Trust & Security
Your Zakāt is an act of worship, and the figures behind it are among the most private information you have. We treat protecting them as an amāna — a trust — not just a legal requirement. This page explains, in plain language, how your data is handled.
Your figures stay on your device by default
You can use the full calculator without creating an account. In guest mode, everything you enter lives only in your browser on your own device — it is never sent to our servers. Data only reaches our servers if you choose to create an account so your records can follow you across devices.
If you create an account
- Encrypted in transit and at rest. All connections use HTTPS/TLS, and stored data is encrypted at rest.
- Isolated per user. Every account's data is protected by database-level row isolation (row-level security): only your authenticated session can read your rows. This is enforced by the database itself, not just the app.
- We collect the minimum. Your email (for sign-in), the figures you enter, and any receipts you choose to upload. No ad trackers, no selling of data — our analytics (Plausible) are cookie-free and anonymous.
- You stay in control. Export all your data as a file at any time, or permanently delete your account and everything in it from Settings — the deletion removes your login, your records, and your uploaded receipts.
Built on certified infrastructure
Zakat Simple runs on established providers that hold independent security certifications, which our service inherits at the infrastructure level:
| Provider | Role | Certifications |
|---|---|---|
| Supabase | Database, authentication, secure functions | SOC 2 Type II, HIPAA-capable |
| Netlify | Website & app hosting (global CDN) | SOC 2 Type II |
| Stripe | Optional support payments | PCI-DSS Level 1 |
Card details are handled entirely by Stripe on Stripe's own pages — card numbers never touch our systems.
Payments are support, not worship
The optional “support the tool” payment funds the running costs of an independent tool. It is not Zakāt, ṣadaqah, or a charitable donation, no tax receipt is issued, and it is kept entirely separate from the app's Zakāt calculation and giving features. Declining it changes nothing — the calculator is fully free for everyone.
Subprocessors
The third-party services that process data on our behalf:
| Service | Purpose | Data involved |
|---|---|---|
| Supabase | Database, auth, storage | Account email, saved records, receipts |
| Netlify | Hosting/CDN | Standard web-server logs |
| Stripe | Optional support payments | Payment details (on Stripe's pages only) |
| Optional “Sign in with Google” | Name & email, as you authorize | |
| Plausible | Privacy-first analytics | Anonymous, cookie-free usage counts |
Practices we hold ourselves to
- Multi-factor authentication on all administrative accounts
- Daily database backups with periodic restore testing
- Error and uptime monitoring with immediate alerts
- Automated dependency vulnerability scanning
- Secret keys kept server-side only — never in the app you download
- A written incident-response plan, including notification duties under PIPEDA (Canada), UK GDPR, and Australia's Privacy Act
Found a vulnerability?
We welcome responsible disclosure. Email nabeeli.biz@gmail.com with the details and we will respond promptly. Please don't access other users' data while demonstrating an issue.
Questions
Anything unclear, or does your organization need more detail (security questionnaires, data-processing agreements)? Contact nabeeli.biz@gmail.com. See also our Privacy Policy and Terms of Service.