How we handle your data

Short version

• We don't log your IP address.
• We don't sell data. We don't share data with advertisers.
• We don't call external tracking services.
• Prayer times are computed on our server from astronomical formulas — we never ship your location to a third party.

What we collect and why

Network request logs

Our server logs are structured for debugging: request path, status code, response time. IP addresses are redacted before logs are written — we keep enough to rate-limit an anonymous abuser (a truncated hash) but never the raw value.

Browser timezone and CDN-reported location

The homepage auto-detects your city using one of three signals: a cookie from your previous visit, CDN-level geo headers (Cloudflare's CF-IPCountry, etc.), or your browser's IANA timezone (Intl.DateTimeFormat().resolvedOptions().timeZone). None of these values are persisted. They're used only for the page render and discarded.

Your city preference (cookie)

If you click "Use my location" or pick a city from search, we store the city slug (e.g. united-kingdom/london/london) in a cookie named esalah_loc. The cookie lives for 1 year, uses SameSite=Lax, and contains no personal identifiers. You can clear it via the homepage's "Reset saved location" link or your browser settings.

Account data (if you sign in)

Signing in is optional and uses magic-link email — we don't store passwords. When you sign in we keep your email address, any reviews or claims you submit, and (if you opt in) your push-notification subscription. You can delete your account anytime from your profile: personal fields are anonymized, sessions are invalidated, and your content becomes anonymous.

Push notifications

If you enable adhan reminders, we store the browser-issued push endpoint and encryption keys. We never send marketing pushes — only the prayer reminders you've explicitly enabled. Disable anytime from your profile.

What we do NOT do

• No third-party analytics (no Google Analytics, no Segment, no pixels).
• No runtime calls to external prayer-time APIs. All times are computed locally.
• No scraping of Google Places or other platforms for mosque data. Our directory is community-sourced.
• No cross-site tracking. Cookies are first-party and lean.
• No ad networks. Ever.

Contact

Privacy questions: get in touch.