Hijaza

Privacy policy

for the Hijaza app and this website · Last updated: 25 October 2026 · The German version is legally binding.

1. Controller

Ahmad Sobair Schokory, Große Seestr. 10, 60486 Frankfurt am Main, Germany
Email: schokorygroup@gmail.com

2. In short

Hijaza works without a user account. Your personal travel data stays on your device. The only exception is the optional group feature: if you create or join a group, your display name and your Umrah progress are stored for the group (see section 5). The app shows no advertising, contains no advertising SDKs and does not track you across other companies’ apps or websites. It only sends usage statistics and crash reports if you agree on first launch or later in the settings (see section 5).

3. Data stored only on your device

• Umrah progress and counters (Tawaf, Saʿi)
• visited places, favourites, your own notes and photos
• listening positions of the audio stories, downloaded offline packs
• settings (e.g. language, prayer notifications) and – if enabled – a list of which place was announced when
• saved meeting points, your own emergency contacts and the pre-trip checklist
• details for the Miqat companion (departure airport and planned departure time) and scheduled reminders

This data is not transferred to us or to third parties. Photos you add are stored as a copy in the app’s private storage; the original in your photo library remains unchanged. You can remove everything in the app under Settings → “Delete all personal data”, or by uninstalling the app. Whether the data is included in a device backup (e.g. iCloud or Google backup) depends on your device settings.

4. Permissions

Location

Only with your permission. The app uses your location on the device for prayer times and the Qibla direction where you are, for the meeting point (saving it and finding your way back), for the Miqat companion during the flight, to show places near you and – if you enable automatic discovery – for notices about historic places. The operating system monitors the places (geofencing). The app only stores which place was announced when – no coordinates of your movements and no movement profile. Your exact location never leaves your device – with two exceptions: if you explicitly share a group meeting point in a group, that point is stored for the group (see section 5). For the temperature shown with the prayer times, the app does not send your location but only the position of the nearest larger city (see “Weather”). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app or in the system settings.

Camera and photos

Only when you add a photo to a place yourself. The photo stays on your device.

Compass (motion sensors)

For the Qibla direction and the way to the meeting point, the app reads your device’s compass. These values are only used on the device and are not stored.

Notifications

Only with your permission: for notices about historic places near you, for the prayer times you choose and for the reminders of the Miqat companion. The app schedules all notifications on your device; there is no notification server and nothing is sent to us. You can switch prayer notifications off in the settings at any time.

5. Services the app connects to

Every connection to a server technically transmits your IP address. We do not receive any data about you from this.

Maps (OpenFreeMap)

The map view loads map tiles from OpenFreeMap (openfreemap.org), a free map service based on OpenStreetMap, in order to display the map (legitimate interest, Art. 6(1)(f) GDPR). The map is only loaded when you open it.

Route (maps app)

When you tap “Route” for a place, the app opens Google Maps (in the app if installed, otherwise in the browser) and passes on only the coordinates of the destination. Whether the maps app uses your location for directions is up to you in that app or in your device settings; Google’s privacy policy applies. Hijaza itself does not transmit your location.

Offers (Google Firebase)

Partners and discount codes in the “Offers” section are read from Cloud Firestore by Google Firebase – without an account and read-only. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data is stored in a data centre in the EU. A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR.

Group (Google Firebase, only if you use it)

With the group feature (Premium), family or a travel group can see where the others are in their Umrah. When you create a group or join one with a code, the app stores in Cloud Firestore by Google Firebase (provider and location see above):

• the group name and a random join code,
• the display name you choose yourself (a nickname is enough),
• your Umrah progress: current stage, completed stages, round and counter during Tawaf or Saʿi,
• if someone shares it, a group meeting point with name, note, coordinates, accuracy, the display name of the person sharing it and the time,
• congratulations on completing the Umrah that members send each other (display name of the sender, recipient and time),
• if you allow notifications, your device’s push address (an identifier issued by Firebase Cloud Messaging) and the app language you use – so that congratulations reach you as a notification even when the app is closed.

Nobody in the group can see the push address. Only our server (Cloud Functions by Google Firebase in Frankfurt am Main, Germany) reads it to send the notification via Firebase Cloud Messaging; on iPhone it is delivered via the Apple Push Notification service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). Delivery may also use servers in the USA; Google and Apple are certified under the EU-US Data Privacy Framework. The app only creates the push address while you are in a group and discards it when you leave the group.

Only people who know the group’s code can see this information. There is no user account, no email address and no phone number; your own location is not shared continuously. When you leave the group, your entry and your push address are deleted. The group expires 14 days after creation; the group, all members, congratulations, push addresses and the meeting point are then deleted automatically, usually within a day. The legal basis is providing the feature you requested (Art. 6(1)(b) GDPR).

Usage statistics and crash reports (only with your consent)

On first launch, the app asks whether it may send usage statistics and crash reports. Only if you choose “Accept” does it use Google Analytics for Firebase and Firebase Crashlytics (provider: Google Ireland Limited, see above). Before you decide and after you decline, both are switched off; stored crash reports that have not yet been sent are then deleted.

• Usage statistics: which screens are opened and which features are used (e.g. Umrah step confirmed, counter round, place or tour opened or listened to, offer opened, Premium purchased), together with the identifier of the place, tour or step concerned, general device and app details (device model, OS version, app version, language, approximate country derived from the IP address) and a random app instance ID.
• Crash reports: error message and stack trace at the time of the crash, device model, OS version, app version, free memory and a random installation ID.

Your location, notes, photos, names on certificates and any other content you enter are never transmitted. The app does not collect an advertising ID (IDFA or Android advertising ID), does not link the data to a person or an account and does not use it for advertising. The data is processed in Google data centres, including in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw it at any time with effect for the future in the app under Settings → “Usage statistics and crash reports”.

Weather (MET Norway)

With the prayer times, the app shows the current temperature, and on very hot days (40 °C or more) it can warn you about the midday heat with a notification (can be switched off in the settings). To do so, it queries the Norwegian Meteorological Institute (Meteorologisk institutt, Postboks 43 Blindern, 0313 Oslo, Norway; api.met.no) at most once an hour. Only the coordinates of the city shown, rounded to about one kilometre, are transmitted – for your own location those of the nearest larger city from a list stored in the app, never your exact location – together with the technically necessary connection data (IP address, time). The app does not send an identifier. The legal basis is our legitimate interest in a helpful display (Art. 6(1)(f) GDPR). Without internet or without a city nearby, no temperature is requested. Weather data: MET Norway, licence CC BY 4.0.

Offline packs

When you download audio stories, the app retrieves the files from our storage at Google Cloud Storage (provider: Google, see above). The audio files are stored in a data centre in the USA. When they are retrieved, Google receives the technically necessary connection data, in particular your IP address, the time and the requested file. In addition, the app retrieves the list of available audio packs from this storage at most once a day, so that new languages and improved recordings appear without an app update; this also involves only these connection data. The app does not send an identifier or any other information about you. Google is certified under the EU-US Data Privacy Framework; the transfer to the USA is covered by the European Commission’s adequacy decision (Art. 45 GDPR). The legal basis is providing the feature you requested (Art. 6(1)(b) GDPR).

Purchases (Premium)

Premium purchases are handled entirely by Apple’s App Store or Google Play under their privacy policies. We do not receive any payment data, only the confirmation that Premium is unlocked.

Partner links

The “Offers” section contains links to partners (e.g. eSIM, transfers, flights). A partner link opens in your browser, outside the app. It first passes through a server of the affiliate network Travelpayouts, which counts the click, and then leads to the partner’s website. For technical reasons your IP address and browser and device information are processed; the link contains an identifier that tells Travelpayouts or the partner that you came via Hijaza. We may receive a commission for a booking and only see aggregated figures (clicks, bookings, commission), no data that identifies you. The privacy policies of Travelpayouts and the partners apply. The app itself does not transmit any personal data.

Email

If you write to us, we use your message and email address only to reply (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed.

6. This website

This website is hosted on Google Firebase Hosting (provider see above). When you visit it, the host processes technically necessary access data such as IP address, time and requested page in order to deliver the page and protect it against abuse (Art. 6(1)(f) GDPR). The website sets no cookies and uses no analytics tools.

7. Retention

Data on your device remains until you delete it or remove the app. Apart from the group feature, we do not store personal data from the app on servers. Group data is deleted automatically when you leave the group (your entry) and after the group expires, 14 days after creation (everything). Usage statistics in Google Analytics are deleted after 2 months, crash reports in Firebase Crashlytics after 90 days.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to withdraw consent with effect for the future. Since we do not store personal data from the app on servers apart from the group feature, you can exercise most of these rights directly in the app; you delete your group entry by leaving the group. For anything else, an email to us is enough. You may also lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden, Germany.

No automated decision-making or profiling takes place.

9. Children

Hijaza is intended for pilgrims and anyone interested in history, of all ages. We do not knowingly collect data from children.

10. Changes

We update this policy when the app or the legal situation changes. The version published here applies.