Privacy Policy

AtharStories (atharstories.com) is a bilingual Arabic and English platform for stories of faith, patience, and healing. We act as the "data controller" for the purposes of GDPR and UK GDPR, the "business" for CCPA/CPRA, and the "controller" (controlador) for LGPD.

For any privacy or data matter, contact us at support@atharstories.com.

• Account info: your display name (or pen name), email address, profile photo if you upload one, birth date if you provide it, preferred language.
• Authentication data: a hashed password (bcrypt) or a Google OAuth identifier — we never see your actual password.
• Content you create: stories and their cover photos, comments, reflections, community discussions and dua requests (including ones posted anonymously), preferences, likes, and follows.
• Direct messages: the text of messages you send and receive, read receipts, and block lists. Messages are not end-to-end encrypted; our team can access them only when a message is reported or when legally required.
• Location data (optional): if you enable prayer times, we store the approximate latitude/longitude or city you choose, your timezone, and the prayer log you keep. We never track your location in the background.
• Device notifications (optional): if you enable push notifications, we store your device’s push subscription endpoint and keys. You can revoke this at any time in Settings.
• Gender (optional, self-attested): used solely to determine eligibility for the Sisters-only circle. It is never shown publicly and never used for advertising.
• Verification data: if you apply for scholar or writer verification, we collect the credentials, ijazah, links, and supporting documents you submit, plus the review outcome.
• Ask-the-Scholar questions: the text of your question, whether you marked it private or public, and the answer received.
• Self-serve advertiser data (advertisers only): organization name, contact details, campaign creative, and payment history. Card details are processed directly by Stripe and never touch our servers.
• Basic usage data: the pages you visit, device type, browser language, and anonymized identifiers. We use this to improve the experience and measure performance.
• Security data: a truncated IP address, access timestamps, CAPTCHA results — to protect against fraud and abuse.
• Advertising data (when ads are active and only with your consent): collected directly by our ad partners — including an advertising identifier, a truncated IP address, the page being viewed, and Google cookies. Used to choose a relevant ad and measure its performance.
• We do not knowingly collect special-category data (religion, political views, health, etc.) outside what you voluntarily share inside your own stories.

We process your data for the reasons below, under the legal bases shown in brackets (GDPR / UK GDPR):

• Running your account, displaying and reviewing your stories, and delivering your direct messages (performance of contract).
• Calculating prayer times for your location, sending device notifications, and gating the Sisters-only circle (explicit consent — all optional and switchable off in Settings).
• Reviewing verification applications and checking credentials (performance of contract and legitimate interest in platform integrity).
• Producing translations, audio narration, and pull-quote highlights of your stories to improve accessibility (performance of contract).
• Processing advertiser payments and running campaigns (performance of contract and legal obligation for financial records).
• Protecting the platform against fraud and abuse (legitimate interest).
• Performance improvement and aggregate feature analytics (legitimate interest).
• Sending core account notifications (performance of contract).
• Showing personalized ads (explicit consent, revocable at any time).
• Responding to lawful requests (legal obligation).

We share data only with the service providers essential to running AtharStories, all of whom are contractually bound to protect it:

• Supabase (US / EU) — database hosting and authentication. SOC 2 and GDPR compliant.
• Vercel (US / EU) — hosting and performance measurement.
• Cloudflare Turnstile (global) — CAPTCHA spam protection.
• Google AdSense and its partners — to serve and measure advertising (when active, only with consent).
• Vercel AI Gateway and the AI models it routes to — for content moderation, translation, pull-quote extraction, and audio narration (fish-audio). Only the story or comment text is sent, never your name or email, and it is not used to train models.
• Sightengine (EU) — automated scanning of uploaded images (avatars and story covers) for inappropriate content before they go live.
• Aladhan API (global) — prayer-time calculation. It receives only your approximate coordinates, never any account identifier.
• Vercel Blob (US / EU) — storage of uploaded images and cached narration audio files.
• Stripe (global) — advertiser payment processing. PCI-DSS Level 1 certified.
• Resend (US) — delivery of account emails (confirmations, notices).
• Sentry (US / EU) — technical error monitoring. May receive your IP address, device type, and the error trace; purged after 90 days.
• Upstash (global) — short-lived cache for rate limiting, using hashed identifiers only.
• Browser push services (Google, Apple, Mozilla) — to deliver the notifications you opted into to your device.

We do not sell your data. We do not share it for cross-context behavioral advertising except with your explicit consent.

Some of our providers are based in the United States or other countries outside the European Union. Where international transfer is required, we rely on appropriate safeguards: the European Commission’s Standard Contractual Clauses (SCCs), the EU–US Data Privacy Framework for certified providers, or the UK IDTA equivalent for UK users.

• Account and stories: as long as your account is active. When you delete the account we remove content from public display immediately, and from our systems within 30 days — encrypted backups may persist for up to 90 days.
• Direct messages: for as long as either participant keeps the conversation. Deleting a conversation removes it from your account; the other person’s copy remains until they delete it. Fully removed on account deletion.
• Location and prayer logs: until you turn prayer times off or delete your account.
• Push subscriptions: until you unsubscribe, or automatically when your device reports the subscription is no longer valid.
• Verification documents: deleted within 90 days of a decision; only the outcome and its date are retained.
• Security logs (IP, login times, CAPTCHA, error reports): kept 90 days, then automatically deleted.
• Advertiser payment records: 7 years, as required by accounting and tax law.
• Support tickets and correspondence: 24 months for legal and dispute-resolution purposes.
• Aggregated, anonymized analytics: may be retained indefinitely because they cannot identify you.
• Advertising consent record: until you withdraw it, or 12 months — whichever is shorter.

AtharStories uses — or will use — Google AdSense to help fund the platform. Here is what you need to know:

• Google and third-party vendors use cookies to serve ads based on your prior visits to this site and to other sites.
• Google uses the DART cookie to serve ads to you across the internet based on your visits to this site.
• You can opt out of personalized advertising from Google at any time via Google Ads Settings at adssettings.google.com.
• You can opt out of personalized advertising from other vendors at www.aboutads.info/choices or www.youronlinechoices.eu.
• If you decline advertising consent, you will still see ads but they will be non-personalized (NPA) — not based on your browsing.
• We do not show personalized ads to users under 18 where we can identify them.

For more on Google's policy, see "How Google uses information from sites or apps that use our services".

If you visit AtharStories from the European Economic Area, the United Kingdom, or Switzerland, no advertising cookies are loaded until you select "Accept" on the Google-certified consent banner (CMP). Your choice is stored and you can change it any time from the Cookies page; Google will also automatically honor the Global Privacy Control (GPC) signal if your browser sends one.

If you select "Reject", you continue to use AtharStories fully; ads are served in a non-personalized (NPA) manner without tracking cookies.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect and how we use it.
• Right to access a copy of your personal information.
• Right to deletion.
• Right to correction.
• Right to opt out of the sale or sharing of personal information (we do not sell; Google ads may count as "sharing" under CPRA, which you can opt out of by declining consent).
• Right to limit the use of sensitive personal information.
• Right not to be discriminated against for exercising any of these rights.

To exercise any of these rights, email support@atharstories.com with "CCPA" in the subject. We do not offer financial incentives in exchange for personal information.

• Brazil (LGPD): access, correction, deletion, anonymization, blocking, portability, consent withdrawal, and complaint to ANPD.
• Canada (PIPEDA): access, correction, complaint to the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act 1988): access, correction, complaint to the OAIC.
• Saudi Arabia (PDPL) and United Arab Emirates (PDPL): access, correction, deletion, portability, and consent withdrawal as required by the local statutes.

Wherever you live, you can exercise equivalent rights by emailing the official inbox. We will action your request within 30 days, or the shorter period your local law requires.

We use essential cookies (sign-in, language, dark mode) and, with your consent, advertising cookies. For the full table of names, durations, and parties, see the Cookies Policy.

We do not make solely-automated decisions about you with legal effect. Stories, comments, and images are screened automatically on submission; anything above a threshold is held for human review rather than published, and anything below it goes live immediately. No content is permanently removed without a human looking at it, and you can appeal any decision by emailing the official inbox.

AtharStories is not directed at children under 16. Our Terms of Service set a global 16+ minimum for creating an account or submitting content, and we do not knowingly collect data from anyone below that age. We also do not show personalized ads to anyone we know to be a minor. If you learn that a child has created an account, let us know so we can remove it.

We hash passwords (bcrypt), encrypt transit (TLS 1.3), and apply database-level Row Level Security so each user only accesses their own data. CSRF, CSP, and HSTS are enabled. No system is 100% secure — if you find a vulnerability, please report it immediately.

We may update this policy from time to time. We will notify you of material changes with a prominent in-app notice before they take effect. The "Last updated" date at the top always reflects the current version.

For any privacy question or to exercise your rights, email support@atharstories.com or visit the contact page. If we cannot resolve your matter, you have the right to lodge a complaint with the data protection authority in your country.