Privacy Policy

We collect information you provide directly when creating an account and using our services:

• Account Information: Full name, email address, phone number, gender, date of birth, city, and residential address.
• Profile Photo: A photograph of yourself (required for the male users only, while it's not asked for the female users). This photo is visible only to your assigned Murabbi (spiritual guide) and system administrators.
• Authentication Credentials: Encrypted password and phone/email verification data managed through Supabase Auth.
• Daily Log Entries: Your daily mamulat (religious practice) records including completions, timings, and personal notes that you choose to log.
• Plan & Category Data: Custom categories and tasks you create for your personal spiritual plan.

Your information is used to provide, maintain, and improve our spiritual tracking services:

• Service Provision: To enable your account, authenticate you, and allow you to log and track daily mamulat.
• Murabbi Guidance: To share your profile, progress data, and logged entries with your assigned Murabbi, so they may provide spiritual guidance and review.
• Administration: To allow approved system administrators to manage accounts, assign Murabbis, import user data, generate aggregate reports, and ensure the system runs correctly.
• Communication: To send verification codes, password recovery links, daily reminders, assignment notifications, and important service announcements via email, SMS, or push notifications (depending on your settings and contact methods).
• Analytics & Improvement: To generate de-identified, aggregate statistics about mamulat completion across cities and majalis for organizational planning and improvement. These reports do not include personally identifiable information when shared outside the admin team.
• Security: To protect against fraud, abuse, and unauthorized access.

We treat your personal and spiritual data with sanctity. We do not sell your personal information. We only share it in the following limited circumstances:

• With Your Assigned Murabbi: Your profile photo, name, contact details, logged mamulat, salik notes, and progress data are visible to the Murabbi specifically assigned to guide you.
• With System Administrators: Authorized admins may access your data for account management, troubleshooting, and report generation as part of their official duties.
• Service Providers: We use trusted third-party vendors (Supabase for database and auth, OneSignal for push notifications, email/SMS gateways) who process data on our behalf under strict contractual obligations and only as instructed by us.
• Legal Requirements: We may disclose information if required by a valid legal process, governmental request, or to protect our rights, users, or the public.

Your data is stored securely on Supabase's managed infrastructure (backed by PostgreSQL with row-level security enabled):

• Encryption: All data is encrypted in transit using TLS 1.2+. Sensitive authentication credentials are handled by Supabase Auth with industry-standard hashing.
• Row-Level Security (RLS): Database policies enforce that users can only read and write their own data, unless they have been granted an admin or murabbi role.
• Access Controls: Role-based access control (Admin, Murabbi, User) is enforced both in the application and at the database layer.
• Accountability: Server-side checks gate sensitive views like print profile reports, ensuring no unauthorized access occurs even if the UI is bypassed.

If you enable push notifications, we use OneSignal to deliver daily log reminders, murabbi assignment updates, and other service-related notifications. OneSignal may receive your device token, IP address, and engagement data (such as whether a notification was opened). You can disable notifications at any time from your browser or mobile device settings, or from the Profile page within the app.

Depending on your jurisdiction, you may have the following rights:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may update your name, phone, email, and photo directly from the Profile page within the app.
• Password Management: You may change your password or initiate a password reset at any time.
• Deletion: You may request permanent deletion of your account and associated data at any time. Submit a deletion request by email or phone via the official public form at /delete-account. This URL is also the official Account Deletion Request URL listed in our Google Play Store listing. Our admin team will verify your identity and process the deletion within 7 business days. All deletion requests are recorded in an auditable log; we retain a minimal de-identified metadata record for legal record-keeping obligations only.
• Withdraw Consent: You may withdraw consent to non-essential processing by contacting us. Note that essential processing required for the contract (your account use) cannot be withdrawn without closing the account.
• Data Portability: Contact us to request your data in a machine-readable format.

Iṣlāḥi Mamūlāt is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

Your data is stored on Supabase servers, which may be located outside the country where you reside (including in the United States or other jurisdictions). By using the service, you consent to the transfer and processing of your data in these jurisdictions, which may have different data protection laws than your home country.

We retain your personal data for as long as your account is active or as needed to provide you with services. After account closure, we may retain some data for a limited period as required by law, for accounting purposes, or to resolve disputes, after which it is securely deleted or anonymized. Daily log entries and progress history may be retained in aggregate, de-identified form indefinitely for organizational analytics.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. Material changes will be communicated via in-app notice or email at least 30 days before they take effect. Your continued use of the service after the effective date of the revised policy constitutes acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your data, please contact the Majlis-e-Iṣlāḥ administration through your assigned Murabbi or by reaching out to the admin team via the official communication channels of Majlis-e-Iṣlāḥ · Al-Burhān.

Organization: MAJLIS-E-IṢLĀḤ · AL-BURHĀN
Last Updated: August 26, 2026