Privacy Policy

Last updated: October 7, 2026

This Privacy Policy explains how Tawaso (تواصوا) handles information when you use our website and applications. Tawaso helps families and friends organize group goals, read the Quran, and record participation.

Information we collect

• Account information: your display name, email address, account identifier, and a hashed password if you register with a password.
• Group participation: groups, memberships, roles, invitations, join requests, goals, assignments, confirmed progress, corrections, participation points, and administrative history.
• Personal reading information: bookmarks, the current saved reading position, and confirmed reading ranges. We keep the current reading position rather than a continuous history of page views.
• Preferences and notifications: language settings, timezone, reminder preferences, quiet hours, group mute settings, notification records, and device push tokens when phone notifications are configured and enabled.
• Technical and support information: session and authentication records, security and error information, and information you send when contacting us. Hosting and delivery providers may process IP addresses, browser/device information, and request logs.

Participation in religious activities can reveal sensitive information about beliefs and practices. Record only information you are comfortable providing, and avoid including sensitive personal details in group names or descriptions.

Prayer times and nearby mosques

When you choose “Use my location,” we request your device or browser location permission to show local prayer times. Coordinates are held in memory and sent directly to AlAdhan's prayer-times API, which also receives connection information such as your IP address. Tawaso does not save these coordinates in its account database or track your location in the background. If you open the nearby-mosques map, available coordinates are included in a Google Maps search; without coordinates, Maps searches for “mosques near me” using its own available location information. You can deny or revoke location permission in your device or browser settings. Prayer times and map searches do not send group memberships or personal participation records to these providers.

Google sign-in

Google sign-in is optional. We request only openid, email, and profile to verify your identity and create or sign in to your Tawaso account. We receive your Google account identifier, verified email address, and profile name. These are stored with your account. Although the profile scope can return other profile fields, our sign-in implementation does not store your Google profile photo.

The server uses a short-lived Google access token to retrieve identity information during sign-in. We do not persist Google access or refresh tokens in the account database. We never receive your Google password and do not request access to Gmail, Drive, Calendar, contacts, or other Google account content. Google identity information is used for account authentication and identification, not advertising.

Our handling of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable. We do not sell Google user data, use it for advertising, or use it to train generalized AI models.

How we use information

We use information to provide and secure accounts; manage authorized group access; synchronize assignments, reading positions, bookmarks, and confirmed progress; calculate participation totals and rankings; deliver configured reminders and notifications; investigate errors or abuse; and respond to support and privacy requests. Points measure recorded participation only and do not assess faith or sincerity.

Who can see information

Within a group, authorized members can see member display names and roles, group goals and assignments, shared progress, and participation scores where rankings are enabled. Group owners and authorized administrators manage memberships, requests, and group settings. Your email address and Google account identifier are not included in the group member list. Personal bookmarks and detailed saved reading positions are accessible only through your own authorized account.

Public groups have a limited discovery preview, such as their name, description, and admission rules. Public visibility does not grant nonmembers access to member lists, assignments, or rankings. Private groups are excluded from public discovery. Information you voluntarily include in a public preview can be seen by people outside the group. Group members may copy information they can see; please choose your groups carefully.

We use service providers to operate the service: Namecheap for hosting, Google for optional sign-in, and Firebase Cloud Messaging and platform push services when phone notifications are enabled. Push delivery includes a device token and routing identifiers; lock-screen notification text is generic. If a configured Quran page source is contacted directly by your device, that source can receive your IP address and the requested page address. We do not send your group membership or personal progress records to Quran content providers.

We may disclose information when legally required, to protect users or the service, or to providers performing necessary hosting, security, delivery, or support functions. We do not sell personal information. The current app does not integrate advertising or behavioral analytics services.

Cookies, device storage, and security

The website uses necessary session and anti-forgery cookies to support sign-in and secure requests. Your browser or device may store language preferences and reading content. Native apps store their Tawaso authentication token using secure device storage. These tokens are distinct from Google tokens. Clearing storage or blocking necessary cookies can affect sign-in or saved local preferences.

We use HTTPS in production, password hashing, server-side authorization, expiring authentication credentials, and login throttling. No method of transmission or storage provides an absolute guarantee of security. Protect your device, account, and invitation links.

Retention and deletion

Account and participation records are retained while needed to operate your account and preserve group history, corrections, and score integrity. Leaving or archiving a group does not automatically delete its historical records. Expired Google sign-in attempts are eligible for cleanup after five minutes. The scheduled operational cleanup removes notification records older than 30 days except records needed for pending push delivery. Hosting logs, application diagnostics, and backups may have separate retention periods; these are not covered by that notification cleanup.

To request account deletion or access, correction, or deletion of personal information, email [email protected] from the address associated with your account and identify your request. Do not send your password. Account deletion is currently handled through support rather than an in-app deletion button. We may verify ownership before taking action. If you own a group, ownership and shared records will need to be addressed as part of your request.

When handling a deletion request, we will explain any records that must be retained and why, including legal, security, or shared historical requirements. Removal from active systems and expiry of backup copies may occur at different times. We do not promise immediate deletion of every backup copy or automatic deletion of other members' records.

Your choices and other privacy rights

You can choose password registration instead of Google sign-in, correct supported progress entries, delete bookmarks, leave groups subject to owner rules, mute groups, and change available notification and quiet-hour settings. Device settings can disable phone notifications. You can revoke Google's authorization through your Google Account connections; this stops future authorized Google sign-in but does not itself delete your Tawaso account or terminate an existing Tawaso session.

Depending on the law that applies to you, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information, or complain to a relevant privacy authority. Contact us to exercise applicable rights. We may need to verify your identity.

Children and international processing

Tawaso is not intended for independent accounts held by children who cannot lawfully consent to the service and its data processing. Age-specific guardian controls are not currently offered. If you believe a child has provided information without appropriate authorization, contact us.

Our hosting, sign-in, and notification providers may process information outside your country. Applicable privacy protections and provider arrangements govern that processing.

Changes and contact

We will update the date on this page when this policy changes and provide additional notice of material changes when required. For privacy questions, contact us at [email protected].