Privacy Policy

Welcome to The Muslim Post (the "Website", accessible at https://themuslimpost.org). This privacy policy is designed to help you understand how we collect, use, and protect your personal information. We respect your privacy and are committed to protecting your personal data in accordance with applicable data protection laws, including the European Union's General Data Protection Regulation (GDPR).

1. Information We Collect

We may collect and process your personal data in the following ways:

1. Information you provide directly: When you register an account, subscribe to our newsletter, or contact us, you may voluntarily provide personal information such as your email address, name, and password.
2. Information from Google Sign-In: When you choose to sign in using Google, we access the following data from your Google account: your email address, display name, and profile photo URL. These are obtained through standard OAuth 2.0 scopes (openid, email, profile). We do not request access to any other Google services, files, or sensitive data.
3. Information from other social logins: If you sign in via Facebook or X (Twitter), we receive similar basic profile information (name, email, profile image) as authorized by those platforms.
4. Information collected automatically: We may automatically collect information about your use of the website through cookies, log files, and analytics tools, such as your IP address, browser type, access times, pages viewed, and session data.

2. How We Use Your Information

The information we collect is used for the following purposes:

1. To create and manage your user account and authenticate your identity.
2. To provide and maintain the features and services of the website.
3. To personalize your experience and display relevant content.
4. To communicate with you, including responding to inquiries and sending notifications.
5. To analyze website usage and improve our services.
6. To comply with legal obligations or enforce legal rights.

3. How We Use Google User Data

We use data obtained from Google Sign-In strictly for the following purposes:

1. Authentication: Your Google email and account ID are used solely to verify your identity and create or link your account on our platform.
2. Profile display: Your name and profile photo from Google are used to populate your user profile. Your profile photo is downloaded and stored on our secure media servers so it can be served independently of Google.
3. No additional access: We do not access your Google Drive, Gmail, Google Calendar, contacts, or any other Google services. We do not use Google user data for advertising, analytics profiling, or AI/ML model training.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sharing and Disclosure of Data

We do not sell your personal data to third parties. We do not share Google user data with any third parties except as described below:

1. Infrastructure providers: Your data is stored on servers operated by Supabase (database hosting) and Cloudflare (media storage and CDN). These providers act as data processors on our behalf and are bound by data processing agreements.
2. Analytics services: We use privacy-focused analytics tools (PostHog, Google Analytics, Microsoft Clarity) to understand website usage patterns. These tools may collect anonymized or pseudonymized usage data.
3. Legal requirements: We may disclose your information if required by law, court order, or to protect our legal rights.
4. Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

5. Data Storage and Protection

We implement appropriate technical and organizational measures to protect your personal data:

1. Database security: User data is stored in a PostgreSQL database hosted by Supabase with encryption at rest and in transit, row-level security, and regular backups.
2. Password protection: User passwords are hashed using bcrypt with a cost factor of 10 before storage. We never store plaintext passwords.
3. Media storage: Profile images and uploaded media are stored on Cloudflare R2 with access controls.
4. Transport security: All data transmission between your browser and our servers is encrypted using TLS/HTTPS.
5. OAuth token handling: OAuth access tokens from Google and other providers are stored securely in our database and are used only for the authentication process.

6. Data Retention and Deletion

We retain your personal data for as long as your account is active or as needed to provide you with our services. Specifically:

1. Account data: Your profile information, including data obtained from Google Sign-In, is retained until you request account deletion.
2. Session data: Login session records are retained for security auditing purposes and are automatically purged after expiration.
3. Analytics data: Anonymized usage data may be retained indefinitely for statistical purposes.

How to request deletion: You may request the deletion of your account and all associated personal data at any time by contacting us at support@themuslimpost.org. Upon receiving a verified deletion request, we will permanently remove your personal data, including any data obtained from Google Sign-In, within 30 days. This includes your profile information, authentication tokens, uploaded media, and activity logs.

7. Your Rights

Under GDPR and other applicable data protection laws, you have the following rights:

1. Right to access: You have the right to access your personal data that we hold.
2. Right to rectification: You have the right to request the correction of inaccurate or incomplete data.
3. Right to erasure: You may request the deletion of your personal data.
4. Right to restrict processing: You may request that we restrict the processing of your data.
5. Right to data portability: You have the right to request your data in a structured, commonly used, and machine-readable format.
6. Right to object: You have the right to object to the processing of your personal data based on legitimate interests.
7. Right to withdraw consent: You may revoke Google Sign-In access at any time through your Google Account permissions page.

8. Use of Cookies

Our website uses cookies and similar technologies to enhance your experience. Cookies are small files stored on your device that help us maintain your login session, remember your preferences, and analyze website traffic. You can manage or delete cookies through your browser settings, but please note that this may affect your ability to use certain features of the website.

9. Third-Party Links

The website may contain links to other websites. We are not responsible for the privacy policies or content of these websites. We encourage you to review the privacy policies of any websites you visit.

10. Children's Privacy

Our website is not directed at children under 13. If we discover that we have inadvertently collected personal data from a child under 13, we will take steps to delete the information as soon as possible.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. Any changes will be posted on this page, and the updated privacy policy will take effect immediately upon posting. We encourage you to review this page regularly.

12. Contact Us

If you have any questions about this privacy policy, wish to exercise your rights, or need to request data deletion, please contact us at:

Email: support@themuslimpost.org

Website: https://themuslimpost.org