Privacy Policy

Who we are

First Light is made by BOS Studio, an independent developer based in the United States ("BOS Studio", "we", "us"). This policy covers the First Light app, the service at athan.bosstudio.org, masjid invite pages and masjid display screens (together, "First Light"). BOS Studio decides how and why this information is used (the "controller" under European data protection law).

Questions or requests: help@bosstudio.org.

What stays on your phone

Your location, prayer and calculation settings, alerts, Quran reading progress, bookmarks, recitations, English read-aloud clips and word timings you have downloaded, tasbih counts, appearance choices and your answer to the age question asked before an account are stored only on your device. We never receive them. Deleting the app deletes them.

Prayer times and the Qibla direction are calculated on your phone from your location. The app asks for your location only while you use it (precise if you allow it, since a few kilometres can move prayer times, or approximate if you choose), reads it once, keeps it on your phone, and you can pick a city from a built-in list instead. Prayer alerts are scheduled by your phone; no server sends them.

If you tap "Scan a masjid's code", the app asks for the camera. Camera frames are read on your phone to find the code and immediately discarded; they are never saved or uploaded. The app never uses the microphone.

What we collect

You can use prayer times, alerts, the Quran, Qibla, tasbih, the timetable and Ramadan tools without giving us anything. We receive information only when you use community features:

The app asks for a push token only once you follow a masjid with announcement notifications on and notifications allowed on your phone. Turn Announcements off in the masjid's settings, or leave every masjid, and the app deletes the token and clears it from our server; announcements then appear when the app refreshes.

What we never collect

• Your precise or approximate location, or location history (search coordinates are rounded and discarded).
• Contacts, photos, files, microphone audio, health data or browsing history.
• Advertising identifiers. First Light has no ads and does not track you across other companies' apps or websites.
• Analytics, crash reports or usage tracking.
• Server access logs or IP addresses; our web server's access logging is turned off. (To block abuse, our web server keeps short-lived request counts per address in memory only, never on disk, and they are not tied to anything you do.)
• Payment card or bank details.

How we use it

We use the information above only to provide First Light: to run your account, publish and deliver masjid information, manage hosting plans and admin access, answer support requests, prevent abuse and keep the service secure, and meet legal obligations. We do not use it for advertising, profiling, selling, automated decisions about you, or training artificial-intelligence models.

Legal bases (for people in the European Economic Area, the UK and similar places): performing our contract with you (accounts, communities, hosting); our legitimate interests in keeping First Light secure and free of abuse (bot checks, rate limits); your consent (location, camera, notifications, and following a masjid, which you can withdraw at any time); and legal obligations.

Religious information

First Light is an Islamic prayer app, so having an account, following a masjid or hosting one may suggest your religious beliefs. Many privacy laws treat that as sensitive information. We treat all account and community information that way: we use it only to provide the features you ask for, never for advertising or profiling, and never sell or share it. Where the law requires your consent to process it, you give that consent when you create an account, follow a masjid or host one, and you can withdraw it by leaving the masjid or deleting your account.

Who we share it with

We do not sell your personal information, share it for targeted advertising, or give it to data brokers. Information leaves us only in these cases:

• Public masjid content. What a host publishes (masjid details, times, announcements, display settings) can be seen by anyone using First Light, its invite pages or a masjid's display screen. Account names, emails, member identities and admin lists are never public.
• Masjid owners and admins see the number of members, never who they are. Only an owner sees their community's admin email list.
• Service providers that run First Light for us under their own security and privacy terms, listed below. They may use the information only to provide their service.
• When you ask us to. For example, when you share a masjid link, your phone's share sheet sends it where you choose.
• Legal reasons. If required by law, valid legal process, or to protect the rights, safety or property of our users, the public or BOS Studio. Where the law allows, we will tell you before disclosing your information.
• Business transfer. If First Light is transferred to a new owner, your information may move with it, still covered by this policy, and we will tell you in the app first.

Other services

• Microsoft Azure hosts our server, database and the audio files below.
• Apple and Google handle sign-in when you choose them, and payment for hosting plans, under their own privacy policies.
• Our email delivery provider sends sign-up and password-reset codes to your address, and, if you host a masjid, the code that deleting it takes.
• Google Firebase Cloud Messaging, with Apple's push service on iPhone, delivers announcements from the masjids you follow while announcement notifications are on. We send it your push token and the announcement (the masjid's name, its title and text); it sees your IP address under its own privacy policy (see Firebase privacy).
• Cloudflare Turnstile and Google Firebase App Check (using Apple App Attest or Google Play Integrity) check that a sign-up or password-reset request comes from the genuine app and a person. They see your IP address and device signals under their own privacy policies (see Cloudflare's Turnstile privacy addendum and Firebase privacy); we receive only a yes or no.
• Google Fonts would serve a typeface style, without any account or location information, only if one that isn't built into the app were ever needed. Like any website, it sees your IP address and may keep it under its own policy.

Athan voices, Quran recitations, the English read aloud and word timings come from our own server, like this page. The app downloads each file once and keeps it on your phone. The server keeps no record of who downloads what; it counts only the total amount of audio sent each month, with no address or file name, so that audio can pause until the next month if a monthly allowance is used up. Files already on your phone keep playing.

We are not responsible for the privacy practices of these services; please read their policies.

How long we keep it

• Accounts, and the communities and posts they host, are kept until you delete them.
• Each masjid keeps its newest 200 posts; older ones are deleted automatically.
• Sign-in sessions end after 180 days unused.
• Device records (and the masjids they follow, and any push token) are deleted after 120 days without contact. A push token that Google reports as no longer valid is deleted at once.
• Admin addresses are kept until the owner removes them or deletes the community. Deleting the owner's account deletes its communities and their admin lists.
• Old public links of a masjid redirect for 90 days, then are deleted.
• Subscription records are deleted a year after the plan ends, or with your account. Redeem-code records are kept with your account and deleted with it.
• A community whose hosting subscription ended stays online for two months, then is taken down (hidden from search and its public pages, not deleted) so it can return if hosting resumes. It is deleted only when its owner deletes it or the account.
• An unconfirmed email sign-up is deleted after 15 minutes; a password-reset request after 15 minutes.
• Notes of when a code was sent to an address (as a one-way hash) are kept for 24 hours.
• Content reports are kept for 90 days, or until the masjid they concern is deleted.
• Support emails are kept as long as needed to answer you and for up to two years after.
• Copies of the database made for recovery before server updates are kept for up to 90 days.

We may keep information longer only where the law requires it, or to resolve a dispute or enforce our terms.

Security

Connections are encrypted (HTTPS). Passwords are stored only as salted, slow hashes; session tokens and device identifiers only as one-way hashes. Access to the server is restricted to BOS Studio. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Please keep your sign-in secure and tell us at help@bosstudio.org if you think your account has been misused.

Your choices and rights

Wherever you live, you can ask us to:

• access the personal information we hold about you, or receive a copy in a portable format;
• correct it;
• delete it (you can also do this yourself; see below);
• object to or restrict how we use it, or withdraw consent you gave.

Email help@bosstudio.org from the address on your account. To protect you, we may need to confirm the request comes from you before acting. You may use an authorized agent where the law allows; we may ask for proof of their authority. We answer within 30 days (45 days where a US state law allows, extendable once as the law permits). If we decline a request, you can appeal by replying to our answer, and we will respond to the appeal within the time the law requires. We will never treat you differently for using these rights.

On your phone you can turn off location, notifications and camera access at any time in system settings, and leave any masjid in the app.

Deleting your account

In the app: Tools → Communities → your account (top right) → Delete account. This immediately and permanently deletes your account, its sign-in sessions, every community you host with their posts and admin lists, and your subscription records. If you signed in with Apple, Apple asks you to confirm, and we revoke First Light's access to your Apple account at the same time (you can also remove it yourself under Sign in with Apple in your Apple Account settings). It doesn't cancel a hosting subscription with Apple or Google: cancel that in your App Store or Google Play subscriptions, or you may continue to be charged.

Without the app, email help@bosstudio.org from the address on the account. We confirm and delete it within 30 days.

To stop following masjids, leave them in the app or uninstall it; the device record is deleted after 120 days.

Children and teens

Under 13. Anyone may use First Light's on-device features (prayer times, alerts, the Quran, Qibla, tasbih and the Ramadan tools), which send us no personal information. Accounts are not for children under 13 (or under the minimum age in your country, up to 16, where the law sets one for using online services without a parent's consent). Before the first account on a phone, the app asks your age; that answer never leaves your phone. We do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has given us personal information, email help@bosstudio.org and we will delete it. If we learn that we hold an account belonging to a child under the minimum age, we will delete it.

Teens. If you are 13 or older but under 18 (or the age of adulthood where you live), you may create an account only with the permission of a parent or guardian, who agrees to our Terms of Service for you. Where a law requires it (for example in some US states), that consent is given through your app store's family and age tools, and First Light asks Apple or Google for your age range and consent status before an account, before hosting, and each time the app opens while you're signed in. That answer is used only to apply these age rules: it stays in the app's memory, is never saved or sent to us, and is never used for anything else. Where your app store reports your age, its answer replaces the app's own age question.

Hosting a masjid, buying a hosting plan, and being a masjid admin are only for adults (18 or older, or the age of adulthood where you live).

US state privacy notice

Residents of California and other US states with consumer privacy laws have the rights described in Your choices and rights, including to know, access, correct and delete their personal information and to appeal a decision. In the last 12 months we have collected these categories, from you or your device, for the purposes in How we use it, and kept them for the periods in How long we keep it:

• Identifiers: name, email address, account identifiers, a hashed random device identifier, and a push token.
• Commercial information: the hosting plan you bought and its renewal dates.
• Content you publish: masjid details and announcements (hosts only).
• Sensitive personal information: your account sign-in (email with password), and, because this is a religious app, information that may reveal religious beliefs. We use these only to provide the service you asked for and as the law allows, and never to infer characteristics about you.

We disclose these only to the service providers above, for business purposes. We do not sell or share personal information (as those words are defined in California law), have not done so in the last 12 months, and do not knowingly sell or share the information of anyone under 16. Because we never sell or share it, there is nothing to opt out of; we would honor Global Privacy Control signals if that changed.

Users outside the United States

First Light is operated from the United States. If you use community features, your information is processed in the United States and wherever our service providers operate, which may have different data protection laws from your country. Where the law requires, we rely on appropriate safeguards (such as our providers' standard contractual clauses) for these transfers. If you are in the European Economic Area, the UK or Switzerland and are not satisfied with our answer, you can complain to your local data protection authority.

Changes and contact

If this policy changes, the effective date above changes too. We will announce significant changes in the app before they take effect, and ask for your consent where the law requires it. We will never use information we already hold in a materially different way without telling you first.

Browsers' "Do Not Track" signals don't change anything here, because First Light does not track you.

Questions, requests or complaints: help@bosstudio.org.