Privacy Policy
Your sacred pilgrimage deserves transparent, respectful data protection. This policy outlines how Rafeeq Al Haram handles your location, personal details, and travel documents with strict confidentiality.
Pilgrim Safety & Location
Location data is collected exclusively to prevent separation in crowded holy sites, assist travel agency mutawwifs, and guide you through ritual stages.
Zero Ads & No Data Selling
We never sell, rent, or trade your personal data. The app is 100% ad-free with no commercial ad tracking SDKs or third-party marketing networks.
On-Device Biometrics
Biometric unlock for Document Pocket is handled strictly on your device via Android BiometricPrompt. Biometric data never touches our cloud servers.
Total Deletion Control
You retain complete ownership of your data. You can delete your account and all stored records at any time in-app or by sending a single email request.
Location & Background Location Tracking
Rafeeq Al Haram collects location data to enable real-time holy site navigation, lost pilgrim reunification during Tawaf and Sa'i, and emergency coordination with your authorized Hajj or Umrah travel agency, even when the app is closed or not in active use.
ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, and ACCESS_BACKGROUND_LOCATION.1. Information We Collect
We only collect data necessary to provide a dependable, safe, and spiritually enriching companion service. This includes:
Account & Identity Details
Your name, email address, phone number, language preference, and travel group registration token assigned by your travel operator.
Precise Geolocation Data
GPS coordinates captured during active travel to deliver prayer times, Qibla compass alignment, itinerary milestones, and group safety tracking.
Document Pocket Vault
Optional digital copies of your passport page, Umrah/Hajj e-visa, flight tickets, and hotel vouchers stored for rapid offline access at Saudi checkpoints.
Device & Diagnostics
Device model, operating system version, network status (online/offline), battery optimization indicators, and crash diagnostics to ensure reliable offline caching.
2. How We Use Your Information
We use the collected information strictly for legitimate pilgrimage operations:
- Spiritual Utilities: Calculating accurate prayer times based on Makkah/Madinah astronomical data, determining Qibla orientation via device sensors, and serving authentic duas and audio recordings.
- Safety & Lost Pilgrim Reunification: Allowing your authorized travel agency guide to view your real-time position during mass movements (e.g., Jamarat stoning, Tawaf al-Ifadah) to quickly locate separated or disoriented pilgrims.
- Emergency Routing: Providing one-tap connection to Saudi emergency medical services (Ambulance 997, Civil Defense 998) alongside your exact coordinates.
- Offline Readiness: Caching your customized itinerary, emergency phone contacts, hotel locations, and dua library so the app remains fully functional when cellular networks are congested.
3. Data Sharing & Third Parties
We maintain a strict minimal-disclosure standard. Your data is only shared with:
Your Authorized Hajj & Umrah Travel Agency
The specific licensed travel company that registered your package has access to your journey status, contact details, and location tracking strictly for tour coordination and duty-of-care obligations.
Emergency Medical & Civil Authorities
In life-threatening situations or medical crises, relevant location details may be shared with Saudi emergency medical services (Red Crescent / 997) upon emergency trigger.
Secure Infrastructure Providers
Our databases are hosted on dedicated, standalone Supabase backend instances protected with enterprise TLS encryption and restricted access controls.
4. Data Security & Storage
We implement industry-standard administrative, physical, and technical safeguards to protect your personal data:
- Encryption in Transit: All communications between your mobile device and our cloud servers are encrypted using TLS 1.3 / HTTPS.
- Encryption at Rest: Cloud databases and document storage buckets are encrypted with AES-256 standards.
- Multi-Tenant Isolation: Strict database row-level security ensures that no agency or unauthorized user can access another group's records.
- Offline Sandbox: Offline cached data is stored strictly within the private application sandbox and is not accessible to other installed applications.
5. Data Retention & Account Deletion
In compliance with Google Play Developer Policies and global privacy laws, you have full authority to request the permanent deletion of your account and all associated data.
Option A: In-App Request
- Open the Rafeeq Al Haram app.
- Tap the More tab in the bottom navigation.
- Select Settings > Account Security.
- Tap Request Account & Data Deletion.
Option B: Email / Web Request
Send an email from your registered email address to:
hello@rafeeq.xpectres.comSubject: Account and Data Deletion Request
What Happens Upon Deletion:
- Your user account, authentication profile, and login credentials are permanently removed.
- All uploaded files from Document Pocket (passports, visas, tickets) are securely purged from storage.
- All historical location breadcrumbs and movement logs are permanently erased within 30 days.
- Offline cached copies on your device are cleared as soon as you log out or uninstall the application.
6. Regulatory Frameworks (Saudi PDPL & GDPR)
We adhere to the Saudi Personal Data Protection Law (PDPL)enacted by Royal Decree and regulated by the Saudi Data & AI Authority (SDAIA), as well as global standards (including the EU GDPR).
Under these regulations, you are entitled to:
7. Children's Privacy
Our application is designed for pilgrims and traveling families. When minors accompany families during Hajj or Umrah, their profiles and tracking settings must be administered under direct parental or legal guardian consent. We do not knowingly collect personal data directly from children under 13 without verifiable parental supervision.
Have Questions About Your Privacy?
Our Data Protection Officer and Privacy Support Team are here to help with any inquiries, data access requests, or deletion verifications.