Privacy Policy

Effective: 6 August 2026  ·  Version: 2026-08-06

Suhbah is a Muslim-friendly social map for halal food, prayer-friendly places, masjids, creator guides and local gatherings. This policy explains, in plain language, exactly what personal information we collect, why, who it goes to, how long we keep it, and how you get rid of it. Where the honest answer is uncomfortable, we've written the honest answer.

1. Who we are

Suhbah is operated by SMughal Labs LLC, a New Jersey limited liability company ("Suhbah", "we", "us"). For the purposes of the EU and UK GDPR, SMughal Labs LLC is the data controller for the personal information described here.

This policy covers the Suhbah mobile and web apps, the suhbah.app website, and the email waitlist. It does not cover independent businesses, masjids, event hosts or other websites you reach through Suhbah — see section 16.

Questions, requests or complaints: saad@smughal.com.

2. The short version

3. You must be 18 or older

Suhbah is for adults. You must be at least 18 to create an account. We ask for your date of birth at signup and enforce the age requirement on our servers, not merely in the app — an under-18 signup is rejected outright and no account is created.

We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email saad@smughal.com and we will delete it.

4. What we collect

4.1 Account and identity

• Email address — your login identifier and how we send account email.
• Password — stored only as a salted hash by our authentication provider. We never see or store your plaintext password.
• Display name and @username.
• Date of birth — the exact date, used to enforce the 18+ rule. It is stored separately from your public profile and is not shown to anyone.
• Gender — male, female, or "prefer not to say". Stored separately from your public profile.
• City — the metro area you choose, so we can show relevant places.
• Consent records — which agreements you accepted, which version, and when. This is an append-only ledger: we keep it so that "what did I agree to, and when" always has an answer.

4.2 If you sign in with Google or Apple

We receive your name, email address and profile picture from the provider. If you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead of your real one, and that works fine — we never need the real one. We do not receive your password or any other data from your Google or Apple account.

4.3 Optional profile details

Anything you choose to add: bio, pronouns, avatar and cover image, links, hometown, the month and day you want shown as your birthday, languages, education, work, relationship status. All optional, all editable, all deletable, and all public unless you set your profile to private.

4.4 Content you create

Reviews and tips, ratings, photos and videos, community and profile posts, comments and reactions, guides and lists, menus you contribute, halal evidence you submit (including certificates or documents you upload), places you submit, events you host, RSVPs and check-ins, poll votes, and answers to host questions.

Uploaded photos and videos may contain metadata such as the time and place a photo was taken. Please strip it first if that matters to you.

4.5 Messages — read this one

4.6 Your social graph and activity

Who you follow and who follows you, communities you join, places and guides you save, accounts you block, events you RSVP to and check into, and reputation events earned from contributing.

4.7 Location

• Device location is requested only while you are using the app, and only when you tap something that needs it (like "near me"). We request approximate accuracy, not the highest-precision mode. Your coordinates are used to sort and filter results on the spot and are never written to our servers or database. We never request background location.
• Places you choose — the address, coordinates and details of a venue you pick for an event or profile are stored, because that's the point of the listing.
• Saved and recent locations — including any you label "home", "work", "mosque" or "community" — are stored only on your device. They are never uploaded to us.
• City — the metro area you select is stored with your account.

4.8 Device and technical data

• Push notification token and the platform (iOS, Android, web), so we can deliver notifications you've asked for.
• IP address, user agent and request logs — recorded by our hosting and database providers whenever your app or browser contacts our servers. These are used for security, abuse prevention, debugging and rate limiting, and are retained for a short period. Some administrative actions are also recorded in our audit log.
• Audit records of security- and moderation-relevant actions: who did what, to what, and when.

4.9 How you use Suhbah

We record first-party product events — for example "viewed a place", "saved a guide", "opened a gathering" — together with the city and the type of thing acted on, to rank the feed, improve recommendations and understand which features earn their place.

There is no third-party analytics or advertising SDK in Suhbah. No Google Analytics, no Firebase Analytics, no Meta SDK, no Segment, no Mixpanel, no advertising identifier, no cross-app or cross-site tracking. We do not collect precise location or sensitive community signals into product analytics.

4.10 Payments

Ticket purchases, donations and subscriptions are processed by Stripe on Stripe's own hosted checkout. Your card number, CVC, expiry and billing address never touch our servers or database. What we store is the record of the transaction: Stripe's payment, session, customer and subscription identifiers, the amounts, the ticket or product purchased, the name shown on the order or ticket, and any check-in code. Stripe handles your payment details under its own privacy policy.

4.11 Support, claims and reports

If you submit a place, claim a business or masjid, report content, or contact us, we keep what you send — including any contact email, supporting notes and documents, and, where you report a message or post, a copy of the reported content so it can actually be reviewed.

4.12 The website waitlist

If you enter your email on suhbah.app, it is submitted to a waitlist service operated by SMughal Labs LLC at smughal.com and stored in a shared waitlist list alongside signups from our other pages, tagged with its source. We use it only to tell you when Suhbah is ready. Every email we send has an unsubscribe link, or you can email saad@smughal.com to be removed. The site itself sets no advertising or analytics cookies.

5. Religious and other sensitive data

Suhbah is built for Muslim users. Using it — searching for halal food, filtering for prayer-friendly venues, following a masjid, attending a gathering — can reveal something about your religious beliefs. Under the EU/UK GDPR this is a "special category" of personal data, and that protection applies whether you tell us directly or it can be inferred from how you use the app.

We take that seriously:

• Our legal basis for processing this data is your explicit consent, given when you create your account and continued by your use of the app. You can withdraw it at any time by deleting your account.
• We do not use religious signals to build advertising profiles — there is no advertising in Suhbah.
• We deliberately exclude sensitive-community signals and precise location from our product analytics.
• Your date of birth and gender are not published on your profile and are not visible to other members.
• Gender is used for account integrity and to respect the gender context a host sets on a gathering. It is not used to target you.

6. How we use your information, and our legal basis

Where we rely on consent, you can withdraw it at any time — that doesn't affect processing we already did lawfully. Where we rely on legitimate interests, we've weighed those against your rights, and you can object (see section 11).

We do not use your personal information to train machine-learning models for anyone outside Suhbah, and we do not sell it.

7. What's public, and what isn't

This section matters more than most people expect, so it's explicit.

Visible to anyone, including people who aren't signed in

• Your display name, @username, avatar, bio, city and join date
• Your public posts, comments, reviews, tips, ratings, photos, guides and public lists
• Gatherings you host, and public community activity
• Your reputation history — the contributions that earned you standing
• Event check-ins — that you attended a gathering
• Follower and following counts

Not public

• Your email address — never shown to other members
• Your date of birth and gender
• Your direct and group messages (but see section 4.5)
• Saved places and guides, and your saved or labelled locations
• Accounts you've blocked
• Your payment records and purchase history
• Reports you file, and the outcome of moderation
• Your device location

Setting your profile to private restricts who can see your profile content. It does not retroactively unpublish things you already posted in public communities, and it does not hide aggregate counts.

Anything you post publicly can be seen, screenshotted, copied and re-shared by other people. We can remove it from Suhbah; we cannot remove it from someone's camera roll.

8. Who we share information with

We do not sell your personal information. We share it only as follows.

8.1 Other members

As described in section 7, and with people you message or whose gatherings you join.

8.2 Service providers (subprocessors)

Companies that run parts of Suhbah on our behalf, under contract, and only for the purposes we set:

8.3 Legal and safety

We may disclose information where we reasonably believe it's required by law or valid legal process, or necessary to investigate a violation of our terms, to protect the rights, property or safety of our members, the public or Suhbah, or to prevent fraud or imminent harm. We aim to notify you of a legal demand for your data unless we're legally prohibited from doing so.

8.4 Business transfers

If Suhbah is acquired, merged, or its assets sold, your information may transfer as part of that deal. We'll notify you before it becomes subject to a materially different policy.

9. How long we keep it

We keep your account information for as long as your account exists. After that:

Deleted data may persist briefly in encrypted backups before those backups age out on their normal cycle.

10. Deleting your account

You can delete your Suhbah account and its data at any time. You do not need to ask us.

In the app

1. Open Suhbah and go to Profile → Settings.
2. Select Delete account.
3. Confirm by typing DELETE.

This is irreversible. Your uploaded files are removed from storage first, then your account and its data are erased, subject only to the narrow exceptions in section 9. It is a genuine erasure, not a hidden or frozen account.

By email

If you can't reach the app — you've lost your device, or you can't sign in — email saad@smughal.com from the address on your account with the subject "Delete my account". We'll verify it's you and complete the deletion within 30 days.

Just want a break?

Deactivating hides your profile and content without deleting anything, and is reversible — signing back in restores your account. Deleting is not.

11. Your privacy rights

Wherever you live, you can ask us to access, correct, delete or export your information — email saad@smughal.com. We respond within 30 days (45 days for California requests, extendable where the law allows).

Suhbah also has a built-in export under Settings → Export my data, which produces a JSON file of your profile, preferences, saved guides, blocked accounts, business profiles and notification settings. It doesn't yet include your posts, reviews, messages or RSVPs — for a complete copy, email us and we'll assemble it.

If you're in the EU, UK or Switzerland (GDPR)

You have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased ("right to be forgotten")
• restrict how we process it
• object to processing based on legitimate interests, including profiling
• receive your data in a portable, machine-readable format
• withdraw consent at any time, without affecting prior lawful processing
• lodge a complaint with your national data protection authority — and we'd appreciate the chance to fix it first

If you're in California (CCPA/CPRA)

In the past 12 months we have collected the categories described in section 4: identifiers, customer records, commercial information, internet and network activity, approximate geolocation, audio/visual information (photos and videos you upload), and — with your consent — sensitive personal information in the form of religious beliefs. Sources, purposes and recipients are in sections 4, 6 and 8.

You have the right to:

• Know what we collect, use, disclose and (if we did) sell
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of, and we honour Global Privacy Control signals regardless
• Limit the use of sensitive personal information — we use it only to provide the service you asked for, which is within the permitted purposes
• Not be discriminated against for exercising any of these rights. We don't.

You may use an authorised agent, with written permission and verification of your identity.

Other US states

If you live in a state with a comprehensive privacy law — Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others — you have broadly equivalent rights to access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale, and certain profiling. We do not conduct targeted advertising or sell data. Some states allow you to appeal a refused request; if we refuse yours, our response will tell you how.

12. International data transfers

Suhbah is operated from the United States and our database and files are hosted in the United States. If you use Suhbah from outside the US, your information will be transferred to and processed there, under laws that may differ from your own.

For transfers of personal data out of the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our providers, together with the technical measures in section 13.

13. How we protect your information

Security is designed in rather than added on. In particular:

• All traffic is encrypted in transit with TLS, and data is encrypted at rest.
• Every database table enforces row-level security, so authorisation is applied by the database itself rather than trusted from the app. The app cannot grant itself access it shouldn't have.
• Privileged operations run through narrowly-scoped server-side routines with least-privilege access. Tables with no legitimate client access are held in a schema the public API cannot reach at all.
• Your app never talks to our database host directly; requests are proxied through our own domain, and API keys for third-party services stay server-side.
• Administrative and moderation actions are audit-logged.
• Two-factor authentication is available in Settings → Security. Please turn it on.

No service can promise perfect security, and we won't. If a breach affects your personal data, we'll notify you and the relevant regulators as the law requires.

14. Cookies and on-device storage

The suhbah.app website sets no advertising or analytics cookies. There is no consent banner because there is nothing to consent to.

The Suhbah app stores data locally on your device — your login session, preferences, appearance settings, recent and saved locations, and cached content — so the app works quickly and stays signed in. On the web this uses your browser's local storage; on mobile it uses the device's app storage. It is cleared when you sign out or uninstall the app.

15. Push notifications

If you allow notifications, we store a push token for your device so we can deliver them. Notifications tell you about messages, follows, RSVPs, community activity and gatherings.

Control which types you receive in Settings → Notifications, or turn them off entirely in your device settings. Turning them off in the OS doesn't stop us from storing the token; deleting your account does, and so does signing out.

16. Links, venues and other people

Suhbah lists independent restaurants, cafés, masjids and other venues, and links to external websites, social profiles and ticket pages. We don't control those places or sites and this policy doesn't cover them.

When you attend a gathering, the host may see your name and that you RSVP'd or checked in. Hosts are independent of Suhbah and are responsible for their own handling of that information.

Halal status, alcohol and smoking flags, prayer facilities and similar attributes in Suhbah are largely community-reported. We show a confidence level rather than asserting a fact, and you should verify anything that matters to you directly with the venue.

17. Changes to this policy

We'll update this policy as Suhbah changes — end-to-end encryption for messages is the next material change we expect to make. When we make a significant change we'll update the version stamp at the top, notify you in the app or by email, and, where the change requires it, ask you to accept the new version.

Because we record which version of this policy you accepted and when, "what was I agreeing to at the time?" always has an answer.

18. Contact us

For any privacy question, request or complaint — access, correction, deletion, export, or withdrawing consent:

SMughal Labs LLC
Email: saad@smughal.com
Please put "Privacy request" in the subject line so it gets routed quickly.

See also our Terms of Service and Community Guidelines.