FitMuslim Privacy Policy

Version 2026-10 · last updated on 25 October 2026

This is a translation of the Dutch text; if the two differ, the Dutch version applies.

FitMuslim is an app for your body and your faith: prayers, Quran, adhkar, food, water, supplements, training and steps. To do that, we process data about you, some of which is sensitive. This policy covers the app and the website fitmuslim.com. It explains which data that is, why we use it, where it is stored, how long we keep it and what your rights are.

1. Who we are

The controller of your data is:

Maben & Co FZC-LLC
Business Centre, Sharjah Publishing City Free Zone
Sharjah, United Arab Emirates
Licence number 4306054.01

Privacy questions: privacy@fitmuslim.com.

2. What data we process

Your account

• Your email address. You sign in with a code we email to you. There is no password.
• Your first name, which you enter yourself.
• A member number, which we use internally instead of your name or email.

What you enter during onboarding

• Gender, age (we store your year of birth), height, your starting weight and your main goal.
• Your language, theme and time zone.

What you track in the app

• Prayers: which prayer you checked off, and whether it was on time, late or a make-up prayer. Also your prayer time settings and your notifications.
• Quran and adhkar: which pages you read, your bookmarks, and which adhkar you did each day.
• Food: meals with calories and macros, and the barcode if you scanned a product.
• Water, supplements, weight and workouts: how much, when, which sport, duration, distance, sets and weights, and a note if you write one yourself.
• Your goals, your day score (a number and how it is built up), badges and what you do and don’t eat.
• Notes from Adam, the coach in the app. Only if you have Adam’s memory turned on. Sensitive notes, for example about your health or your faith, are only kept by Adam once you say yes to them.

Special categories of personal data

Your prayers, Quran reading and adhkar say something about your religion. Your weight, food and workouts say something about your health. Under the law (GDPR) these are special categories of personal data. We only process them because you enter them yourself to use the app, and with your explicit consent. You give it when you create your account. You can withdraw it by deleting your account.

In FitMuslim your worship is never scored, rewarded or compared. Your prayers do not count towards your day score.

Apple Health and Health Connect

If you turn this on yourself, the app reads from Apple Health (iPhone) or Health Connect (Android):

• steps: only on your phone. Our server only receives the percentage of your step goal you reached;
• weight and workouts: we store these with your account, so they appear in the app;
• heart rate, speed, distance, energy, laps and the route of a workout: only to show them on your phone. We never store or send these.

The app can also write your weight and workouts back to Apple Health or Health Connect, if you allow it. We never use data from Apple Health or Health Connect for advertising and we never sell it.

Location

• For prayer times and the qibla, the app asks for your location, only while you use the app. It is rounded to about one kilometre and stays encrypted on your phone. Only your time zone goes to our server. To show the name of your town, your phone looks it up with Apple’s or Google’s service.
• During a workout with GPS (only if you turn it on yourself), the app measures the distance. We only keep the total distance; the route does not leave your phone. On Android the measurement continues with a visible notification if you briefly leave the app. The app never asks for permission to use your location in the background.

Camera and photos

• Scanning a barcode happens on your phone. Only the number goes to our server.
• A photo of your plate is made smaller and sent to the AI (see section 4). We do not keep the photo, and the temporary files on your phone are deleted right away.

Garmin watch

If you connect the FitMuslim app on your Garmin watch, the following passes between the watch and our server: your prayer settings, today’s water and supplement data, your day score and today’s workout. The watch determines your location for prayer times itself, and it stays on the watch. The traffic runs through Garmin Connect on your phone. Workouts you record on the watch go to your own Garmin account, not to us.

What we don’t do

• No advertising and no ad tracking.
• No third-party analytics or crash services in the app.
• We do not sell your data and do not share it for marketing.

The website (fitmuslim.com)

• Waitlist: if you leave your email address, we first send an email with a confirmation link (valid for 72 hours). Only when you press the button on the confirmation page is your address added to the waitlist, together with the language of the site. We only use it to let you know that FitMuslim is live. You can always unsubscribe via the link in the email or by emailing us.
• Contact form: your name, your email address, the topic you choose and your message. It reaches us as an email, so we can reply to you. We do not put it in a database.
• To prevent abuse, the website’s server keeps your IP address in memory for at most 10 minutes, to see whether someone sends the forms too often. After that it is gone.
• Your language choice is remembered by your browser (in your browser’s local storage, not a cookie), so the site opens in your language next time. It is not sent to us.
• Visitor numbers are counted with Vercel Web Analytics. It works without cookies and does not store your IP address: a visit is recognised by a code that changes every day, so we cannot follow you across days. We only see totals: which pages are viewed, which site people come from, from which country and with which kind of device and browser.
• No cookies, no advertising and no services that follow you on the website. The fonts are hosted on our own server, so your browser does not connect to Google Fonts.

3. Where your data is stored

• On our server: at Supabase, in a data centre in Frankfurt (EU). Only you can access your own data; this is enforced in the database itself.
• On your phone: an encrypted copy (AES-256), so the app also works without internet. The key is in your phone’s secure storage. When you sign out, everything on your phone is deleted. Your conversations with Adam are stored only on your phone, not on our server.
• Website: the site runs at Vercel. The site’s server is in Frankfurt (EU); the pages themselves are distributed through Vercel’s global network. Waitlist and contact messages go through Resend.
• Widget: if you use the widget, your prayer times, today’s check marks and your score are stored on your phone for it. They are deleted when you sign out.

4. Artificial intelligence (AI)

Adam and the plate scan work with AI. You only use them after you have given separate consent for this in the app. You can withdraw that consent at any time.

• Adam uses Claude by Anthropic. For each question, the following goes there through our server: your question and the conversation so far (a summary and the latest messages), your first name, gender, age and height, your main goal and your goals (calories, water, steps, workouts, target weight and Quran reading), what you track in the app today and over the past two weeks (food, water, supplements, your day score and your steps as a percentage of your goal), your workouts of the past four weeks with sets and weights, your week plan, your weight over time, what you don’t eat, Adam’s notes (if memory is on) and the date. Also your prayers (which ones you ticked off and whether on time), your Quran reading, today’s adhkar and today’s prayer times; your phone sends the prayer times along, because only your phone knows where you are. This is data about your religion: it only goes to the AI if you give your explicit consent for it in the app. Adam only uses it to plan your day in a practical way and never judges, counts or praises your worship. If you ask about a scanned product, that product’s label goes along too.
• The plate scan uses Gemini by Google. The smaller photo of your plate goes there.
• Translating an ingredient list uses Claude by Anthropic. Only the public text of the label goes there, nothing about you.

For each AI request we only keep how much it cost and which model was used, never the content. The AI services may process the data outside the EU, under the agreements they have with us for this (the European Commission’s standard contractual clauses, and where it applies the EU-US Data Privacy Framework). We use the paid business services: with those, Anthropic and Google do not use your data to train their AI. An AI answer may contain mistakes and is not medical or religious advice.

5. Other services we use

With the services that process data on our behalf, data processing agreements apply; they are part of their business terms.

6. Why we may use your data

• To make the app work (the agreement with you): your account, what you track, your goals and your score.
• With your consent: the website’s waitlist (you confirm it yourself with a click).
• With your explicit consent: your religious and health data, Apple Health and Health Connect, your location, your camera, and the AI features.
• Legitimate interest: keeping the app safe (for example preventing abuse of the sign-in code), answering your message from the contact form, and anonymous counts to improve the app and the website (including visitor numbers). Those counts cannot be linked to you; for Adam, for example, we only count which topic a question was about, from a fixed list, never the question itself.

7. How long we keep your data

• As long as your account exists. If you delete your account (Profile → Account → Delete account), we erase all your data on our server. Everything on your phone is deleted when you sign out.
• What remains after deletion: a short entry in our admin log if an administrator did something with your account (only your member number and the reason, no email or content), anonymous counts, and temporary technical logs at Supabase, which disappear by themselves.
• Waitlist: until you unsubscribe, or until 3 months after the launch. A sign-up you do not confirm is not kept.
• Contact messages: as long as needed to help you, and at most 12 months after that.
• A pairing code for the watch is valid for 10 minutes. A note from Adam that you did not say yes to is deleted within a day.

8. Your rights

You may access your data, have it corrected, have it deleted, take it to another service, object and withdraw your consent. In the app you can yourself:

• download all your data (Profile → Account);
• delete your account and everything that belongs to it;
• withdraw the AI consent, and turn off Apple Health, Health Connect, location and camera in your phone’s settings.

For everything else, email privacy@fitmuslim.com. We respond within a month. If you disagree with us, you can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in your own country.

9. Age

FitMuslim is intended for people aged 16 and over.

10. Security

• Everything travels over the internet encrypted.
• The database only lets you access your own data, even if there is a bug in the app.
• Your data is stored encrypted on your phone.
• Keys for the AI services are only on our server, never in the app.
• Administrators do not see users’ health or religious data, and only see your email address if they request it separately. That is logged.

11. Changes

If we change something important in this policy, we will let you know in the app. The newest version is always on fitmuslim.com. The date of the latest version is always at the top.