Legal

Privacy policy

Last updated 25 September 2026. Applies to the Hajj Companion app for iOS and Android.

1. Who we are

Hajj Companion is operated by Hajj Companion ("we", "us"). We provide the app to pilgrims and a dashboard to the Hajj operators and group leaders who organise their trip ("your operator"). We are the controller of the data described here. Your operator uses the dashboard to run the group and is responsible for what its staff do with the information they see.

2. What we collect

You cannot use the app without a join code from your operator. Once you join, we collect the following.

Account

• Phone number, used to log in with a code issued by your operator. It is the only identifier you enter.
• Name, as you type it, so your leader and tent-mates know who you are.
• Language (English or Arabic) and your notification preference.

Device

• A random installation ID generated by the app, the platform (iOS or Android), the app version and when the app was last active. This keeps your sessions apart and lets a lost phone be signed out.
• A push notification token, if you allow notifications, so your leader's messages and prayer reminders can reach you. It is cleared when you log out.

Group activity

• Your membership of the group, your bus and tent as assigned by the operator.
• Check-ins: when you confirm you are on the bus or at the tent, with the time.
• RSVPs to group activities.
• Which guide steps you have ticked and which prayers you have marked as prayed. These are private notes for you; your operator does not see them.
• Which notifications you have read.

Safety

• Your medical card: blood type, conditions, allergies, medication and notes, only if you fill it in. See section 4.
• Your emergency contacts: names and phone numbers you add.
• SOS alerts: when you hold SOS or tap "I'm lost", the time, the kind of alert, your position at that moment and your phone's battery level, so staff know how long the phone can still be found.

Documents

• The details you type about a passport, visa, Hajj permit, vaccination certificate or insurance policy: type, title, number, issuing country, dates, holder name and nationality.
• The photo or scan you attach, if any. See section 4.

What we do not collect

No advertising identifiers, no analytics profiles, no contacts list, no photos other than the ones you deliberately attach to a document, no microphone, and no background location unless you switch sharing on.

3. Location

The app uses your location in four ways, each with its own scope.

Feature	When	Sent to us?
Prayer times and Qibla	While you use those screens	No. Calculated on the phone.
Guide me back	Once, when you tap it	Yes, to work out the way back. Not stored.
SOS and "I'm lost"	Once, when you raise the alert	Yes, stored with the alert so staff can find you. The alert goes out even before a fix is available.
Location sharing	Continuously, only while you have switched it on in Profile	Yes, roughly every 30 seconds, so your leader's map shows where you are.

Location sharing is off by default. While it is on, the app shows a persistent notification on Android and the system location indicator on iOS. Positions are kept for at most 7 days. The moment you switch sharing off, or leave the group, every position we hold for you is deleted. Nothing is kept "just in case".

4. Documents and medical card

Document files are stored in a private, encrypted bucket that is never served through a public address. The app uploads and downloads a file through a link that is valid for fifteen minutes and tied to that one file. The typed details and the file's fingerprint are kept with your membership so the list works offline.

The free text of your medical card is encrypted at rest on our servers. It is shown to your operator's medical staff, and to the staff responding to an SOS you raise.

On your phone, cached document images are encrypted with a key held in the device's secure storage, and opening a document can be locked behind Face ID, Touch ID or your fingerprint.

5. Who can see your data

• Your operator's staff (leaders, assistants, medics) see your name, phone number, bus and tent, check-ins, RSVPs, SOS alerts and, while sharing is on, your position. They see a document only if you have shared it with their role, and the medical card only if they are medical staff or are responding to your SOS. Every time staff open a document, it is logged.
• Other pilgrims in your group see your name in the tent-mates list of a check-in and in the attendee list of an activity you joined. They never see your phone number, documents, medical card or location.
• We access data only to run the service, fix a problem you report, or meet a legal obligation.
• Authorities: we disclose data when the law requires it, and, in an emergency, we may pass your position and medical card to emergency services helping you.

We do not sell personal data and do not share it with advertisers.

6. Service providers

We use a small number of providers to run the app. Each processes data on our instructions.

• Firebase Cloud Messaging (Google) and Apple Push Notification service deliver notifications. They receive your push token and the notification content.
• Cloud hosting and object storage for our servers, database and the encrypted document bucket.

The app contains no advertising or analytics SDK.

7. How long we keep it

Data	Kept
Shared positions	7 days at most; deleted at once when sharing is switched off or you leave the group
"Guide me back" position	Not stored
SOS alerts	For the season, as part of your operator's record of the trip
Push token	Until you log out or disable notifications
Documents, medical card, emergency contacts	With your membership until you delete them or ask us to delete your account. Leaving a group keeps them so they are there if you rejoin; they do not follow you to another group.
Account (phone, name)	Until you ask us to delete it

8. What stays on your phone

The app is built to work without a signal, so it keeps a copy of your group's schedule, places, notifications, your documents' details, your medical card and your prayer times on the device. Changes you make offline are queued and sent when you reconnect. Logging out clears this cache and your session. Uninstalling the app removes it.

9. Your choices and rights

• Location sharing: switch it on or off at any time in Profile. Your phone's settings can also revoke the permission.
• Notifications: switch them off in Profile or in your phone's settings.
• Documents and contacts: delete any document or emergency contact in the app. Empty the medical card by clearing its fields.
• Document sharing: choose which staff roles can open each document, and change it later.
• Leave the group: from Profile. Sharing stops and your positions are deleted.
• Delete your account: write to us at the address below and we will delete your account and its data, except what your operator or the law requires us to keep for the trip's records.
• Access and correction: you can see and edit your details in the app, or ask us for a copy.

Depending on where you live you may have further rights under data protection law, including the right to complain to a supervisory authority. We will answer any request within 30 days.

10. Security

All traffic between the app and our servers is encrypted with HTTPS. Sessions are tied to your device and end when you log out. Document files are encrypted at rest and reachable only through short-lived links. The medical card's free text is encrypted at rest. Staff access to documents is logged. No system is perfectly secure, so if you believe your account has been misused, contact us and we will sign that device out.

11. Children

The app is intended for adult pilgrims. A child travelling with a group is registered by an adult in the family, and their data is handled as described here.

12. Changes

When we change this policy we will update the date at the top and, for anything material, tell you in the app before it takes effect.

13. Contact

Questions, access requests and deletion requests: privacy@hajcompanion.app.