🕌 Salah Time

Salah Time ("we", "our", or "us"), developed by Salah Time Corp, is committed to protecting your privacy. This Privacy Policy describes how we collect, use, and safeguard your personal information when you use the Salah Time mobile application ("the App"). We have designed this application with a security-first architecture aligned with industry best practices.

1. Information We Collect

We collect only the minimum data necessary to provide our services:

• Email address — used for account authentication via one-time password (OTP) and subscription management.
• Device location (foreground only) — used in real-time to calculate accurate prayer times and Qibla direction. Location is never stored, transmitted to our servers, or accessed in the background.
• Subscription status — plan type (monthly, annual, or permanent) and Stripe customer ID, stored to validate your access.
• Installed application list — read on-device only to allow you to select apps to block during prayer time. This list is never transmitted to our servers or any third party.

2. Authentication — OTP Workflow

Salah Time uses a passwordless, email-based One-Time Password (OTP) authentication system. When you sign in or verify your account, a cryptographically generated 6-digit code is dispatched to your email address via TLS-encrypted SMTP. Each OTP:

• Expires after 5 minutes (short-lived token design)
• Is invalidated immediately upon successful use (single-use token)
• Is rate-limited to prevent brute-force enumeration attacks
• Allows a maximum of 5 verification attempts before invalidation

OTP codes are stored transiently in server-side memory only and are never persisted to the database.

3. How We Use Your Information

• To send you authentication codes and manage your session
• To calculate and display accurate prayer times for your location
• To display the Qibla compass direction using your real-time bearing
• To enforce your subscription plan and manage billing through Stripe
• To provide the app-blocking feature during active prayer times (on-device only)

4. Backend Security Architecture

Our server-side infrastructure is designed with defence-in-depth principles. Our backend API is deployed on Railway, a secure cloud platform with automatic TLS/SSL certificate provisioning, ensuring all data in transit between the App and our servers is encrypted using TLS 1.2 or higher (HTTPS). No cleartext HTTP communication is used in production.

• Transport security: All API endpoints are served exclusively over HTTPS with valid TLS certificates.
• Secret management: All API credentials (Stripe keys, database credentials, SMTP passwords) are stored as encrypted environment variables on the server and are never embedded in the application binary or source code.
• No keys in the app: The App never holds your Stripe secret key or any server-side credential. Only the Stripe publishable key (safe to be public by design) is retrieved at runtime from our API.

5. Database Security — Row-Level Security (RLS)

User data is stored in Supabase, a PostgreSQL-based cloud database. We implement Row-Level Security (RLS) policies at the database layer to enforce strict data isolation. RLS ensures that even if an API endpoint were misconfigured, a user's record could never be read or modified by any other user — access control is enforced at the database engine level, not just the application layer.

All database operations from our backend use a service role key with scoped permissions, stored exclusively as a server-side environment variable and never exposed to clients.

6. One Device Policy

Salah Time enforces a session-based, single active device policy per account. Your subscription is validated server-side on each app launch. This prevents unauthorised account sharing while ensuring your data remains associated exclusively with your verified email identity.

7. Payment Security

All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor — the highest level of payment security certification. We never process, store, or transmit raw credit or debit card numbers. Salah Time's servers only receive and store Stripe-issued customer and subscription identifiers (e.g. cus_xxx, sub_xxx).

Stripe webhooks — used to sync subscription lifecycle events — are verified server-side using HMAC-SHA256 signature validation before any action is taken, preventing webhook spoofing attacks.

8. Device Permissions

• Location (foreground only): Used to calculate prayer times and Qibla direction. Never accessed in the background. You may deny this permission; manual location entry is available.
• Query installed packages: Used on-device only to let you choose which apps to block during prayer. This data never leaves your device.
• Accessibility Service: Used solely to detect the active foreground app and display the prayer-focus overlay during prayer windows. It is never used to read screen content, capture keystrokes, or collect any personal data.

9. Data Retention & Deletion

Your account data (email and subscription status) is retained for as long as you hold an active subscription. Upon cancellation, your data is retained for a reasonable period for billing dispute resolution, after which it is purged. To request immediate deletion of your data, contact us at the email below.

10. Children's Privacy

Salah Time is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe your child has provided us with personal data, please contact us immediately and we will delete it.

11. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Withdraw consent for data processing where applicable

To exercise any of these rights, contact us at salahtimesupport@gmail.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the App or email. Continued use of the App after changes constitutes acceptance of the revised policy. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Salah Time Corp
Email: salahtimesupport@gmail.com