What we collect
What you give us
- Your Google account. Signing in is the only way to join, and when you do, Google tells us three things: a permanent identifier for your account, your email address, and your name and profile picture. Nothing else. We never see your Google password, and we cannot read anything else in your Google account — not your contacts, not your mail, not your files.
- Your email address is kept so we can reach you about your account. It is never shown to other members and is never used to advertise to you. Your name and picture become the starting point for your profile, and you can change or remove either straight away.
- A password, only if you add one. You may set one in your settings so you can still get in if you lose access to your Google account. It is stored by Google’s Firebase service against the same account — never by us. We cannot read it, and there is no password of ours to leak.
- Your profile. Display name, handle, role (Mufti, Aalim, Hafiz-e-Quran, Talabah or Community Member), institution, credentials, specialisations, languages, location, country, headline and website. Every field except your name and handle is optional.
- What you post. Text, images, audio recordings, polls, event announcements, comments, reactions, saved items and the folders you file them in, and whether you are going to an event.
- Statuses. The text, photo and voice statuses you share, and who you chose to share them with: your followers and connections, only certain people, or everyone except certain people. When somebody views one of your statuses we record that they saw it and when, and any reaction they leave; you, as its author, can see that list, and nobody else can. The same is recorded about you when you view somebody else’s.
- Questions and answers. The questions you ask in Ask a Mufti, and how you chose to ask them (publicly, anonymously or privately), and the answers you give if you are a scholar.
- Direct messages. New messages are end-to-end encrypted: we store them only in a form we cannot read, together with the public keys of each of your devices and a list of those devices that your own devices sign. We can still see who you message, when, roughly how long each message is, and which conversations you have read, muted or cleared. Messages sent before encryption was switched on, or from an app too old to encrypt them, are stored as plain text and are marked “not end-to-end encrypted”. If you turn on message backup, we also keep your backup, locked with a recovery key or passphrase that only you know.
- Dhikr. How many of each recitation you counted on each day, so your streaks follow you between devices, and what you counted towards a Durood campaign. Campaigns you start, with their title, goal and intention.
- Pages. If you create or run one, for a masjid, a madrasa, a personality, an organisation or a business: its name, address, map pin, phone number, website, a masjid’s jamaat and Jumu’ah times, the posts made to it, and who its admins are. Which pages you follow.
- Jobs. Openings you post, comments on them, and the “I’m interested” you send, with any note for the poster.
- Feedback you send us from the app, with its rating.
- Verification applications. If you apply for the verified mark, what you submit in support of it and the moderator’s decision.
- Reports you file. About a post, a comment or a member, so a moderator can act on them.
What the platform records as you use it
- Sessions. One record per signed-in device, so you can see your own devices and end any of them. It holds the browser and device description, the network (IP) address it signed in from, when it was last used, and a hash of the session secret — never the secret itself.
- When you were last active, and roughly where. The last time you used the website and the app, which app version and whether Android or iPhone, and the country, region and city your network address points to. That place is worked out on our own server from an offline database, and the address itself is not kept here. It is approximate, often only the city of your mobile network, and only our admins see it, to understand where the community is.
- Notification addresses. If you allow notifications, the address Firebase gives your phone or browser for them, with the app version and the device’s language. If you turn on quiet notifications during salah, the app sends us the next week’s prayer windows, as times only.
- Translations. When someone reads a post or comment in another language, the translation is kept so it is only made once. It goes when the original does.
- Post views. That a post was seen, and by whom, so an author can see how their writing travelled. Counted once per person per post.
- A record of every change to your email address — the old value, the new one, and when. You cannot change it here: it comes from your Google account. This exists because it can therefore change without anyone telling you, and you deserve a date rather than a mystery.
- A sign-in record. That a sign-in happened, when, and from which network address. It holds no credential of any kind — only the fact that the check happened, which is what stops the same sign-in being replayed. It is deleted automatically after about ninety minutes.
- Rate-limit counters. Short-lived counts of requests, to stop abuse of sign-in and posting.
- Crash reports. When the app or a page breaks, it sends us what broke: the error message, where in our code it happened, the app or site version, the kind of device (iPhone, Android or browser), the section of the site without any ids, and your account if you were signed in. Never what you were typing, never your network address. They go to our own servers only — no crash-reporting company — and only our admins read them.
- Who invited you. If you join from someone’s invite link, we note who invited you, and they are told that you joined.
What stays on your device
- Your location, for prayer times and the qibla. If you let the app find you, it reads a rough, city-level position and works out the times and the qibla direction on the phone. Your phone’s own place-name service (Google’s on Android, Apple’s on iPhone) names the place. We never receive or store that position. When you look for masjids or gatherings near you, the point you search from is sent with that search to find what is close, and is not kept.
- The microphone, camera and photos are used only when you choose to record audio or attach a picture, and only what you then post is uploaded.
- Quran bookmarks, recent places, downloaded bayans and listening history are kept on the phone. Signing out clears your listening history and downloads.
What we do not collect
No advertising identifiers. No third-party analytics or tracking scripts. No precise location, and no location history. No contact-list upload. No personal phone number: we never ask for yours. The only phone number on SunniHub is the one a page, such as a masjid’s, chooses to show. We never see your Google password, and the only thing Google shares with us is the small profile described above.
Why we collect it
Each item above exists for one of four reasons, and nothing is collected for a reason that is not on this list:
- To let you in and keep the account yours — your Google identity, the optional password you may add, and your sessions.
- To provide what the platform is for — your profile, your posts, questions and messages, your connections, your saved items, your dhikr, the notifications you asked for, and translations.
- To keep the community safe — reports, blocks, mutes, moderation decisions and verification.
- To keep the service working — rate limits, delivery receipts, error records, and knowing which app versions and places are in use.
We do not sell your data, we do not share it with advertisers, and we do not show advertising of any kind. There is no interest-based advertising on SunniHub and there will not be.
What is public, and what is not
Public: your display name, handle, profile picture, role, institution and other profile fields you fill in, and anything you publish — posts, comments, reactions, and the circles and hashtags you file them under. Questions you ask publicly, with their answers, so others can learn from them; a question asked anonymously is published without your name. Pages and the posts made to them, job openings and Durood campaigns, with the campaign’s total. A post you share by link can be read by anyone holding that link, including people without an account.
Not public: your email address, your saved items and folders, your drafts, your blocks and mutes, your sessions, your own dhikr counts, where you were last active, and your follower, following and connection lists — those three are visible to you alone. A question you ask privately is seen only by you and the platform’s scholars. A direct message is seen by you and the person you sent it to. If one of you reports an end-to-end encrypted conversation, the reporter’s device sends the last few messages it can read along with the report, and moderators see them marked as supplied by the reporter; we cannot check them against the encrypted copies. A reported message from before encryption is read by a moderator directly. The note with an “I’m interested” on a job is seen only by its poster. Moderators can see who asked an anonymous question, for reports only.
How long we keep it
- Sign-in records are kept for about ninety minutes, long enough to stop a sign-in being replayed, and then deleted automatically.
- Sessions, with the network address they hold, end when you sign out, when you end them from your device list, or after 30 days without use. The records of ended sessions go with your account.
- Last-active time and approximate place are overwritten as you use SunniHub, so only the latest is held, and go with your account.
- Crash reports are kept until the fault is fixed and then for our records; your account is detached from them when you delete it.
- Statuses disappear after 24 hours, and their photos and voice recordings are deleted from storage with them, along with who viewed them and how they reacted. You can delete one sooner yourself.
- Your account and what you posted are kept until you delete them.
- A released handle is reserved for 30 days after you change it, and the record that it once belonged to you outlives the change. This is deliberate: on a network where a scholar’s name carries weight, a freed handle is a ready-made disguise.
- Moderation records — a report and the decision made on it — are kept after the matter is closed, so a pattern of behaviour remains visible to moderators.
Your rights, and how to use them
Under India’s Digital Personal Data Protection Act, 2023, and as a matter of how this platform is built, you can do each of these yourself from within your account:
- See and correct what we hold. Your profile is editable at any time.
- Take a copy. In the app, Settings → Your data → Download your data; on the website, the “Your data” tab on your profile. You receive everything you wrote as plain JSON: your account, posts, comments, messages you sent (for end-to-end encrypted ones, only when and to whom, since we cannot read them), statuses you have live, votes, saved items, endorsements, jobs, feedback and uploads. It deliberately leaves out other people’s words and names, because those are not yours to take.
- Delete your account, as described below.
- End a session. Any signed-in device can be signed out on its own, from your device list.
Deleting your account
In the SunniHub app, go to Settings → Your data → Delete this account. On the website, open the “Your data” tab on your own profile and choose Delete my account. Either way you confirm with Google first. This removes your profile, posts, comments, reactions, votes, questions and answers, the messages you sent, your statuses and who viewed them, your dhikr counts and campaigns, saved items, notifications, sessions, devices and uploaded files, along with your encryption keys, your message backup and the encrypted copies of messages you sent.
What survives deletion, and why. A comment of yours that somebody has replied to cannot simply vanish without taking their reply with it, so its words are erased and your name detached — the empty place in the thread remains. The record that your handle once existed is kept for the impersonation reason above. Nothing else is retained.
Deletion is immediate and cannot be undone. Removing your account here does not touch your Google account. If you cannot reach your account, write to us at the address below from the email address on it and we will act on the request.
How it is protected
No password is stored here, which removes an entire category of risk: no password database of ours to breach, and no reset links of ours to forge. If you add a password, Google holds it. Session secrets are stored only as a SHA-256 hash, so reading our database does not yield a usable credential, and every refresh rotates the session — a copied one is detected and the whole device is signed out. What we receive from Google is a signed statement, which we check against Google’s own keys, accept exactly once, and refuse if the sign-in behind it is more than a few minutes old. Deleting your account requires you to sign in again first, so a stolen session cannot destroy it. Traffic is encrypted in transit.
Direct messages are end-to-end encrypted on current versions of the app and website. Each of your phones and browsers has its own keys, made on that device; the private halves never reach us. On the website they are kept in your browser’s storage in a form scripts cannot export. Each message is encrypted separately for every device of yours and the other member’s, so only those devices can read it. You can see and remove your devices in Message settings, and compare a security code with the person you’re talking to to check that nobody else is listening in. If their code changes, the conversation tells you. Signing out of a device, or deleting your account, deletes that device’s keys.
A new phone or browser can’t send or read encrypted messages until one of your existing devices approves it, after you compare a six-digit code on both. If you no longer have another device, you can reset your security key instead; your contacts then see that your security code changed. Your devices sign the list of which devices are yours, so we cannot quietly add one. Removing a device signs it out at once and stops it receiving new messages. Each device replaces its keys every week and deletes the old ones a month later, so a key taken from a device later cannot open messages from long before.
Encryption has limits, and we would rather say so. We still see the details listed above, such as who talks to whom and when. Messages sent before encryption, or from an old app, are not end-to-end encrypted. The website can only be as trustworthy as the code we serve it, so if that matters to you, use the app. Message backup is optional. If you use it, your history is locked with a recovery key or passphrase that never leaves your device. If you lose it, nobody can recover those messages, including us. Without a backup, a new device only reads messages sent after it was set up.
No system is perfect. If we ever discover a breach affecting your personal data, we will tell you and the Data Protection Board as the law requires.
Age
SunniHub is intended for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.
Changes
If this notice changes in a way that affects you, we will say so on the platform before the change takes effect, and the date at the top will move. Continuing to use SunniHub after that means the updated notice applies.
Contact
Questions about this notice, or about your data, go to account@sunnihub.com. We answer requests about your own data within 30 days.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India.