Privacy Policy
This is the same text shown inside the app.
This policy explains what data the SORASAF app, provided by SORASAF, collects. It explains why the data is collected, where it goes and how long it is kept, in line with Malaysia's Personal Data Protection Act 2010. In short, your settings and location stay on your phone. Our server keeps only what your account needs. There are no analytics, no advertising, and your data is not sold.
1. Data that stays on your phone
Your prayer settings, meaning the source, zone and adjustments, are stored on your device only. So are your language and display choices, your last location, saved du'a, Quran reading position and settings, notification preferences, and downloaded audio and khutbah files. None of these are sent to the SORASAF server. Uninstalling the app removes them all.
Prayer-time notifications are scheduled on your phone itself. There is no push-notification server.
2. Account data on the SORASAF server
For your account, we store your name, your email address and its verification status. If you set a password, it is stored as a hash (bcrypt), never as plain text. If you sign in with Google, we store your Google account identifier (sub), your Google email and your profile-picture link. If you sign in with Apple, we store your Apple ID identifier, the email Apple shares (which may be a private relay address), and a token from Apple kept encrypted, so that deleting your account also revokes SORASAF's access at Apple.
We also keep the list of devices signed in, meaning the platform, app version, device name if given, and when each was last seen. Sign-in tokens and verification codes are stored only as hashes, and codes expire within minutes. We record the number of failed sign-in attempts and any temporary lock that results.
The purpose is to let you sign in, to protect the account from abuse, and to let you manage or delete it. The basis for processing is our agreement to provide the account, and our legitimate interest in security.
3. Technical data
When the app contacts our server, the server log records your IP address, the request path, the app version and platform, the language, and the time. This is for security and rate limiting. Logs are kept for 14 days.
The app also asks our server for the minimum supported version and, when you request it, the latest zakat rates. These requests carry no personal data beyond what is described above.
4. Third-party services that receive data
For prayer times, JAKIM e-Solat receives your zone code, not your coordinates. AlAdhan receives your coordinates. Only the source you choose is contacted.
When you allow location, your coordinates are sent to a third-party map service to obtain the place name and the list of nearby mosques. We use reduced location accuracy where that is enough. The map on the Kiblat page loads map tiles from a third-party map service, which sees your IP address and the area shown.
Quran recitation audio and its timings are fetched from everyayah.com, mp3quran.net and Quran.com. These services see your IP address and the files requested.
Khutbah texts are downloaded directly from the state Islamic religious departments' websites, which see your IP address.
If you choose Google or Apple sign-in, Google or Apple processes that sign-in under its own privacy policy. Verification and password-reset codes are sent through Resend, which processes your email address for delivery.
The app contains no analytics or advertising SDK and does not track you across other apps. We do not sell or share your personal data for marketing.
5. How long data is kept
Account data is kept for as long as your account exists. Verification codes and Google sign-in attempts are deleted when they expire, which is within minutes. Expired sign-in tokens are kept for 30 days for security investigation, then deleted. Server logs are kept for 14 days.
When you delete your account, your records are removed from the database at once, and if you signed in with Apple, SORASAF's access to your Apple ID is revoked at Apple. Daily server backups are kept for 14 days and used only for disaster recovery. After that no copy remains.
6. Your rights
Under the Personal Data Protection Act 2010, you have the right to access and correct your personal data, to withdraw consent, and to limit processing. You can view and delete your account in Settings. For other requests, write to support@saf.soraserv.com. We will respond within 21 days.
7. Security
All connections to our server are encrypted (TLS). Passwords are hashed with bcrypt. Tokens and codes are stored only as hashes. Sign-in is rate-limited and temporarily locked after repeated failures. Verification codes are never written to logs.
8. Children
The app is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
9. Changes and contact
We will update this policy as the app changes, and material changes will be announced in the app. Questions about your data can be sent to support@saf.soraserv.com.