed when you sign out or delete your account.

10. Changes

We may change this policy. The update date appears at the top of the page.

11. Contact

For any question about this policy, write to us at contact@wassimkanze.dev.