Murshid privacy policy

Last updated: 19 October 2026

Who operates Murshid

Murshid is operated by Jamiu Okanlawon, Nigeria. Contact developerjamiu@gmail.com about this policy or your submitted information. Within Murshid, Jamiu Okanlawon is the only person authorized to access private submissions, setup goal records, vote records and support media. The service providers named below process information to provide their services.

Your information on this device

Murshid saves your profile, preferences, preparation checklists, saved places and ritual progress on your device. The app does not provide account sign-in or cloud backup of this progress. Your selected guidance and health-related progress are not attached to analytics events or diagnostic reports. Optional usage analytics can include coarse ritual stages, as described below. Explicit goal choices during setup are also sent separately, as described next.

Goals chosen during setup

When you explicitly choose goals during setup, Murshid sends those choices to Google Firebase Firestore with your saved language preference, app version, platform, a UTC timestamp and the same random installation identifier used for feedback, place suggestions and helpful-place votes. This lets the team see which goals people prioritize. These records are not read back to personalize the app. A new choice replaces the previous goals document for that installation; an empty choice or skipped setup does not create a goals report.

This collection happens independently of the optional diagnostics and usage analytics settings. An unconfirmed choice is saved in a separate local queue and retried on launch or when the connection returns. The queued copy is removed after Firestore accepts it. This queue is not part of Saved submissions.

Optional diagnostics and analytics

Crash diagnostics and usage analytics are separate choices in More → Privacy and diagnostics. Both are off by default. You can change either choice at any time.

When enabled, Google Firebase Crashlytics receives technical information about the app and device, crash information, sanitized error and cause types, original stack traces with private paths removed, and fixed code-operation categories. Murshid removes raw error messages and user/application data from the custom error reports it sends. Native crash reports also contain technical device and crash metadata generated by the SDK.

When enabled, Google Firebase Analytics receives Murshid's app-launch events, screen categories, and bounded feature actions and outcomes. These describe preparation, learning, reading, audio playback, coarse Umrah stages and counter correction, Explore, utilities, feedback delivery and store-review requests. This can reveal use of religious features. They do not contain exact progress counts, profile answers, health or vaccination tasks, selected supplication/place identifiers, search text, quiz answers, feedback content or contact details. An earlier analytics choice requires renewed consent before this expanded scope is enabled; the app does not replay prior activity when you opt in. Firebase also collects automatic session, engagement and technical metadata, including an app-instance identifier and approximate geography derived from IP addresses. Murshid disables automatic screen names, advertising identifiers and advertising personalization. It does not attach your profile, precise device location, detailed ritual progress, selected supplications or feedback text to analytics.

Turning a choice off stops future collection by that integration; it does not recall reports already sent. Firebase processes this information under its privacy and security terms.

Feedback, place suggestions and votes

Feedback is sent only when you choose Send. Murshid sends your message and any name, contact details, displayed screen context or attachments you provide, together with a randomly generated installation identifier, submission identifier, timestamp, app version, platform and language. Feedback is stored in Google Firebase Firestore. You should avoid including information you do not want to share.

New feedback and place suggestions include one random per-submission retry secret, also used for receipt acknowledgement. It lets this installation confirm a previously accepted submission after an interrupted connection without reading or changing the submitted content. An empty acknowledgement may be stored separately in Firestore. This confirms receipt by the service, not that support has reviewed it; the secret is not sent to analytics or diagnostic reports.

Place suggestions send the place name, note, optional photos and any location you explicitly add, with the same technical fields and installation identifier. Selected photos and videos can contain their own metadata, such as capture location and time. Murshid does not strip that metadata before uploading files; adding map coordinates is a separate choice. Helpful-place votes send the vote and installation identifier to Firebase. This identifier is not an account or advertising ID, but it persists across sessions. The same identifier is used for feedback, place suggestions, votes and setup goal choices, so those actions from the same installation can be linked. It is not sent to Firebase Analytics or Murshid's custom crash reports.

Submissions whose delivery is unconfirmed and their selected media are saved on this device for retry. More → Saved submissions shows delivery status and any submissions whose automatic retry has stopped. You can inspect the saved message and remove an individual local copy without clearing your journey or other reports. Received-by-service status confirms delivery, not support review.

Server-rejected submissions stop retrying and remain locally until removed or local data is cleared. Local copies are normally removed after acknowledged delivery; a remaining copy can also be removed in Saved submissions. Removing a local report removes its owned local attachment copies. It does not withdraw a report already accepted by Firebase or delete uploaded Cloudinary media. A media upload or database write already started may still finish after local removal. If local file cleanup fails, the saved report is marked as incomplete so you can retry removal; that cleanup record does not resume automatic delivery. Unconfirmed or rejected local submissions have no automatic expiry in the app.

Place photos are uploaded to Cloudinary and can be publicly accessible. Support attachments are available only when separate protected Cloudinary storage is configured; otherwise feedback accepts text without attachments. When enabled, support media uses authenticated delivery. Cloudinary's privacy policy also applies.

How long submitted information is kept

We apply the following schedule through manual review and deletion:

• Feedback and support attachments: delete the report, receipt records and associated original and derived media within 90 days after the support case is closed. Review unresolved reports after 12 months and delete them unless an ongoing support need is recorded.
• Place suggestions: keep pending suggestions for no more than 12 months. Delete rejected suggestions and unused photos within 90 days of rejection or the decision that they are no longer needed. Approved public place information and photos remain while maintained as part of the directory; private report or contact fields are not published with them.
• Setup goals: delete the latest server-side goals document 12 months after its most recent update. New explicit choices replace that document and restart this period. A pending local copy has no automatic expiry and may be delivered later, as described above.
• Helpful-place votes: keep the installation's vote record while needed for the published place's vote trail, until a successful unvote or an applicable deletion request. Removing the app does not itself remove a server-side vote.
• Unmatched media uploads: review uploads not matched to a received report after seven days. This is a manual review point, not an automatic deletion deadline. We retain media that may still belong to a queued report while reconciling it, and remove media confirmed to be unnecessary.

The app does not automatically expire unconfirmed or rejected local submissions. You can remove a feedback or place-suggestion copy in Saved submissions. Setup goals use a separate local queue; clearing app data or removing the app removes that local copy subject to your device's backup settings. Optional telemetry settings do not cancel these queues.

A server-side deletion does not recall an old local copy or a transfer already in progress. When asking us to delete a report, also remove an unconfirmed local copy if one remains. If a late copy arrives afterwards, contact us so we can complete the request for that copy too. If retained queued media has become unavailable, we will explain that limitation rather than treat the attachment as recovered.

Firebase Analytics and Crashlytics have their own product-specific retention and deletion controls, described by Google. The report and media schedule above does not itself delete those separate records. For those separate records, contact us about the deletion options available through the relevant provider.

Voluntary financial support

Where available, you can choose optional one-time or monthly financial support. Contributing does not unlock app features. Paystack processes the payment, sends receipts and manages recurring billing. Monthly support continues until cancelled.

Murshid's payment service, hosted on Railway, receives your chosen amount, currency, support frequency and a random payment reference. When you enter a receipt email in our checkout form, that service passes it to Paystack to start the payment. It does not save the email in its own storage or application logs. You enter payment details on Paystack's hosted pages. Murshid does not receive or store your full card number or security code. Paystack can make customer and transaction information available to the operator through its merchant services.

The payment service checks transaction and subscription information with Paystack to confirm a contribution, recover an interrupted checkout and open management or cancellation controls for the correct subscription. It does not send your Murshid profile, guidance choices, worship progress or feedback to Paystack. Railway and Paystack also receive normal connection information needed to provide their services. Their policies describe their processing and international transfers: https://railway.com/legal/privacy and https://paystack.com/terms.

This device saves the pending contribution and private credentials used to check its result and manage monthly support. Recovery credentials for abandoned monthly checkouts can remain so a payment completed later is still recognised. Clearing app storage or removing the app can remove access to those in-app controls; it does not cancel a Paystack subscription. Use Paystack's management controls or contact us if you need help cancelling.

Checkout references, recovery links and safety records expire after 30 days and are removed by periodic cleanup, or earlier on access or server restart. A completed or reversed payment's recovery link is removed earlier. Newly created monthly records that were never submitted for payment become eligible for cleanup after 15 minutes. Periodic cleanup runs every ten minutes. Records for attempted monthly payments and verified subscription associations are retained while their management credentials remain supported, without an automatic expiry, including after cancellation. They contain random references, lifecycle states and, where verified, the subscription code and initial transaction identifier. They let us avoid losing an existing subscription or confusing it with a new contribution. The operator can access these records.

Contact developerjamiu@gmail.com to request deletion of Murshid-held support data. Deleting recovery records can prevent later in-app verification or management and does not cancel recurring billing or erase Paystack's records. A device that still presents its saved recovery credential can cause verification records to be recreated, so contact us to coordinate removal. We will explain those effects and handle applicable provider requests with you. Our existing seven-day acknowledgement and 30-day response aim apply. Paystack retains its own records under its privacy policy and applicable obligations.

Other services and permissions

Explore can refresh its public place directory from Firebase Firestore and fetch place photos from their configured image hosts, including Cloudinary. Map previews inside the app request OpenStreetMap tiles for the displayed destination; the tile coordinates describe the place, rather than your current location. City labels may use selected coordinates with Apple or Android platform geocoding services. Weather requests are sent to Open-Meteo for the selected city. Supplication recordings are downloaded from OpenDua. These services receive normal connection information, including your IP address and requested resource. These feature requests are separate from optional crash diagnostics and usage analytics. Opening maps, booking links or other external links takes you to an independent service with its own privacy policy.

Location, photos and notification access are requested for the features that need them. You can change permissions in your device settings. Adding a location to a place suggestion is optional. Location used for on-device features is not attached to analytics or crash reports.

Your choices and contact

You can turn off optional diagnostics and analytics, decline permissions and choose which information to include in feedback. Removing the app deletes its local data subject to your device's backup settings; it does not delete previously submitted feedback, media, votes or setup goal choices from their services.

Contact developerjamiu@gmail.com with questions or requests about submitted information. Include enough details to identify the submission without sending unnecessary sensitive information. We acknowledge deletion requests within seven days and aim to complete them within 30 days. If a specific exception or a late queued delivery affects that timing, we will explain it to you. Murshid does not target children under 13.

The public policy will be updated when these practices change.