🔒

Privacy Policy

Effective: September 27, 2026

Who we are

SalahSync (the "Service," available at app.salahsync.io) is operated by Simple Cortex ("Simple Cortex," "we," "us," or "our"), based in Virginia, USA. This policy explains what information we collect, where it comes from, how we use and disclose it, how long we keep it, and the choices you have. Simple Cortex is the controller of the personal information described in this policy. For privacy questions or to exercise any of the rights described below, email privacy@salahsync.io. For general support, email support@salahsync.io.

What SalahSync does

SalahSync calculates Islamic prayer times for your location and creates, updates, and reschedules prayer events on your Google Calendar around your existing commitments. It runs an automated weekly scheduling pass so your calendar stays current without manual upkeep.

Information we collect

Account information: your Google account identifier and email address (plus your name and profile image if Google includes them), which we receive from Google when you sign in and use to create and secure your account and communicate with you about the Service.
Google OAuth tokens: access and refresh tokens issued when you connect your Google account, encrypted at rest, so SalahSync can act on your calendar between visits.
Location and timezone: coordinates, a city or address you provide or choose to obtain from your device, and your timezone. We use these details to calculate prayer times, identify your city, and, when you use Friday-prayer features, find nearby mosques. We do not collect device location in the background.
Prayer and scheduling preferences: your chosen calculation method and related settings, mosque preferences, and records of prayer events SalahSync schedules or reschedules.
Subscription status: your current plan (Free, Standard, or Premium) and whether it is active. Payment itself is handled by our payment processor, described below — we do not receive or store your card number.
Usage and technical information: an internal account identifier, product actions, feature-flag assignments, browser or device information, IP address, request metadata, and diagnostic and error information. We use this information to operate, secure, analyze, and troubleshoot the Service.

We collect information from you, from your browser or device when you use the Service, from Google when you authorize access, and from the service providers described below. If you do not provide information needed for a feature, that feature may not work.

Google user data we access

When you connect your Google account, SalahSync requests the following OAuth scopes, each limited to a specific purpose:

calendar.events — to create, update, and delete the prayer events that SalahSync has scheduled and to store the identifiers and scheduling details needed to manage those events. We do not create, modify, or delete your other calendar events.
calendar.freebusy — to check when you are busy so we can schedule prayers around conflicts. This scope returns only free/busy blocks of time, never the titles, descriptions, or attendees of your other events.
userinfo.email — to identify your Google account and sign you in.

You can review or revoke SalahSync's access to your Google account at any time from myaccount.google.com/permissions. Revoking access stops future calendar access and scheduling. Prayer events already on your calendar remain there unless you delete them. You may also delete your SalahSync account as described below; disconnecting Google alone does not delete your SalahSync account data.

Google API Services User Data Policy

SalahSync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, we use Google user data only to provide or improve the user-facing features described above. We never sell your Google user data; we never use it for advertising or ad targeting, determining creditworthiness, or surveillance; and we never use it to train generalized artificial intelligence or machine learning models. We do not allow a human to read Google user data unless we have your explicit consent to view specific data, the data is aggregated and anonymized for lawful internal operations, access is necessary for security or abuse investigation, or access is required by law. We transfer Google user data only to service providers as necessary to provide or improve these features, for security, to comply with law, or as otherwise permitted by Google's Limited Use requirements with the required consent.

How we use your information

We use the information above to calculate prayer times, schedule and reschedule prayer events on your calendar, avoid conflicts with your other commitments, run your weekly scheduling pass, manage your subscription, secure your account, and diagnose problems with the Service. We also use limited technical and usage information to prevent fraud and abuse, protect users, analyze performance, troubleshoot errors, comply with law, and enforce our Terms of Service. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.

Legal bases for processing

Where the GDPR or UK GDPR applies, we process account information, Google user data, location, preferences, and subscription status as necessary to provide the Service you request and perform our contract with you. We process security, diagnostic, and limited analytics information for our legitimate interests in keeping SalahSync safe, reliable, and useful, after considering your rights. We process information to comply with legal obligations when required. Where law requires consent, including for access to Google data or precise location, we rely on your consent, which you may withdraw at any time without affecting earlier lawful processing.

Service providers we use

We disclose personal information to the following categories of recipients to operate SalahSync. They may process information for us or, where stated, under their own terms and privacy notices.

Supabase (United States) — our database, authentication, and realtime infrastructure.
Google Cloud Run (United States) — hosts our backend application.
Cloudflare — content delivery network, DNS, and hosting for the SalahSync web app.
Upstash — caches prayer-time calculations by coordinates rounded to four decimal places, calculation method, and date. The cache key does not include your account identifier.
Sentry — diagnostic and error monitoring used to find and fix bugs.
PostHog — product analytics, identified only by an internal, random user ID. PostHog never receives your email address, calendar contents, or precise coordinates, and we do not enable session recording or automatic event capture.
Lemon Squeezy — our payment processor and merchant of record for paid subscriptions. Lemon Squeezy handles your payment details directly; we never receive or store your full card number.
AlAdhan — receives coordinates, calculation method, and date when we request prayer-time calculations; SalahSync uses a local calculation if AlAdhan is unavailable.
Google — Google Sign-In and Calendar APIs as described above, plus Google Places for address lookup and nearby-mosque features.
OpenStreetMap Nominatim — receives coordinates when you ask SalahSync to identify a city or address from a location.

We may also disclose information when reasonably necessary to comply with law, protect rights and safety, investigate fraud or abuse, or complete a merger, financing, acquisition, bankruptcy, or sale of assets subject to applicable law and Google's Limited Use requirements. We do not sell personal information, share it for cross-context behavioral advertising, process it for targeted advertising, or offer financial incentives for personal information.

Cookies and local storage

We use essential cookies to keep you signed in and to protect the Service with cross-site request forgery (CSRF) protection. Our analytics run through your browser's local storage rather than tracking cookies. PostHog assigns analytics identifiers, records page views and the product actions we choose to send, and respects the Do Not Track browser setting. We disable session recording and automatic event capture. We do not use third-party advertising cookies.

Security and international transfers

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption of Google OAuth tokens at rest. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We and our providers process information in the United States and may process it in other countries where they operate. Where applicable law requires a transfer mechanism, we rely on the safeguards in our providers' data processing terms, such as Standard Contractual Clauses.

Data retention and deletion

We keep account information, OAuth tokens, settings, scheduling records, and subscription status while your account is active. Prayer-time cache entries expire after 24 hours; server logs are kept for about 30 days; error reports for up to 90 days; and analytics events for up to one year. Security and transaction records are kept only as long as reasonably necessary for the purposes described above. If you delete your account from the app or by emailing privacy@salahsync.io — we revoke stored Google authorization where practicable and delete or de-identify personal information under our control within 30 days, except information retained in backups until overwritten and records we must or may retain to comply with law, resolve disputes, prevent fraud or abuse, or enforce agreements. Lemon Squeezy retains payment records under its own obligations as merchant of record. Deleting SalahSync does not delete prayer events already placed on your Google Calendar.

Your privacy rights

If you are a Virginia resident, the Virginia Consumer Data Protection Act (VCDPA) gives you the right to:

confirm whether we process your personal data and access it;
correct inaccuracies in your personal data;
delete your personal data;
obtain a portable copy of your personal data in a usable format; and
opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects — we do not engage in any of these, so there is nothing to opt out of today.

We will not discriminate against you for exercising a privacy right. An authorized agent may submit a request where applicable law permits, subject to verification of the agent's authority and your identity.

California residents may have rights under the CCPA to know and access categories and specific pieces of personal information, delete or correct it, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing. We do not sell or share personal information or use sensitive personal information for purposes that require a right to limit under the CCPA.

If the GDPR or UK GDPR applies, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent, and complain to the data protection authority where you live, work, or believe a violation occurred. These rights are subject to legal conditions and exceptions.

To exercise any of these rights, email privacy@salahsync.io. You do not need to create a new account to submit a request. We may ask for information reasonably needed to verify your identity and authority, and we will respond within the time required by applicable law. Virginia residents may appeal a decision by emailing the same address with the subject line "Privacy Appeal." We will decide the appeal within 60 days and explain our decision. If we deny the appeal, you may submit a complaint to the Virginia Attorney General.

Children's privacy

SalahSync is a general-audience service and is not directed to children under 13. You must be at least 13 to use it. We do not knowingly collect personal information from a child under 13 and do not seek parental consent to do so. Users under the age of legal majority where they live may use the Service only with permission from a parent or legal guardian. If you believe a child under 13 has provided us personal information, contact privacy@salahsync.io and we will investigate and delete it as required by COPPA and other applicable law.

Changes to this policy

We may update this policy as SalahSync evolves. We will post the revised policy and update the effective date above. If a change materially affects how we use personal information, we will provide any additional notice or request any consent required by law. Before using Google user data for a new purpose, we will update our disclosures and obtain consent as required by Google's policies.

Contact us

For privacy questions or to exercise your rights, email privacy@salahsync.io. For general support, email support@salahsync.io.