Privacy Policy

1. Introduction

Masjid Plus ("Masjid Plus," "we," "us," or "our") is a mosque-discovery, prayer-schedule, and community mobile application developed and operated by Lexus Developers. This Privacy Policy explains what information the Masjid Plus app and its supporting services actually collect, how we use it, who we share it with, and the choices available to you.

This policy applies to the Masjid Plus Android application and its backend services. It does not describe hypothetical or planned features — only data practices that are actually built into the app as of the effective date above. If a feature changes what data is collected, we will update this policy accordingly (see Changes to this policy).

2. Information we collect

2.1 Account & identity information

When you create a Masjid Plus account, we collect:

• Phone number — used to sign in via a one-time passcode (OTP), and as your account identifier.
• Full name — provided by you during registration.

If you sign in to the separate Super Admin web console (used only by our internal operations team, not by mosque visitors, mosque admins, or Imams), we collect an email address and a password, which is stored only in securely hashed form and never in plain text.

2.2 Authentication data

Phone sign-in is verified using Firebase Phone Authentication (provided by Google) and/or an SMS-based one-time-passcode delivery service, depending on the delivery method active for your account/region. We do not store the OTP code itself once it has been used to verify your session. Signed-in sessions are secured with access and refresh tokens; refresh tokens are stored on our servers only in hashed form.

2.3 Location information

With your permission, the app reads your device's approximate GPS location, in the foreground only and only at the moment you use a location-based feature (such as "mosques near me" or setting a mosque's location while registering it). This location reading is used immediately to perform that one action and is not stored on our servers as GPS coordinates. We do keep a record of whether you granted or denied location permission, so the app can request it again appropriately — this record does not contain any coordinates.

If you register a mosque, the mosque's own location (its address coordinates, not yours) is stored so the mosque can be found by other users through nearby-mosque search.

2.4 Push notifications & device tokens

If you enable notifications, we store a device push token (issued by Firebase Cloud Messaging) and your device platform, linked to your account, so we can deliver notifications you have opted into — such as new chat messages, mosque announcements, or event updates. You can control which notification categories you receive from within the app; some prayer-time reminders are generated entirely on your device and never involve our servers at all.

2.5 Chats & messages

Masjid Plus includes in-app text messaging between users and mosque Imams, and between Imams across mosques. Message text you send is stored on our servers so it can be delivered and so conversation history is available to the participants. Messages are limited to text (no photo or file attachments are supported by this feature).

2.6 Mosque Admin / Imam verification information

If you apply to be verified as a Mosque Admin or Imam for a mosque, we additionally collect your CNIC (national identity card) number and images of the front and back of your CNIC. This information is used solely to verify your identity and your association with the mosque you represent, and is reviewed only by our authorized Super Admin team. CNIC images are never made public, never shown to other app users, and are not returned directly to any client app — they are only ever accessible through short-lived, access-controlled links generated specifically for an authorized reviewer.

2.7 Mosque, follow & subscription activity

We store which mosques you follow and which Imams you subscribe to, so we can show you relevant content and deliver the notifications you've opted into for those mosques.

2.8 Information we do not collect

Masjid Plus does not integrate any analytics or crash-reporting SDK, does not use advertising identifiers or ad SDKs, and does not use browser cookies (this is a native mobile app, not a tracked website). We do not request access to your contacts, camera roll/storage in general, or microphone.

3. How we use information

• To create and secure your account, and to verify your phone number at sign-in.
• To show you nearby mosques, prayer/Iqamah schedules, and mosque-related content.
• To deliver chat messages between you and Imams, or between Imams.
• To send notifications you've opted into (chat messages, announcements, events).
• To review and verify Mosque Admin/Imam applications and mosque registrations.
• To maintain the security, integrity, and reliability of the service.
• To respond to support requests you send us directly.

We do not sell your personal information, and we do not use your data for third-party advertising.

4. Third-party service providers

We rely on the following categories of service providers to operate Masjid Plus:

• Firebase (Google) — phone-number authentication (Firebase Phone Auth) and push notification delivery (Firebase Cloud Messaging). Google processes the phone number and device token needed to provide these services under its own privacy terms.
• SMS delivery provider — depending on the active configuration for your account/region, OTP codes may be delivered through a third-party SMS provider (such as Twilio) rather than, or in addition to, Firebase. Only the phone number and OTP code needed to complete delivery are shared with this provider.
• Cloud storage provider — where Mosque Admin/Imam CNIC images are submitted for verification, they are held in access-controlled cloud object storage, accessible only through short-lived authorized links as described in 2.6 above.
• Infrastructure hosting — our backend and database run on a private server we operate; they are not exposed as a public data marketplace or shared with data brokers.

We do not use any advertising network, analytics vendor, or crash-reporting vendor in Masjid Plus.

5. Data storage & security

Your account data is stored in an access-controlled database, reachable only by our backend service — it is never directly exposed to the public internet. Passwords (Super Admin only) and session refresh tokens are stored only in irreversibly hashed form, never in plain text. CNIC images, where collected, are stored in access-controlled object storage and are never returned as public, guessable, or permanently-shared links.

While we take reasonable technical and organizational measures to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Retention & deletion

We retain your account information for as long as your account is active, so we can provide the service to you. Chat messages are retained to preserve conversation history for participants.

Account deletion: Masjid Plus does not currently offer an automated, in-app "Delete my account" button. To request deletion of your account and associated personal data, contact us at privacy@lxcd.site from the phone number or account in question. We will verify the request and delete or anonymize your personal data within a reasonable time, except where we are required or permitted to retain certain information (for example, to resolve disputes, enforce our terms, or comply with legal obligations).

7. Your choices & rights

• Location: you can grant or deny location permission at any time through your device's system settings; denying it only disables location-based features such as "mosques near me."
• Notifications: you can turn individual notification categories on or off inside the app, or disable all notifications through your device's system settings.
• Access, correction, and deletion: you may contact us at privacy@lxcd.site to request access to, correction of, or deletion of your personal information, subject to the limits described in Section 6.

Depending on where you live, applicable data protection law may give you additional rights over your personal information. We will honor requests to exercise those rights consistent with applicable law when you contact us.

8. Children's privacy

Masjid Plus is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@lxcd.site and we will take appropriate steps to remove it.

9. Changes to this policy

We may update this Privacy Policy from time to time as Masjid Plus's features change. When we do, we will update the "Effective / Last updated" date at the top of this page. If a change is significant, we will make reasonable efforts to bring it to your attention within the app.