MahabbaPrivacy Policy
This Privacy Policy explains how PT Sagatra Artha Teknologindo ("we", "us") collects, uses, shares, and protects personal data when you use the Mahabba mobile app ("the App"). It also explains your choices and how to delete your data. By using the App you acknowledge this policy.
1. Data we collect
| Data | How it is collected | Why we use it |
|---|---|---|
| Email address | You enter it to sign in or register. | Account creation and authentication. We email you a one-time code (OTP). There are no passwords. |
| Name | Created automatically from your email address when you register; you can change it. | Greeting you in the App and personalising your account. |
| Optional profile details: phone number, gender, place of birth, date of birth | Only if you enter them in the Profile menu. | Completing your profile. They are optional and the App works without them. |
| Location (precise or approximate GPS) | Read only while the App is open, after you grant permission. The App does not track your location in the background. | Determining your city for prayer times and calculating the Qibla direction. |
| Device token and platform (Firebase Cloud Messaging token; "android" or "ios") | Generated by Firebase on your device and sent to our server. | Delivering notifications and announcements. If you are signed in, the token is linked to your account. |
| Technical data: IP address and request logs | Received automatically by our server and by the services listed in section 4 whenever the App connects to them. | Delivering content, security, and preventing abuse. |
| Data stored only on your device: last-read Quran position, bookmarks, prayer tracker, deeds checklist, Quran reading target, and notification and adhan settings | Created as you use the App. | Keeping your progress. We do not receive this data. It is removed when you clear the App's storage or uninstall the App. |
We do not collect: contacts, photos or files, microphone or camera data, SMS or call logs, financial or payment information, or the advertising ID. The App contains no ads and no analytics or crash-reporting SDKs.
2. How we use your data
- To create your account, sign you in, and keep you signed in.
- To show prayer times, Qibla direction, and schedule adhan reminders for your location.
- To send you notifications and announcements you have allowed.
- To secure the App, prevent abuse (for example, limiting OTP requests), and fix problems.
- To comply with legal obligations.
We do not use your data for advertising or profiling, and we do not make automated decisions that affect you.
3. Permissions the App requests
- Location (precise and approximate), while the App is in use: prayer times and Qibla direction. If you deny it, prayer times and the Qibla direction cannot be personalised to your location.
- Notifications: prayer-time reminders and announcements.
- Exact alarms: so the adhan sounds at the correct time.
- Run at device startup: to restore scheduled reminders after your device restarts.
- Ignore battery optimisations: so reminders are not delayed by the system.
- Internet: to fetch prayer times and content, and to sign in.
- Vibrate: notification vibration and the digital tasbih.
You can change or withdraw any permission at any time in your device settings.
4. Who we share data with
We do not sell your personal data. We share limited data only with the service providers needed to run the App:
| Recipient | Data received | Purpose |
|---|---|---|
Our server (sagatra-tech.biz.id), operated by us | Email, name, optional profile details, device token and platform, IP address | Accounts, OTP sign-in, notifications |
| Email delivery provider (SMTP service used by our server) | Your email address and the OTP message | Sending your sign-in code |
| Google Firebase Cloud Messaging | Device token, IP address, device/app identifiers handled by Firebase | Delivering push notifications. Google Privacy Policy |
MyQuran API (api.myquran.com) | Your GPS coordinates (for Qibla direction), city search terms and city IDs, IP address | Prayer times, city lookup, and Qibla direction |
| Device geocoding service (Google Play services on Android, Apple on iOS) | Your coordinates, to obtain a city/district name | Identifying your city. Handled by the operating system under Google/Apple policies |
EQuran.id and Islamic API (equran.id, islamic-api.vwxyz.id) | IP address and content requests (e.g. surah or hadith number). No account data or location. | Quran, hadith, supplications, dhikr, and other content |
Opening a map link (for example to find a mosque) takes you to Google Maps outside the App, under Google's terms. We may also disclose data when required by law or to protect our rights and users' safety.
5. Security
- All communication between the App and our server uses HTTPS (encryption in transit).
- One-time codes are stored only as a hash, expire after 10 minutes, and are invalidated after 5 wrong attempts; OTP requests are rate-limited.
- The App does not use passwords, so there is no password to leak.
No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.
6. Retention and deletion
- Account data (email, name, optional profile details, device token) is kept while your account is active and until you ask us to delete it.
- OTP records expire after 10 minutes and are not used for any other purpose.
- Server logs are kept only for a limited period for security and are rotated and deleted regularly.
- Local data on your device is controlled by you and removed when you clear storage or uninstall the App.
How to delete your account and data: in the App, open Profile → Hapus Akun (Delete Account) and confirm; your account and data are deleted from our server immediately. You can also email us from your registered address with the subject "Delete Mahabba Account" (see mahabba.web.id/delete-account); we then delete your data within 30 days. Data we must keep by law is excepted.
7. Your rights
Subject to applicable law, including Indonesia's Personal Data Protection Law (UU No. 27 of 2022), you may access and correct your data (you can edit your profile in the App), withdraw consent (for example by revoking permissions), request deletion, and object to or ask us to restrict processing. Contact us using the details below.
8. Children
The App is not directed to children under 13 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
9. International processing
Some providers (such as Google Firebase) may process data on servers outside your country. We rely on those providers' safeguards for such transfers.
10. Changes to this policy
We may update this policy. The latest version is always at mahabba.web.id/privacy-policy with its update date. If changes are significant, we will notify you in the App.
11. Contact
PT Sagatra Artha Teknologindo
Email: info.sagatra@gmail.com
Website: mahabba.web.id