Privacy Policy

Balum · Last updated: 13 October 2026

1. Our approach

Balum ("we", "us", "our") is built to be privacy-first. Most of what you do in the App stays on your device. We do not show ads in the App, and we do not sell your personal data. This policy explains what we collect, why, and your choices.

This policy is provided by Balum, operated from the United Arab Emirates, which acts as the data controller for the limited personal data described here. Contact: [email protected].

2. What stays on your device

The following is never uploaded to Balum or to any of our service providers:

Your journal entries and private du'a records.
Notes you add to your Library on their own, that is, notes not written on a piece of Balum content (for example a lecture note you add with "Add"). They stay on this phone even when you are signed in.
Photos you add to your Library or your Journal. They are kept in the App's own storage on this phone, are never uploaded, and are left out of your phone's backups (iCloud and Google), so they are not copied anywhere, including to a new phone.
Your own words, personal reminders and mood check-ins. If you leave anonymous analytics on, only the mood category you pick (for example "calm" or "anxious") is counted, never tied to you (see Section 7).
Your language, settings and preferences.
Your progress (streaks, points, habits), unless you choose to sign in and sync (see Section 3).

This data lives in the App's storage on your phone. Except for photos, it can be included in your device's own backup (iCloud on iPhone, Google backup on Android) if you have backups turned on, like other app data. Those backups are made and kept by Apple or Google under your account with them, not by us, and you control them in your device settings.

3. What we collect if you choose to sign in

Balum works without an account. Signing in is optional. You can sign in with Google or Apple, or with an email "magic link", to back up and sync across devices. If you do, we store with our hosting provider (Supabase):

Your name and email address, as provided by your sign-in provider (with the email option, just your email address; if you use Sign in with Apple and choose to hide your email, we receive only Apple's private relay address).
A user identifier for your account.
Your progress data: streaks, points/XP, badges, daily completions, and your saved bookmarks. Saved bookmarks are visible only to your account, including on a shared phone: when someone else signs in on it, or no one is signed in, they are not shown, and they are never added to another account.
Your Library notes on Balum content: the private notes you write on verses, hadith, du'as, lessons and other content, and which content they belong to, so they appear on every device you sign in on. They are visible only to your account, including on a shared phone: when someone else signs in on it, or no one is signed in, your Library notes and the photos you added to them are not shown. Notes you add to your Library on their own are not synced.

We never receive your password for any sign-in provider. When you sign in by email, we use Resend to send you the one-time sign-in email (see Section 9). Your journal, private du'a records, own words, reminders, mood check-ins, the notes you add to your Library on their own, and all photos stay on your device and are not synced.

4. How we use your information

We use the limited information above to:

provide and sync the App's features across your devices;
deliver reminders and notifications you enable (such as prayer-time reminders);
maintain security and prevent abuse; and
comply with our legal obligations.

We do not sell or rent your data, and we do not build advertising profiles of you or target ads based on what you do in the App. To measure how our own ads perform, the App tells Meta when it is installed and opened (see Section 9).

Business transfers. If Balum is involved in a merger, acquisition, financing, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you (for example, in the App or by email if you have an account) before any such transfer, and any successor will be bound by this Privacy Policy or will provide a policy at least as protective.

Legal bases (EEA / UK). Where the GDPR or UK GDPR applies, we rely on: performance of a contract to provide and sync your account features when you choose to sign in; your consent for any notifications you enable (which you can withdraw at any time); our legitimate interests in keeping Balum secure, diagnosing crashes, measuring our own advertising, and understanding anonymous, aggregate usage to improve the App (you can opt out of analytics at any time); and compliance with legal obligations where the law requires it.

5. Location and prayer times

To calculate prayer times and the Qiblah direction, the App needs your location: either from your device's location service, if you allow it, or from a city you search for.

Prayer times and the Qiblah direction are calculated on your device.
The App never sends your exact location to anyone. To show the name of your city, the App sends an approximate location (your position rounded to a grid square about 2 km across) or the city name you type to Photon, an OpenStreetMap search service run by komoot. When you look for nearby mosques, the same approximate location is sent to OpenStreetMap's Overpass service; the App then works out on your device which mosques are near you and how far away they are.
These requests carry no account, name or identifier, and we do not store your location on our servers.

6. Push notifications

Prayer-time and other reminders are scheduled on your device. If you allow notifications on iPhone, or in a web browser, we also store a push token for your device together with your language, time zone and when the App was last opened, so we can send you occasional announcements in your language at a sensible hour. We keep a record of which announcements were sent to which device so none is sent twice. You can turn notifications off at any time in your device settings.

7. Anonymous usage analytics

To understand how Balum is used and where we can improve it, we collect a small amount of anonymous usage data on our own hosting (Supabase). We do not use a third-party analytics provider for this.

It is tied to a random, per-install identifier, not to you, your name, your email, or your account. We do not store your IP address, a device fingerprint or your location in this data.
It records basic events: when the App is opened and for how long; which tabs and which Balum content (such as a surah, a hadith collection or a lesson) you open; which onboarding steps you reach; that a mood check-in, a Daily Peace session or a quiz was completed, including the mood category chosen; that you ticked something on the Today screen or a habit on the You screen, never what was ticked; whether setting your location worked and, if not, the kind of problem, never the location itself; whether notifications are allowed and how many prayer reminders are scheduled; notification taps and which screen they open; whether a nearby-mosques search succeeded; the App version and build number, platform, the App's language, local hour and your device's offset from UTC (for example "UTC+7", which many countries share; not your time zone's name and not your location); and how you found Balum (the campaign tags of the ad or link you followed, Google Play's install referrer on Android, and on iPhone whether the install came from an Apple Search Ads campaign, which the App asks Apple about). We do not record your journal, your messages, or anything you write.
We use it only in aggregate, for example "how many people return after 7 days" or "where people stop during onboarding", to make the App better.

Your choice: because it is anonymous, this is on by default, but you can turn it off at any time under Profile → "Share anonymous usage data." Turning it off stops collection and forgets the random identifier.

8. Crash and error reporting

To find and fix problems, the App (on iPhone, Android and the web) reports crashes and errors to Sentry, a crash-reporting service. A report contains technical diagnostic data: the type of error and where in the App's code it happened, the device and operating-system type, the App version, and a short error code. It is not linked to your account and does not include your journal or anything else you write.

9. Third-party services

We rely on a small number of service providers that process data on our behalf:

Google and Apple, for optional sign-in, if you choose one of them. See each provider's own privacy policy.
Resend, to deliver the email "magic link" when you choose to sign in by email. It processes your email address only to send that message. See Resend's Privacy Policy.
Supabase, for secure hosting and storage of synced account data, push tokens and our own anonymous analytics. See Supabase's Privacy Policy.
Sentry, for crash and error reporting (see Section 8). See Sentry's Privacy Policy.
Capgo, to deliver over-the-air app updates (bug fixes and content). When the App checks for an update it sends your device's app version, platform, and a random device identifier, not your name, email, or account. See Capgo's Privacy Policy.
Photon (komoot) and OpenStreetMap, for city search, naming your location and finding nearby mosques (see Section 5).
Content services. Qur'an text and audio and some other content are downloaded from public content services (Islamic Network, AlQuran Cloud and jsDelivr), and some fonts from Google Fonts. Like any website, they receive your device's IP address when the App downloads from them.
RevenueCat, for optional in-app purchases, if and when we offer them. None are offered today, and until then the App does not contact RevenueCat. When a purchase is offered, the payment is handled by Apple or Google; RevenueCat receives a random app user identifier (and your account identifier, if you are signed in), the store's receipt and your device type, to confirm and restore your purchase. We never receive your payment details.

These providers are bound to handle data only as needed to provide their services.

Advertising cookie (our website only). On our website balum.app, which is separate from the App, we offer a Meta (Facebook) advertising pixel that measures how our ads perform and helps us reach similar audiences. It loads only if you choose "Accept" on our cookie banner; if you decline, no pixel is loaded and nothing is sent to Meta. You can revisit the choice by clearing your browser's stored data for balum.app. See Meta's Privacy Policy.

Advertising measurement (the App). To measure the ads we run to introduce people to Balum, the App includes Meta's SDK, which tells Meta when the App is installed and opened. It does not send anything you do inside the App: nothing you type, read, or save. On iOS the App does not ask to track you and Meta receives no advertising identifier; results reach us through Apple's privacy-preserving SKAdNetwork. On Android these events include your device's advertising ID, which you can reset or delete in your device's Google settings. We use the results only to understand which of our own ads work, never to profile you or target ads based on your activity in the App. See Meta's Privacy Policy.

10. Data retention and deletion

On-device data, including Library photos, is removed when you delete the App (or a photo, when you delete it in the Library). When you delete your account in the App, and only once our servers have confirmed the deletion, the App also removes from this phone the Library notes and saved bookmarks that belonged to that account and the photos you added to those notes. What belongs to the phone rather than to an account stays until you delete it there: your Journal and its photos, and the notes and photos you added to your Library on their own.
Synced account data is kept while your account exists. You can delete your account in the App (open your profile, then "Delete account"): this permanently deletes your account and everything synced to it from our servers, including your Library notes and your devices' push tokens and their announcement records. If deletion cannot finish, nothing is half-deleted: your account stays as it was and you can simply try again. You can also ask us by emailing [email protected].
Anonymous analytics are not linked to your account, so deleting your account does not affect them. Turning analytics off stops collection and forgets the random identifier.
Error reports are kept by Sentry for a limited period and then deleted automatically.

11. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit. No method of transmission or storage is completely secure.

12. Children

Balum is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. International transfers

Our service providers may process data in countries other than yours. Where required, we rely on appropriate safeguards for such transfers.

14. Your rights

Depending on where you live (for example under the GDPR or similar laws), you may have rights to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact [email protected]. You may also have the right to lodge a complaint with your local data-protection authority.

California residents. We have collected the categories of personal information described above: identifiers (such as your name, email, and a user identifier, if you choose to sign in, and on Android your device's advertising ID for ad measurement) and internet or other electronic activity (anonymous usage analytics). We do not sell your personal information. Subject to applicable limits, you have the right to know about, access, correct, and delete your personal information, and not to be discriminated against for exercising these rights. To make a request, contact [email protected].

15. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date and, where appropriate, notify you in the App.

16. Contact

Balum · Email: [email protected]