Privacy Policy

Effective: 21 September 2026  ·  Version: 2026-09-21

Suhbah is a Muslim-friendly social map for halal food, prayer-friendly places, masjids, creator guides and local gatherings. This policy explains, in plain language, exactly what personal information we collect, why, who it receives it, how long we retain it, and how to request its deletion.

1. Who we are

Suhbah is operated by SMughal Labs LLC, a New Jersey limited liability company ("Suhbah", "we", "us"). For the purposes of the EU and UK GDPR, SMughal Labs LLC is the data controller for the personal information described here.

This policy covers the Suhbah iPhone and Android app, the suhbah.app website, and the email waitlist. It does not cover independent businesses, masjids, event hosts or other websites you reach through Suhbah — see section 15.

Questions, requests or complaints: privacy@smughal.com.

2. The short version

3. You must be 18 or older

Suhbah is for adults. You must be at least 18 to create an account. We ask for your date of birth at signup and enforce the age requirement on our servers, not merely in the app — an under-18 signup is rejected outright and no account is created.

We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email privacy@smughal.com and we will delete it.

4. What we collect

Suhbah does not collect your religion. There is no religion field on your profile and we do not derive one from your use of the Service. Where a gathering is described as being for brothers, sisters, families or a mixed audience, that description is supplied by its host and applies to the gathering; it is not matched against any information about you.

4.1 Account and identity

• Email address — your login identifier and how we send account email.
• Password — stored only as a salted hash by our authentication provider. We never see or store your plaintext password.
• Display name and @username.
• Date of birth — the exact date, used to enforce the 18+ rule. It is stored separately from your public profile and is not shown to anyone.
• City — the metro area you choose, so we can show relevant places.
• Consent records — which agreements you accepted, which version, and when. This is an append-only ledger: we keep it so that "what did I agree to, and when" always has an answer.

4.2 If you sign in with Google or Apple

We receive your name, email address and profile picture from the provider. If you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead of your real one, and that works fine — we never need the real one. We do not receive your password or any other data from your Google or Apple account.

4.3 Optional profile details

Anything you choose to add: bio, pronouns, avatar and cover image, links, hometown, the month and day you want shown as your birthday, languages, education, work, relationship status. All optional, all editable, all deletable, and all public unless you set your profile to private.

4.4 Content you create

Reviews and tips, ratings, photos and videos, community and profile posts, comments and reactions, guides and lists, menus you contribute, halal evidence you submit (including certificates or documents you upload), places you submit, events you host, RSVPs and check-ins, poll votes, and answers to host questions.

Uploaded photos and videos may contain metadata such as the time and place a photo was taken. You may wish to remove it before uploading.

4.5 Messages

Direct and group messages are encrypted in transit and encrypted at rest. Message content is stored in a form our systems can process, and a limited number of authorized personnel may access it where necessary to investigate a report, comply with a legal obligation, or operate and maintain the Service.

When you edit or delete a message, the earlier version is retained for a limited period for safety and moderation purposes, and is removed when your account is erased. Chats attached to public events and communities are moderated spaces and remain accessible to their moderators.

4.6 Your social graph and activity

Who you follow and who follows you, communities you join, places and guides you save, accounts you block, events you RSVP to and check into, and reputation events earned from contributing.

4.7 Location

• Device location is requested only while you are using the app, and only when you tap something that needs it (like "near me"). It is accurate enough to rank places a few blocks from you, which several US state privacy laws describe as precise geolocation and treat as sensitive personal information — so rather than call it "approximate", we tell you exactly what happens to it. Your coordinates are used to sort and filter the results in front of you and are never written to our servers or database, never retained, never used for advertising or profiling, and never sold or shared. We never request background location. You can turn location off at any time in your iOS or Android privacy settings; the app keeps working, you just choose a city instead.
• Places you choose — the address, coordinates and details of a venue you pick for an event or profile are stored, because that's the point of the listing.
• Saved and recent locations — including any you label "home", "work", "mosque" or "community" — are stored only on your device. They are never uploaded to us.
• City — the metro area you select is stored with your account.

4.8 Device and technical data

• Push notification token and the platform (iOS or Android), so we can deliver notifications you've asked for.
• IP address, user agent and request logs — recorded by our hosting and database providers when the app contacts our servers, and used for security, abuse prevention, debugging and rate limiting. An IP address can indicate your approximate area, typically your city, whether or not you have granted location permission. We do not use it to build a location history, and it is not used in product analytics or recommendations.
• Security records. We maintain a record of sign-ins, account changes and payment events. Each entry contains your user identifier, the IP address the request originated from, and the device or browser identifier. These records contain no email address and no name: the log identifies you by your account identifier and the IP address, and nothing else about you. They are used to detect and investigate fraud, abuse and unauthorized access to accounts. They are retained for up to 12 months and are not deleted when an account is deleted; the retention period, rather than a deletion request, is what limits them. See section 8.
• Audit records of security- and moderation-relevant actions: who did what, to what, and when.

4.9 How you use Suhbah

We record first-party product events — for example "viewed a place", "saved a guide", "opened a gathering" — together with the city and the type of thing acted on, to rank the feed, improve recommendations and understand which features earn their place.

There is no advertising SDK and no third-party product-analytics SDK in Suhbah. No Google Analytics, no Firebase Analytics, no Meta SDK, no Segment, no Mixpanel, no advertising identifier, no cross-app or cross-site tracking. The only third-party SDKs in the app are the ones that take payments, sign you in and deliver push notifications — every one of them is named in section 7.2. Your coordinates never enter product analytics: a usage event records the city and the kind of thing you acted on, not where you were standing.

4.10 Payments

Ticket purchases, donations and subscriptions are processed by Stripe on Stripe's own hosted checkout. Your card number, CVC, expiry and billing address never touch our servers or database. What we store is the record of the transaction: Stripe's payment, session, customer and subscription identifiers, the amounts, the ticket or product purchased, the name shown on the order or ticket, and any check-in code. Stripe handles your payment details under its own privacy policy.

4.11 Support, claims and reports

If you submit a place, claim a business or masjid, report content, or contact us, we keep what you send — including any contact email, supporting notes and documents, and, where you report a message or post, a copy of the reported content so it can actually be reviewed.

4.12 The website waitlist

If you enter your email on suhbah.app, it is submitted to a waitlist service operated by SMughal Labs LLC at smughal.com and stored in a shared waitlist list alongside signups from our other pages, tagged with its source. We use it only to tell you when Suhbah is ready. Every email we send has an unsubscribe link, or you can email privacy@smughal.com to be removed. The site itself sets no advertising or analytics cookies.

5. How we use your information, and our legal basis

Where we rely on consent, you can withdraw it at any time — that doesn't affect processing we already did lawfully. Where we rely on legitimate interests, we've weighed those against your rights, and you can object (see section 10).

We do not use your personal information to train machine-learning models for anyone outside Suhbah, and we do not sell it.

6. What's public, and what isn't

This section matters more than most people expect, so it's explicit.

Visible to anyone, including people who aren't signed in

• Your display name, @username, avatar, bio, city and join date
• Your public posts, comments, reviews, tips, ratings, photos, guides and public lists
• Gatherings you host, and public community activity
• Your reputation history — the contributions that earned you standing
• Event check-ins — that you attended a gathering
• Follower and following counts

Not public

• Your email address — never shown to other members
• Your date of birth
• Your direct and group messages (but see section 4.5)
• Saved places and guides, and your saved or labelled locations
• Accounts you've blocked
• Your payment records and purchase history
• Reports you file, and the outcome of moderation
• Your device location

Setting your profile to private restricts who can see your profile content. It does not retroactively unpublish things you already posted in public communities, and it does not hide aggregate counts.

Content you post publicly may be viewed, copied, saved and re-shared by others. We can remove content from Suhbah, but we cannot recover or delete copies others have already made.

7. Who we share information with

We do not sell your personal information. We share it only as follows.

7.1 Other members

As described in section 6, and with people you message or whose gatherings you join.

7.2 Service providers (subprocessors)

Companies that run parts of Suhbah on our behalf, under contract, and only for the purposes we set:

7.3 Legal and safety

We may disclose information where we reasonably believe it's required by law or valid legal process, or necessary to investigate a violation of our terms, to protect the rights, property or safety of our members, the public or Suhbah, or to prevent fraud or imminent harm. We aim to notify you of a legal demand for your data unless we're legally prohibited from doing so.

7.4 Business transfers

If Suhbah is acquired, merged, or its assets sold, your information may transfer as part of that deal. We'll notify you before it becomes subject to a materially different policy.

8. How long we keep it

We keep your account information for as long as your account exists. After that:

Deleted data may persist briefly in encrypted backups before those backups age out on their normal cycle.

9. Deleting your account

You can delete your Suhbah account and its data at any time. You do not need to ask us.

In the app

1. Open Suhbah and go to Profile → Settings.
2. Select Delete account.
3. Confirm by typing DELETE.

This is irreversible. Your uploaded files are removed from storage first, then your account and its data are erased, subject only to the narrow exceptions in section 8. It is a genuine erasure, not a hidden or frozen account.

By email

If you can't reach the app — you've lost your device, or you can't sign in — email privacy@smughal.com from the address on your account with the subject "Delete my account". We'll verify it's you and complete the deletion within 30 days.

Just want a break?

Deactivating hides your profile and content without deleting anything, and is reversible — signing back in restores your account. Deleting is not.

10. Your privacy rights

Wherever you live, you can ask us to access, correct, delete or export your information — email privacy@smughal.com with "Privacy request" in the subject. We verify that the request is really yours, then respond within 45 days, and we will tell you if we need a single 45-day extension that the law allows. You may use an authorized agent, with your written permission and verification of your identity.

If we refuse a request, you can appeal. Reply to our response, or email the same address with "Appeal" in the subject. We will reconsider and write back within 45 days with our decision and the reasons for it. If we still say no, we will tell you how to complain to your state Attorney General.

Suhbah also has a built-in export under Settings → Export my data, which produces a JSON file of your profile, preferences, saved guides, blocked accounts, business profiles and notification settings. It doesn't yet include your posts, reviews, messages or RSVPs — for a complete copy, email us and we'll assemble it.

If you're in California (CCPA/CPRA)

In the past 12 months we have collected the categories described in section 4: identifiers, customer records, commercial information, internet and network activity, geolocation data, audio/visual information (photos and videos you upload), and professional or education information if you choose to add it. Sources, purposes and recipients are in sections 4, 5 and 7.

Two categories of sensitive personal information are involved. Precise geolocation is collected only in the moment you ask for something nearby (section 4.7). The contents of your direct and group messages are stored so that we can deliver them, and may be accessed by a limited number of authorized personnel for the purposes described in section 4.5. We use both only to perform the services you asked for and for the security, safety and legal purposes that are permitted without a right to limit, and we never sell or share either. We do not collect your religion, race or ethnicity, health information, biometric identifiers, union membership, sexual orientation, immigration status or government identifiers.

You have the right to:

• Know what we collect, use, disclose and (if we did) sell
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — we do neither, and never will, so there is nothing to switch off
• Limit the use of sensitive personal information — we already use it only for the purposes described above, and you can withhold location entirely in your device settings
• Not be discriminated against for exercising any of these rights. We don't.

Other US states

If you live in a state with a comprehensive privacy law — including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Iowa and Utah — you have broadly the same rights: to confirm whether we process your data and access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects. We do not run targeted advertising, we do not sell personal data, and we do not profile people in ways that produce legal or similarly significant effects.

Where your state requires consent before processing sensitive data, the permission you grant for location in your device settings is that consent, and withdrawing it in those settings withdraws the consent. In Minnesota and Oregon you may also ask for a list of the specific third parties we have disclosed your data to — section 7.2 names every one of them, and we will confirm in writing on request. Appeals work as described at the top of this section.

Opt-out preference signals. Because we do not sell or share personal information, a Global Privacy Control signal has nothing to disable. Our website honours it anyway, and if that ever changes we will treat GPC as a valid opt-out request.

If you're outside the United States

Suhbah is offered only in the United States (section 11). We still extend the core rights above to anyone who asks: access, correction, erasure, a portable copy, restriction of processing, objection to processing based on our legitimate interests, and withdrawal of any consent you have given — without affecting processing already carried out lawfully. If you are in the EU, UK or Switzerland and you're not satisfied with our answer, you may complain to your national data protection authority; we'd appreciate the chance to put it right first.

11. Where Suhbah is offered, and where your data lives

Suhbah is offered only in the United States. The app is distributed on the Apple App Store and Google Play in the United States only, it runs on iPhone and Android only, and there is no web version. We do not direct the app at people outside the US.

SMughal Labs LLC operates Suhbah from the United States and our database and files are hosted in the United States. If you travel and use Suhbah from abroad, your information is still processed in the US, under laws that may differ from those where you are.

The suhbah.app website is reachable from anywhere, because it is a public page describing the app. Where personal data of someone in the EEA, UK or Switzerland does reach us — a waitlist signup, or an email to us — we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our providers, together with the technical measures in section 12.

12. How we protect your information

Security is designed in rather than added on. In particular:

• All traffic is encrypted in transit with TLS, and data is encrypted at rest.
• Every database table enforces row-level security, so authorization is applied by the database itself rather than trusted from the app. The app cannot grant itself access it shouldn't have.
• Privileged operations run through narrowly-scoped server-side routines with least-privilege access. Tables with no legitimate client access are held in a schema the public API cannot reach at all.
• Your app never talks to our database host directly; requests are proxied through our own domain, and API keys for third-party services stay server-side.
• Administrative and moderation actions are audit-logged.
• Two-factor authentication is available in Settings → Security.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and the relevant regulators as required by law.

13. Cookies and on-device storage

The suhbah.app website sets no advertising or analytics cookies. There is no consent banner because there is nothing to consent to.

The Suhbah app stores data locally on your device — your login session, preferences, appearance settings, recent and saved locations, and cached content — so the app works quickly and stays signed in. This uses your device's own app storage, and it is cleared when you sign out or uninstall the app. Because Suhbah is an iPhone and Android app with no web version, it sets no cookies at all.

14. Push notifications

If you allow notifications, we store a push token for your device so we can deliver them. Notifications tell you about messages, follows, RSVPs, community activity and gatherings.

Control which types you receive in Settings → Notifications, or turn them off entirely in your device settings. Turning them off in the OS doesn't stop us from storing the token; deleting your account does, and so does signing out.

15. Links, venues and other people

Suhbah lists independent restaurants, cafés, masjids and other venues, and links to external websites, social profiles and ticket pages. We don't control those places or sites and this policy doesn't cover them.

When you attend a gathering, the host may see your name and that you RSVP'd or checked in. Hosts are independent of Suhbah and are responsible for their own handling of that information.

Halal status, alcohol and smoking flags, prayer facilities and similar attributes in Suhbah are largely community-reported. We show a confidence level rather than asserting a fact, and you should verify anything that matters to you directly with the venue.

16. Changes to this policy

We update this policy as Suhbah changes. When we make a significant change we update the version stamp at the top of this page and notify you in the app or by email.

For a significant change you will be asked to accept the new version before you can continue using the app. Until you do, the app shows you the updated agreements rather than your feed. This applies to this policy, the Terms of Service and the Community Guidelines together, so what you accept is always the current set.

Because we record which version you accepted and when — and keep the earlier records rather than replacing them — "what was I agreeing to at the time?" always has an answer.

17. Contact us

For any privacy question, request or complaint — access, correction, deletion, export, or withdrawing consent:

SMughal Labs LLC
Email: privacy@smughal.com
Please put "Privacy request" in the subject line so it gets routed quickly.

See also our Terms of Service and Community Guidelines.