Trust & Security
Your Zakāt is an act of worship, and the figures behind it are among the most private information you have. We treat protecting them as an amana, a trust, not just a legal requirement. This page explains, in plain language, how your data is handled.
You choose where your data lives
You can calculate your Zakāt with no account at all. Nothing is sent anywhere. You choose how your Zakāt data is handled the first time you save a calculation, before any account exists. Kept on this device means it stays in your device’s storage, never uploaded to us; if you later create an account, it simply signs you in. Synced to your account means your records are stored in our secure database and follow you across devices. You can switch either way, anytime, in Settings. Signing out shows only the login screen; on-device data is kept safely and reappears when you sign back in.
If you sync your data
- Encrypted in transit and at rest. All connections use HTTPS/TLS, and stored data is encrypted at rest.
- Isolated per user. Every account’s data is protected by database-level row isolation (row-level security): only your authenticated session can read your rows. This is enforced by the database itself, not just the app, and we don’t access it in the ordinary course of running the service.
- We collect the minimum. Your email (for sign-in), the figures you enter, and any receipts you choose to upload. No ad trackers and no selling of data. We count page views ourselves, without cookies and without any third party.
- You stay in control. Export a backup at any time, or permanently delete your account and everything in it from Settings. That removes your login, your records, your version history, and your uploaded receipts.
How we count visits
We measure how many people use the site, and we do it ourselves rather than handing your visit to an analytics company. There are no cookies and no tracking across other sites. Each visit gets a random number that lives only until you close the tab, and we record the page you viewed, the site that linked you (the domain only, never the full address or your search terms), and your country. That is the whole record. It is deleted after 90 days.
Backups & your data
Losing a device shouldn’t mean losing your records, so there are several safety nets:
- Automatic device backup. On the mobile apps your data may ride your device’s normal OS backup, Android Auto Backup on Android, iCloud device backup on iOS, depending on your device’s own settings. It is handled by your device, not by us, and we cannot read it. How well that backup is protected is Apple’s or Google’s decision rather than ours: Android 9 and later encrypt it end-to-end with your device credential, while on iOS that requires Advanced Data Protection.
- A backup file you control. Download a backup any time and keep it wherever you like: Google Drive, iCloud, or email. Restore it on any device, with a preview before anything is replaced.
- Version history (synced accounts). We keep the last several saved versions so you can roll back a mistake. It lives in the same protected, per-user-isolated database and is deleted with your account.
- Undo on deletes. Deleting a donation or a year can be undone for a few seconds, and larger deletes offer a one-tap backup first.
Built on certified infrastructure
Zakat Simple runs on established providers that hold independent security certifications, which our service inherits at the infrastructure level:
| Provider | Role | Certifications |
|---|---|---|
| Supabase | Database, authentication, secure functions | SOC 2 Type II, HIPAA-capable |
| Netlify | Website & app hosting (global CDN) | SOC 2 Type II |
| Stripe | Optional support payments | PCI-DSS Level 1 |
Card details are handled entirely by Stripe on Stripe's own pages. Card numbers never touch our systems.
Payments are support, not worship
The optional “support the tool” payment funds the running costs of an independent tool. It is not Zakāt, sadaqah, or a charitable donation, no tax receipt is issued, and it is kept entirely separate from the app's Zakāt calculation and giving features. Declining it changes nothing. The calculator is fully free for everyone.
Subprocessors
The third-party services that process data on our behalf:
| Service | Purpose | Data involved |
|---|---|---|
| Supabase | Database, auth, storage | Account email, saved records, receipts |
| Netlify | Hosting/CDN | Standard web-server logs |
| Stripe | Optional support payments | Payment details (on Stripe's pages only) |
| Optional “Sign in with Google” | Name & email, as you authorize |
Practices we hold ourselves to
- Multi-factor authentication on all administrative accounts
- Daily database backups, retained by our database provider
- Error and uptime monitoring with immediate alerts
- Automated dependency vulnerability scanning
- Secret keys kept server-side only, never in the app you download
- A written incident-response plan, including notification duties under PIPEDA (Canada), UK GDPR, and Australia's Privacy Act
Found a vulnerability?
We welcome responsible disclosure. Email nabeeli.biz@gmail.com with the details and we will respond promptly. Please don't access other users' data while demonstrating an issue.
Questions
Anything unclear, or does your organization need more detail (security questionnaires, data-processing agreements)? Contact nabeeli.biz@gmail.com. See also our Privacy Policy and Terms of Service.