Last updated: 2026-10-18. Applies to all users worldwide.
1. Controller
The data controller for personal data processed by this service is Afam Muslim. Contact: info@afammuslim.com.
2. What we process
Anonymous user token: a random, signed cookie named __Host-muid issued on your first visit to a page. It is the only cookie we set. It is used to keep your favorites, settings and recent locations apart from those of other visitors and is not linked to your name, e-mail address or any other personal identifier. We use no analytics, advertising or tracking cookies.
Approximate geolocation (latitude / longitude): provided by your device only after you allow it in the browser, or entered manually. Used to compute prayer times.
Settings: theme, language, calculation parameters (twilight angles, which Asr and Isha time is shown, the Maghrib angle) and similar preferences, stored with your anonymous token.
Introduction answers: your answers in the first-visit introduction about tradition, school of law and the mosque you follow are stored only in your browser (local storage). They are not sent to our server and you can delete them under Settings, My profile. The calculation parameters derived from them are part of your settings above, so your times stay correct if the browser storage is cleared.
Recent location history: the last 50 lat/lon lookups associated with your anonymous token.
Audit log: hashed (non-reversible) identifiers of write actions, used to detect abuse.
Server logs: each request is logged with method, path, status code and duration. Your IP address and your token are stored in these logs only as keyed hashes that cannot be reversed; the raw IP address is used in memory for rate limiting and is not written to disk.
3. Legal basis (GDPR Article 6)
Consent (Article 6(1)(a)) for the optional device geolocation, which the browser asks you for.
Legitimate interest (Article 6(1)(f)) for delivering the requested prayer-time computation, keeping your settings and protecting the service against abuse. The anonymous cookie is strictly necessary for these functions.
4. Recipients
We do not sell or share your data. Fonts, map library, flag images and all other assets are delivered from our own server, so no third party receives request data when you simply open the site. The following providers receive data only when you actively use the related feature:
OpenStreetMap Nominatim (OpenStreetMap Foundation): your browser sends the search text when you use the location search bar.
OpenStreetMap tile servers (OpenStreetMap Foundation): your browser requests map tiles for the area shown on the mosque map.
timeapi.io: when your timezone is auto-detected, our server forwards the coordinates to this service. Your IP address is not sent; the request comes from our server.
Amazon Web Services (AWS): hosting provider of our server (Amazon Lightsail, Singapore region). AWS processes network traffic on our behalf under its data processing addendum.
Each provider applies its own privacy policy.
5. Retention
Anonymous cookie: 2 years or until you clear browser storage.
Settings and favorites: until you delete them or invoke the erasure right below.
Location history: capped at 50 entries; older entries are deleted automatically.
Audit log: 180 days, then pruned.
Server logs (hashed identifiers only): at most 30 days.
Backups of the database: 14 days, stored on the same server, then deleted.
6. Your rights
Under GDPR Articles 15 to 22 you may request access, rectification, erasure, restriction, portability, or object to processing. For California users, equivalent rights apply under CCPA. Email info@afammuslim.com to exercise these rights, or use the self-service delete button below. Because we hold no name or contact details, requests by e-mail can only be matched to data if you tell us the anonymous token shown in your browser's cookie storage.
Self-service erasure
Click below to permanently delete all data associated with your current anonymous token on this device. This cannot be undone.
7. International transfers
The service is hosted on Amazon Web Services in the Singapore region. For users in the European Union and the European Economic Area this means a transfer outside the EEA; it is covered by the standard contractual clauses contained in the AWS data processing addendum. The providers listed in section 4 may process data in other regions under their own safeguards.
8. Security
All traffic is encrypted with TLS 1.3. The server sets strict security headers, keeps no plain-text IP addresses on disk and runs with minimal system privileges. The cookie is marked HttpOnly and Secure and is only sent to this site.
9. Children
The service is not directed at children under 13. We do not knowingly collect data from children.
10. Changes
We may update this policy. The "Last updated" date at the top will change accordingly.
11. Contact and supervisory authority
For privacy concerns: info@afammuslim.com. EU users may also lodge a complaint with their national data protection authority.