PRIVACY
Privacy Policy
Last updated: September 27, 2026
Istiqama is built by SYZi Labs, based in Jakarta, Indonesia. This page explains what we collect to run the app, who else ever sees it, and the choices you have. The short version: no ads, no analytics inside the app itself, no selling your data — and you can export or delete everything yourself, any time.
Information we collect
Account details you give us: your email, display name, and either a password we only ever store as a salted hash — we cannot read it, and neither can anyone who gets access to our database — or, if you sign in with Google instead, no password at all: we just record that your Google account is linked. Location and preferences: the city and coordinates you set (used to calculate accurate prayer times for where you are), your calculation method, madhab, and high-latitude rule, your timezone, and your language. Worship data you choose to record: your prayer logs and any private journal entries you write — these exist so the app can show your own consistency back to you, nothing more. Notifications: your reminder preferences and, if you enable push notifications, the browser-issued subscription endpoint needed to deliver them. Billing: if you buy a Pro plan, a reference to that purchase and its status — your card or e-wallet details are handled directly by Midtrans and never reach our servers.
How we use it
To calculate prayer times for your location, to log and show your own worship history back to you, to send the reminders you asked for, to process a Pro purchase you make, and to keep the service secure and working. Nothing here is used to build an advertising profile, because we don't have one.
Who else sees it
Resend delivers our verification and password-reset emails, and sees the email address needed to send them. If you sign in with Google, Google confirms your identity to us and we receive your email and display name from it — we never see or store your Google password. Midtrans processes Pro plan payments and sees whatever payment details you give it directly — we only ever see that a purchase happened, not your card number. Have I Been Pwned checks whether a password you're choosing has appeared in a known data breach, for accounts that set one; it uses k-anonymity, so only the first five characters of a hashed version of your password are ever sent — never the password itself, never in a form anyone could reverse. If error monitoring (Sentry) is enabled for the environment you're using, it receives details about crashes and unexpected errors so we can fix them, with coordinates and email addresses stripped before the event ever leaves our own code — see "Error monitoring" below. Our public marketing pages (this page included, but never the signed-in app) may load Plausible, a privacy-respecting analytics tool that doesn't use cookies, doesn't collect personal data, and can't identify you individually — it only ever sees anonymous, aggregated page-visit counts. We do not sell, rent, or otherwise share your data with anyone else.
Error monitoring
When Sentry is configured for an environment, our own scrubbing step strips latitude, longitude, and email addresses from every error event before it's sent — verified directly against how the Sentry integration we use actually populates an event, not assumed. Sentry is off by default and stays off unless we've explicitly turned it on for that environment.
Data retention
Your data is kept for as long as your account exists. Deleting your account (Settings → Account → Delete account) removes your account and everything linked to it — prayer logs, journal entries, notification preferences, push subscriptions — immediately. Our database backups are kept on a rolling schedule (7 daily, 4 weekly) for disaster recovery only, so a copy of deleted data can persist in a backup for up to that window before it's fully gone.
Cookies and local storage
There's no cookie-consent banner on this site, and here's exactly why: everything below is either strictly necessary to keep you signed in and using the app the way you left it, or a preference you set yourself. Our public marketing pages may load Plausible for anonymous visit analytics (see "Who else sees it" above), but it sets no cookie and writes nothing to local storage, so it has no row in this table. There is no advertising pixel and no third-party tracking cookie anywhere in Istiqama. Under GDPR and the ePrivacy Directive, storage like this doesn't need prior consent — only clear disclosure, which is what this table is.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| refresh_token | HTTP-only cookie | Keeps you signed in between visits | 30 days |
| NEXT_LOCALE | Cookie | Remembers your chosen language | 1 year |
| theme | Local storage | Remembers light, dark, or system appearance | Until you clear your browser data |
| dashboard.installCardDismissed | Local storage | Remembers that you dismissed the install-the-app prompt | Until you clear your browser data |
| dashboard.notificationsCardDismissed | Local storage | Remembers that you dismissed the notification-permission prompt | Until you clear your browser data |
| istiqama:today-panels | Local storage | Remembers which panels you've collapsed on your Today view | Until you clear your browser data |
| settings.travelBannerDismissed | Session storage | Remembers that you dismissed the high-latitude prayer-time notice | Until you close the tab |
| istiqama:demo-mode | Local storage (development builds only) | Flags a demo account for internal testing | Until you clear your browser data |
Your rights
You don't need to email us for most of this — it's self-service, right now, in the product:
- Access & export: download a full copy of your account, prayer logs, and journal entries from Settings → Account → Export data.
- Correction: update your email, display name, location, and preferences directly in Settings.
- Deletion: delete your account and everything linked to it from Settings → Account → Delete account.
- Anything else: email us and we'll respond — including any request under a right not listed above.
Questions
Reach us at contact@syairozi.com.