The short version
What stays on your device: your tawaaf circuit count, your dua bookmarks, your prepare-page checklist. None of it is transmitted to us. Ever.
What we count on our server: an anonymous tally of which pages are visited, from which country, on what kind of device. No names, no accounts, no cookies, no third parties, no individual profile of you. The raw IP and user-agent that come in with any web request are parsed into an aggregate category (e.g. "Chrome on iOS from Saudi Arabia") and then discarded in the same request — they are never written to our database.
What lives on your device, not ours
- Tawaaf counter session. Stored in localStorage. Includes your circuit timestamps, mode (auto/manual), and active rotation in degrees.
- Prepare-page checklist progress and departure date. Stored in localStorage.
- Dua-library preferences (last category, last source filter). localStorage.
You can inspect any of this yourself in your browser's developer tools. None of it leaves your device.
What we count on our server (the aggregate analytics)
When you visit any page on tawaaf.com, our own server logs a single row containing:
- The page path (e.g.
/app/duas.html). Query strings are stripped. - A timestamp (to the second).
- The country your IP resolves to (two-letter code, e.g.
SA,GB). No city, no region, no street. - The browser family (Chrome, Safari, Firefox, etc.) and OS family (iOS, Android, macOS, etc.), derived from the user-agent header.
- The device type (mobile / tablet / desktop).
- The referrer host only (e.g.
google.com), if you arrived from another site. Never the full referring URL. - A daily visitor hash. This is a short hash of (your IP + user-agent + a random salt that rotates every UTC midnight). Because the salt rotates, the same visitor looks different on different days — we can count "unique visitors today" but we cannot link visitors across days, and the hash cannot be reversed to recover your IP. This is the same approach used by Plausible and Fathom; we just run it ourselves.
What we deliberately do NOT collect:
- Your raw IP address is never written to our database. It is used in the same HTTP request to look up the country code, then discarded.
- Your full user-agent string is never stored. It is parsed into (browser, OS, device) and discarded.
- We set no cookies.
- No keystrokes, mouse movements, scroll depth, screen size, form contents, or session recordings are captured.
- The content of any page is never sent anywhere. Only that you visited it.
- Inside
/app/we record only page visits at the same aggregate level. The contents you set within the app (your tawaaf session, your bookmarked duas, your prepare-page checklist) never leave your device.
We do NOT use: Google Analytics. Plausible. Fathom. Hotjar. Mixpanel. Amplitude. Heap. Segment. Meta pixel. TikTok pixel. Any A/B testing service. Any tag manager. Any third-party CDN that wasn't strictly necessary. Cookies of any kind.
Retention. Raw pageview rows are automatically purged after eighteen months. We may retain aggregate counts (e.g. "total visits per month") indefinitely for long-term trend understanding, but those aggregates contain no per-visitor data.
Why we do it. So we can see, at a weekly level, which pages are being read and which are being ignored, and improve the site accordingly. That's it. We don't run ads, we don't sell data, and we don't share data with anyone. If you want to see the exact code that runs on the server, it lives in api/track.php in the site repository.
Do-Not-Track & Global Privacy Control. If your browser sends either of these signals, we don't run the tracking beacon at all. It is a no-op in your browser. You can test this in your browser's devtools.
Third-party services we depend on
Three remote services see one piece of information about you when you use specific features:
- Google Fonts — for the typefaces (Inter, Fraunces, Amiri). When you load any page, your browser fetches font files from
fonts.googleapis.com. Google may log your IP address and user-agent. If you block Google Fonts the site still works; the type just falls back. - Aladhan API — only when you use the Prayer Times page. We send your latitude and longitude (with browser geolocation, after you grant permission) so they can compute today's prayer times for your location. Aladhan is a non-commercial service run by IslamicNetwork; their privacy policy is here.
- OpenStreetMap Nominatim — only when you use the Prayer Times page. We send your latitude and longitude to look up a human-readable city name. Their usage policy is here.
We do not store the coordinates you share — they leave your browser, hit the third-party API, and the result is rendered on your screen. Nothing is logged on our end.
The contact form
When you submit the contact form, the message you write — together with the name and email you provide — is delivered by email to contact@tawaaf.com via our hosting provider's PHP mail. The form itself does not write your message to a database. We retain inbound email for as long as we'd retain any other piece of correspondence; you may ask us to delete your message at any time by writing back to the same address.
Cookies
We do not set any cookies on the public site. The aggregate analytics beacon described above is explicitly cookie-free. An HTTP-only session cookie is set only on /admin/ URLs, which are used by the site operators to view the aggregate dashboard — it is never set in your browser unless you are signing into the admin area.
Your browser may set its own cookies for fonts and other host-level concerns; those are out of our control and out of our visibility.
Server access logs
Separate from the aggregate analytics above, our hosting provider (HostGator) keeps standard web server access logs of every HTTP request. These contain your IP address, the URL you requested, the timestamp, your user-agent, and the referer, and are kept on the host's default schedule (typically a few weeks). We do not export, analyse, syndicate, or correlate these logs. They exist for diagnostic purposes only.
Children
The site is suitable for all ages. We do not knowingly collect personal information from anyone, of any age. If you are concerned about a child's interaction with the site, write to us.
Changes to this policy
If we materially change anything on this page — for example, if we ever add tracking beyond what is described above, or introduce a new third party — we will say so on the homepage for at least 30 days and date the change at the bottom of this policy. We will never quietly add tracking. The April 2026 update (adding first-party aggregate analytics) was announced on the homepage for 30 days under this same clause.
Your rights, briefly
Because we hold so little of your data — and because the data we do hold cannot be linked back to you as an individual — the rights jurisdictions like the EU's GDPR or California's CCPA grant you are largely already satisfied by default. If you want a confirmation that we hold nothing identifying about you, write to contact@tawaaf.com and we'll reply with what we can confirm. If you want any inbound email we have from you deleted, the same address.