Your privacy on Almuhajir

Effective 2 October 2026 · Last updated 31 October 2026

This policy explains what personal data the Almuhajir app and website collect, why, who we share it with, how long we keep it, and the choices and rights you have.

In short: we collect what we need to run your account and the app. We do not sell your data, show advertising, or use third-party advertising or analytics trackers. You can delete your account at any time from the app, or by email.

1. Who we are

Almuhajir is operated by Almuhajir Studio ("we", "us"), a business name registered with the Corporate Affairs Commission of Nigeria (BN 9904488), with its principal place of business at No. 5 Press Road, Gyadi-Gyadi, Tarauni, Kano State, Nigeria. We are the data controller for the personal data described here, under the Nigeria Data Protection Act 2023.

For anything about your personal data, write to privacy@almuhajir.org.

2. What we collect

Information you give us

Account details: your name, email address, phone number, the country and state you tell us you live in, and your password. Your password is stored only in a protected, scrambled (hashed) form by our sign-in provider; we cannot read it.
Passkeys: if you add a passkey, we store its public key, the name of the device or password manager it was created on, and when it was last used. The private key never leaves your device. You can remove a passkey in Settings.
Profile: your profile photo, your city if you add it, and your language and appearance choices.
Questions you ask a scholar: the text of your question, and its progress through the scholar's team.
Reports: when you report a post or video, the reason and any note you add.
Messages to us: what you send when you email us.

Information created as you use the app

The scholars you follow and your notification choices for each.
Your reactions, saved items, bookmarks and reading progress.
Plays: the lessons and clips you play while you are signed in, and when. We count a play at most once every 30 minutes for the same item, so scholars can see how many people listen and watch.
Where you stopped: the point you reached in each lesson you play while you are signed in, so you can continue on another device.
A record of which audio lessons and books you downloaded, used to apply the download limit of your plan. The files themselves stay on your phone.
Notifications we send you, and when you last opened them.

Information about your device

Notification token: if you allow notifications, a token from Apple or Google that lets us deliver them to your phone, and whether the phone runs iOS or Android.
Technical logs: our hosting providers keep short-lived records of requests (such as IP address, time and device type) for security and to keep the service working.
Crash reports: if the app crashes or hits a serious error, it sends a report of what went wrong: the app version, phone model and system version, the technical trace of the error, and a random ID for that installation. Crash reports do not include your name, email, or anything you typed.

Reports and account decisions

If you report a post or clip, we keep the report and the reason you chose so the Almuhajir team can review it. The scholar and their team are never told who reported it. If your account is suspended or banned, we keep a record of the decision, the reason and how long it lasts.

Scholars, media teams and administrators

If you run or help run a scholar's School, or administer Almuhajir, we also keep your role and permissions, the School you belong to, the content you publish or manage, and a record of important changes you make (an audit log) so that work can be checked and corrected.

What we do not collect

We do not track your location: the app never reads your phone's position. We only keep the country and state you choose to tell us. We do not read your contacts, or use advertising or third-party analytics trackers. The app uses your camera, photos or microphone only when you choose to add a photo or video, or record an answer.

3. Using Almuhajir on the web

You can browse, listen and read on almuhajir.org without an account. The website sets no cookies and has no analytics, advertising or tracking tools. So you can pick up where you left off, your browser keeps a few small items on your own device: the lesson you last played, how far you got and the playback speed; where you last placed the floating player on the screen; and, if you switch it, whether you chose the light or the dark appearance. They never leave your device. Pressing Close on the player removes the lesson, and clearing the site's data in your browser removes everything. Listening on the website is not counted or recorded against you. Searches are sent to our servers only to show you results, and we do not store what you search for. As on any website, our hosting providers keep short-lived technical logs of requests (such as the IP address and the page requested) for security and reliability, as described under "Technical logs" above.

If you sign in on the website, your browser keeps your sign-in session on your device so you stay signed in: a pair of tokens that identify your account, your user ID and your email address. It is stored in the browser's own storage, not in a cookie, it is sent only to our sign-in provider and database, and it is removed when you sign out or clear the site's data. If you create an account on the website, the profile photo you chose waits in the same browser storage until you confirm your email and sign in, and is then uploaded to your account and removed from the browser. If you add a passkey on the website we store the same things as described in section 2.

4. How we use it, and our lawful basis

To provide the app (create and secure your account, sign you in, show the Schools you follow, deliver questions and answers, keep your downloads and reading progress). Lawful basis: performance of our agreement with you (the Terms of Use).
To send notifications about new lessons, posts and answers from the scholars you follow. Lawful basis: your consent, given in your phone's notification prompt. You can withdraw it at any time in your phone settings or per scholar in the app.
To send account emails such as email confirmation, password reset and School invitations. Lawful basis: performance of our agreement with you.
To keep Almuhajir safe: review reports, enforce the Community guidelines, prevent abuse and fix problems. Lawful basis: our legitimate interest in a safe, working service.
To understand and serve our community. Your country and state tell us, in broad terms, where our members are, so we can decide what to build and which languages and content matter most. Lawful basis: our legitimate interest in running and improving the service. Giving them is optional, and you can add, change or remove them at any time in Settings.
To meet legal obligations where the law requires it.

We do not make decisions about you based solely on automated processing, and we do not profile you for advertising.

5. What other people can see

Questions: a question you send is read by the scholar and the members of his team who handle questions. If the answer is published, it appears in public Q&A without your name, and the team removes details that could identify you.
Content published by a School (posts, audio, clips, books and answers) is visible to everyone who uses Almuhajir.
Your email address and phone number are never shown to other users.
Your country and state are never shown to other users, to scholars or on the website.
Your profile photo is seen only by you and the Almuhajir team (for example when reviewing reports). Scholars, their teams and other users do not see it.

We do not sell or rent your personal data. We share it only with service providers who process it for us under contract, and only as needed to run Almuhajir:

Supabase — database, sign-in and file storage.
Google Firebase Cloud Messaging, and Apple Push Notification service on iPhone — delivering notifications.
Google Firebase Crashlytics — collecting crash reports so we can fix problems.
Resend — sending account emails.
Cloudflare — hosting this website.

We may also disclose data if the law requires it, to protect the safety of people, or as part of a transfer of the Almuhajir service to a new operator, who would be bound by this policy.

7. Where your data is stored

Our main database is hosted by Supabase in the European Union (Ireland). Our email, notification and website providers may process data in other countries, including the United States. When data leaves Nigeria, we rely on safeguards recognised by the Nigeria Data Protection Act 2023, such as our providers' contractual data protection commitments.

8. How long we keep it

Account and activity data: for as long as your account exists.
After you delete your account: it is removed from our live systems straight away (see below). Copies in our providers' backups are overwritten within 30 days.
Play records: up to 400 days, then deleted. When you delete your account they are no longer linked to you.
Where you stopped: until you play the lesson again from the start, or delete your account.
Country and state: until you change them, or delete your account.
Notification tokens: removed when you sign out, delete your account, or the token stops working.
Technical logs: kept by our providers for a short period, normally no more than 90 days.
Crash reports: kept by Firebase Crashlytics for 90 days.
Reports and moderation decisions: kept so repeated problems can be recognised. When you delete your account, reports you made are no longer linked to you.
Suspension records: kept while the account exists and deleted with it. Our audit log keeps a note that the action was taken, without your name or email.
Emails you send us: for as long as needed to deal with your request.

9. Deleting your account

You can delete your account at any time in the app (Profile › Settings › Delete account) or by email. See Delete your account for the steps.

What is deleted: your profile, name, profile photo, email and phone number; the scholars you follow; your saved items, reactions, bookmarks and reading progress; your notifications and notification tokens; and questions you asked that have not been answered.

What we keep, and why:

Answered questions that were published stay in public Q&A, still without your name, because the answer is shared knowledge for everyone.
Content you published for a School as a scholar or media team member stays with that School, no longer linked to your account.
A record that an account was deleted, with no name, email or phone number, so we can show we acted on the request.

10. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

be told how your data is used (this policy);
get a copy of your personal data, including in a portable electronic format;
have inaccurate data corrected;
have your data deleted;
ask us to restrict or stop certain processing, and object to processing based on our legitimate interests;
withdraw consent at any time, without affecting what was done before;
complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

To use any of these rights, email privacy@almuhajir.org from the email address on your account. We may ask you to confirm your identity, and we reply within one month.

11. Children and young people

Almuhajir is for people aged 13 and over. If you are under 18, you may use Almuhajir only with the permission of a parent or guardian. If we learn that a child under 13 has an account, we will delete it. Parents or guardians can contact us at privacy@almuhajir.org.

12. Security

All data travels over encrypted connections (HTTPS). Access to data in our database is limited by role, so people see only what their role allows, and passwords are never stored in readable form. No system is perfectly secure; if a breach affects your personal data, we will tell you and the regulator as the law requires.

13. Changes to this policy

We will post any change on this page and update the date at the top. If a change is significant, we will also tell you in the app before it takes effect.

14. Contact us

Almuhajir Studio, operator of Almuhajir
Business name registered with the Corporate Affairs Commission, Nigeria: BN 9904488
No. 5 Press Road, Gyadi-Gyadi, Tarauni, Kano State, Nigeria
Email: privacy@almuhajir.org