Privacy policy

Names, phone numbers and email

• Passport name: your name exactly as printed on your passport. Your operator needs it for your visa and the Nusuk Masar submission, and it appears on your certificate. Your operator corrects it; you cannot change it in the app, because it must match your passport.
• Display name: the name other pilgrims in your group see, on your group card, in chat and in the member list. You can change it.
• Indian mobile: the number you sign in with. We send it your sign-in code and your operator's invitation, by WhatsApp or SMS.
• Saudi mobile: optional, a number to reach you while you are in Saudi Arabia. It is never used to sign in.
• Email: optional, for notices and for sending you a copy of your data.

Your profile

• Photo: for your pilgrim card, so your group leader recognises you, and for your certificate.
• Date of birth or age: needed for the visa and Nusuk Masar, and to suit the guidance to your age.
• Gender: needed for the visa, and for the rules on travelling with a mahram and on accommodation.
• Nationality: needed for the visa and Nusuk Masar.
• Language: the language the app and its content are shown in.
• Fiqh preference: not collected. The app has no field for your school of thought.

Passport, visa and travel documents

• Passport number: your operator submits it to Nusuk Masar. It is encrypted on our servers before it is stored and is shown masked; your operator sees it in full only by asking to, and every time it is shown is recorded.
• Visa number: for travel and immigration, encrypted and masked in the same way.
• Document files: copies of your travel documents that you may need offline during the trip.
• Document trip link and kind: which trip a document belongs to and what kind of document it is, so that your operator's copy is removed on time after that trip.

We never collect the twelve-digit identity number issued by UIDAI, and never a fingerprint, face or iris template. The phone's own fingerprint or face unlock may lock your documents on your phone; nothing from it reaches us.

Your group and your trip

• Group membership: which of your operator's groups you travel with.
• Member display card: what the other members of your group see of you, with the group leader marked.
• Group check-ins: whether you have answered your group leader's roll call that you are here, seen by you, your leader and your operator's staff, never with your location.
• Group and trip dates: when your group leaves and returns. The return date starts the clock for removing your documents.
• Itineraries and announcements: your group's programme and your operator's messages to the group.
• Itinerary reads: which parts of the programme you have seen, so your operator can help.
• Announcement receipts: whether an announcement reached you, and whether you read and acknowledged it, counted for your operator.
• Pilgrim invites: the invitation your operator sends you, by WhatsApp or SMS, to join the app.
• Join attempts: attempts to join a group with a code, counted so that codes cannot be guessed.

Your journey, history and certificates

These show your religious practice, so we treat them as sensitive.

• Journey progress: the ritual steps you mark done, and when, which decide whether a certificate can be issued. Your group leader and your operator's staff can see it.
• Hajj and Umrah history: the years you completed Umrah or Hajj, if you add them, shown as marks on your profile. Your group leader and your operator's staff never see them.
• Certificates: the certificate of completion you can share, with its code. Anyone with the code can check it on our website, and your name shows there only as you choose: in full, as initials, or not at all.
• Operator ratings: the stars and the comment you give your operator after a trip. Other people see only the average and the number of ratings; only SOSA reads your comment.

Safety and SOS

Your emergency contacts are kept with your consent. The SOS records are kept because they may be needed to protect your life, which the law allows without consent; withdrawing a consent never hides an SOS that is still open.

• Emergency contacts: up to three people to reach if you ask for help.
• Operator SOS contacts: your operator's staff numbers that you can dial from the SOS screen, kept on your phone so they work offline.
• SOS events with location: when you press SOS, your location and the time, sent to your group leader and your operator so that someone can reach you.
• Location pings during an open SOS: your location, updated until your leader reaches you.
• SOS acknowledgements: who answered your SOS and when, so you know someone is coming.
• Owner's SOS escalation number: SOSA's own number, called when nobody answers an SOS in time.

Outside an open SOS the app never tracks your location. Prayer times and the Qibla are worked out on your phone, and that position is never sent to us.

Chat, reports and contacts

• Chat messages: your messages in group chats and direct messages. Personal details are taken out of a message before it is stored, and the original text is never kept.
• Reports and blocks: the messages or people you report, and the people you block, for safety and moderation. A report is kept after you delete your account, without your identity.
• Contact hashes: if you choose to find co-travellers from your phone's contacts, the numbers are turned into one-way codes on your phone and only those codes are sent. They are compared and discarded at once, and never stored.
• Contact match pairs: the pairs of people who found each other that way, so that a direct message can open between them. Turning the feature off deletes them.
• Moderation actions: what a moderator decided about one of your messages or about your chat, such as approving or removing a message, a warning, a mute or a ban, with the reason shown to you. Your operator's administrators (for your group chats) and SOSA keep the record; you are never shown who decided.
• Chat restrictions: a mute or a ban on sending messages, kept until it ends or is lifted.
• Contact discovery: if you let people who have your number find you, a one-way code made from your own mobile number. Turning the feature off deletes it.
• Contact match runs: how many codes each search from your contacts sent and how many people it found, so that searches can be limited. No number or code is kept.
• Feature flags: the switches that turn chat, finding co-travellers from contacts, the essentials guide and Hajj mode on or off for everyone, for an operator or for a group. They hold nothing about you.

Plus

• Plus entitlements: whether you have Plus, where it came from (your operator's seat or a store purchase) and until when.
• Store transactions: the record of a Plus purchase from the App Store or Google Play, so we can verify it and honour a refund. The store takes the payment; we never see your card or bank details.

Your account, devices and security

• Account link and profile status: the link between your sign-in and your pilgrim record, and whether your account is active, suspended or being deleted.
• Pending account deletion: while the 7 days after a deletion request run, your profile is hidden from everyone and you can still cancel.
• Device push tokens: the address that lets us send notifications to your phone. A notification carries no message text and no personal data.
• Device records: the phones signed in to your account, so you can see and remove them.
• Watch companion state: if you use the Noor Hidayah app on a Wear OS watch paired with your phone, what your phone sends it to show: the prayer times and your city's name (never your exact position), your next step, your group's and your leader's names, emergency numbers, whether your phone has synced, and the state of your SOS. Google Play services carries it between your phone and your watch, and may pass it through Google's servers when the watch is not connected to the phone by Bluetooth.
• Sign-in session metadata: your sign-in sessions, so they can be listed, ended, and checked for unusual sign-ins.
• OTP sends: how many sign-in codes were sent to a number, to limit abuse.
• Rate-limit buckets: short-lived counts per network address that limit certificate checks and usage-statistics uploads.
• Notification log: whether a notification was delivered, to find and fix delivery problems.
• Audit log: who revealed a passport or visa number, who exported a list and who read personal data, kept as the DPDP Rules require.

Consent and your requests

• Consent notices: the exact text of each notice, in each version and language.
• Consent records: what you agreed to, in which version, and when, so it can be shown.
• Deletion and rights requests: your requests to see, correct or delete your data, your grievances, and what was done about them.

Crash reports and usage statistics

• Crash reports: when the app crashes, a technical report goes to Sentry, with personal data removed and your user id replaced by a one-way code.
• Product analytics events: which features are used, counted with nothing that links them to you. You can turn them off in the app under Settings, Usage statistics.

If you work for an operator

• Operator organisation data: your company's details, for its identity, its invoices and its Nusuk Masar link.
• Operator staff accounts: the sign-in accounts of an operator's staff, with a second sign-in step.
• Staff invites: the email that invites a new staff member.
• Seat allocation: how many pilgrim seats an operator uses, for its invoices.
• Export jobs: a record of every pilgrim list an operator exports. The file itself is deleted after 24 hours.
• Partner directory listing: an operator's public listing, when it has agreed to be listed.

On the website

• Website contact form: when the website's contact form opens, what you write to us, so we can answer.
• Our public pages set no cookies of their own. The account-deletion and certificate-check pages ask Cloudflare Turnstile to check that the visitor is a person.