Privacy policy
Last updated: 22 October 2026
This is a translation. Where it differs, the German version applies.
Controller
IOQ Software, owned by Ihab Oweis
Lessingstraße 48, 47166 Duisburg, Germany
Email: support@amuslim.net
The short version
aMuslim is a social network for Muslims. We only process what aMuslim needs to work. We do not sell data and we do not show ads.
What data we process
| Data | Purpose | Where it is stored |
|---|---|---|
| Email address and password, or sign-in with Google or Apple | signing in | Firebase Authentication. We never see your password in plain text. |
| Name, username, profile photo, gender and year of birth | your profile, the separation by gender and the minimum age | Firestore and Cloud Storage. The app checks your full date of birth only at registration and stores the year. |
| Posts, comments, images, files, polls, events, reactions, votes and event replies | showing them to the people allowed to see them | Firestore and Cloud Storage |
| Friends, who you follow, your groups and blocks | deciding who sees what | Firestore |
| Groups you create or belong to: name, description, picture, category and address, the members with their role, invitations, removed people, sessions (title, place, time, spots, sign-ups) and resources (links and files) | running the group and informing its members | Firestore and Cloud Storage. If the leader deletes the group, we also delete its sessions, resources and files. |
| Messages | delivering them | Firestore, encrypted at rest but not end-to-end encrypted |
| Your device's location | finding groups near you, only when you search for them | The app sends it rounded to three decimals (about 110 m) to look up groups in the area. Neither the app nor we store it. |
| When you agreed to which version of the terms | proving that you agreed | Firestore |
| Reports you make or that concern you, and moderation decisions. If you report someone from a chat, the last 20 messages of that conversation go to the moderation team as a copy | moderation and our duties under the Digital Services Act | Firestore |
| How often moderators removed content of yours (a number with no content) and, after a permanent suspension, a hash of your email address | graduated suspensions and no new account with a permanently blocked address | Firestore. The counter exists as long as your account does; the hash stays with no time limit. |
| Your notifications: who commented, reacted, sent you a request or followed you, event reminders and decisions of the moderation team | showing them under the bell in the app | Firestore, without the text of a post, comment or message |
| An identifier of your device for notifications (the push token) with the language you chose, and the platform | delivering notifications if you allow them. A push names the person and the kind, never the content. | Firestore, one entry per device, delivered through Firebase Cloud Messaging. It is deleted when you log out on the device or delete your account. |
| Device, operating system, app version, your account ID and the steps before an error, without content and without your email address | finding and fixing errors | Firebase Crashlytics |
| A confirmation from Google Play or Apple that a request comes from the genuine app | protection against abuse | Firebase App Check |
| How many new users reach each registration step and how long it takes, as totals not linked to you | seeing where new users give up | Firestore, counters per step only |
| Which parts of the app you use, with a random identifier of this installation and without the advertising ID | improving the app, only with your consent | Firebase Analytics |
Legal bases
- Article 6(1)(b) GDPR, contract: what you need to use aMuslim, that is account, profile, content, messages and notifications.
- Article 6(1)(f) GDPR, legitimate interest: crash reports, protection against abuse, checking content before it is published, the registration counters, the violation counter and blocking an address after a permanent suspension. Our interest is an app that works and stays free of illegal content.
- Article 6(1)(c) GDPR, legal obligation: handling reports under the Digital Services Act.
- Article 6(1)(a) GDPR and § 25(1) TDDDG, consent: usage statistics. You give it voluntarily at registration and can change it at any time under Settings → Account and privacy. Without your consent the app collects nothing for it.
Checks before publishing
Before a post or comment appears, an automatic filter checks its text and images for violations of the terms of use. This also applies to your name, bio and profile picture and to names, descriptions and pictures of groups, resources and sessions. The check runs in three steps: a list of forbidden words, OpenAI's moderation service and a Google Gemini model. Only the text or the picture goes to these services, never your account ID or email address. Only when your name is checked, the name you entered goes along. A log entry keeps the decision, the rule and the model, never the content, and is deleted after six months. Rejected new posts, comments, resources and sessions are deleted after 30 days. It rejects clear violations, and someone from our moderation team looks at unclear cases. Male moderators see content by brothers, female moderators content by sisters.
Who processes the data
- Google Ireland Ltd., Dublin, runs Firebase for us: sign-in, database, files, server functions, notifications, crash reports, App Check and usage statistics. Database, files and server functions run in data centres in the EU. Google processes the data on our behalf (Article 28 GDPR).
- Google and Apple learn that you use aMuslim if you sign in with their account.
- OpenAI (moderation service) and Google (Gemini) check texts and pictures before they are published (see “Checks before publishing”). They process them on our behalf.
- OpenFreeMap delivers the map tiles the app uses to draw the map of groups. The service sees your device's IP address and which parts of the map you look at, but no data from your account and not your location as a number.
- Apple (iOS) or Google (Android) turns a place name you type when searching for groups into a point on the map. The place name goes to your device's service for this.
- Cloudflare, Inc. delivers this website. The service sees your device's IP address.
- IONOS SE, Montabaur, runs our mailbox. If you write to support@amuslim.net, your message is stored there.
Transfers outside the EU
Google, OpenAI and Cloudflare may also process data in the United States. We rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Article 45 GDPR) where the recipients are certified under it, and otherwise on the Commission's standard contractual clauses (Article 46(2)(c) GDPR).
How long we keep data
- Account, profile, content and messages until you delete them or your account. What happens when you delete your account is described under delete account.
- Reports until the moderation team has decided, and the decisions for six months after that, with the hiding record that keeps the reported item out of sight for those who reported it. This also applies if the reported content or account is deleted; if you delete your account, your identifier is removed from your reports (Delete account).
- Your certification request and the proof you attach: while your account carries the badge; after a rejection or withdrawal for 30 days, then we delete the details and the proof; a short note of the outcome (kind, date, reason) stays until you apply again or delete your account. The decision itself is kept for six months like other moderation decisions. Proof may show documents with data about other people; please cover what is not needed.
- Notifications until you delete your account. You can remove single ones in the app.
- The violation counter for as long as your account exists. It contains no content.
- The hash of your email address after a permanent suspension, with no time limit, so that no new account can be created with it.
- Proof of your consent for as long as your account exists.
- Crash reports for 90 days, usage statistics for two months.
- Emails to support@amuslim.net until the request is settled, for one year at most.
This website
amuslim.net is hosted on Cloudflare Pages. When you visit it, Cloudflare processes your IP address to deliver the page and protect it against attacks. We count visitors with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not recognise you again, so no consent under § 25 TDDDG is needed. The legal basis is our legitimate interest in a secure website and in knowing how many people visit it (Article 6(1)(f) GDPR).
Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests (Article 21). You can withdraw consent at any time with effect for the future (Article 7(3)). Write to support@amuslim.net.
You can also complain to a data protection supervisory authority, for example the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).
Minimum age
aMuslim is for people aged 16 and over. If the date of birth entered at registration shows a younger age, registration ends and we delete the account that was just created.
Changes
If the way we process data changes, we update this policy. If we need your consent for the change, the app asks you first.