Skip to the main content

Trust · Privacy

What Qutb holds,
and for whom.

Qutb runs the websites, giving, classes and screens of the masajid on it. This notice says what the platform processes, on whose behalf, which organisations help, and what is still undecided.

Written by the Qutb team · pending legal review

Last updated

Who is responsible

Each masjid on Qutb decides what it asks of its congregation and what it keeps. Qutb holds and processes those records on the masjid’s behalf, so the masjid is the first place to ask about them.

For the platform’s own address, qutb.one, and for people who apply to bring a masjid to Qutb, Qutb itself is responsible.

What the platform processes

Members
The names, email addresses and phone numbers a masjid records, roles, and volunteer shifts.
Giving
The amount, fund, date and receipt of each donation. A donor can give without an account, and card details never reach Qutb.
Maktab
For a child a guardian enrols: the enrolment, attendance, hifz progress and report cards. These carry the platform’s strictest isolation tests.
Assistance
A request for help from a masjid and the notes its committee keeps, under the same strictest tests.
Questions and messages
A question put to the imam, and its answer if the masjid publishes one; the address an email goes to, and whether it arrived.
Founders
A person applying to bring a masjid to Qutb: the application keeps two names, and the email address only as a peppered hash. Signing in is handled by the identity provider below.
Screens and kiosks
A device’s enrolment and health. No person’s record.
Visitors
Public pages on qutb.one set no cookie and carry no analytics or advertising script.

The organisations that help

These are the organisations the platform’s code sends personal data to. Each is named from the place in the code that engages it, and that place is printed beside it so anyone can check.

  • Google Cloud

    For
    Hosting and the database, in Google’s us-central1 region in the United States.
    What reaches it
    Every record the platform keeps.
    In the code
    infra/gcp/README.md:3

  • Google Cloud Identity Platform

    For
    Sign-in for a masjid’s administrators, staff and members, and for a founder bringing a masjid to Qutb.
    What reaches it
    The email address a person signs in with, and the password they set on Google’s service, which never passes through Qutb’s servers.
    In the code
    packages/members-crm/src/infrastructure/auth/GcipMemberPrincipalAdapter.ts:121

  • Resend

    For
    The email the platform sends: a masjid’s announcements and notices, a donor’s receipts and giving statements, and the links that set a password.
    What reaches it
    The address an email goes to, and the email.
    In the code
    packages/communications/src/infrastructure/ResendReachTransport.ts:62

  • Twilio

    For
    Text messages: a masjid’s notice, sent as a text to a member who gave a phone number.
    What reaches it
    The phone number a message goes to, and the message.
    In the code
    packages/communications/src/infrastructure/TwilioSmsReachTransport.ts:25

  • Anthropic

    For
    Qutb AI’s drafting, when someone at a masjid asks it to draft an announcement.
    What reaches it
    Only the brief that person typed. The request has no other text field, so no member record, masjid name or identifier is attached to it.
    In the code
    packages/qutb-ai/src/infrastructure/AnthropicCloudAiProvider.ts:4

  • Stripe

    For
    Card payments: donations, and what a masjid charges for its programmes and gatherings.
    What reaches it
    The payment and what it is for. Card details are typed into Stripe’s own page or reader and never pass through Qutb.
    In the code
    packages/giving-ledger/src/infrastructure/stripe/StripePaymentAdapter.ts:65

  • Google Maps Platform

    For
    Address search at the founder’s door: the Places API (New) completes the address a founder types, and the Time Zone API sets the masjid’s time zone.
    What reaches it
    The address text a founder types while founding a masjid, and the place they pick. It carries no member record.
    In the code
    apps/web/src/infrastructure/googlePlaces.ts:18

  • Cloudflare

    For
    A masjid’s own web address: registering a new domain name for a masjid whose paid plan includes one, and connecting a domain a masjid already owns.
    What reaches it
    The domain name a masjid chose and, for a domain Qutb registers, the e-mail address given as its contact so the registry can confirm it. Nothing about a member, a donor or a donation.
    In the code
    packages/tenancy-theming/src/infrastructure/CloudflareDomainRegistrarAdapter.ts:59

  • Google Firebase Crashlytics

    For
    A report of a crash in the Qutb app, sent only when the person using it says yes — once, or from then on.
    What reaches it
    What the app was doing when it failed, and the phone’s model and system and the app’s version. Collection is off until the person turns it on.
    In the code
    apps/mobile/src/infrastructure/nativeShell.ts:57

  • Expo

    For
    Push notices to the Qutb app: a masjid’s announcements, for a member who turned notices on.
    What reaches it
    The phone’s push address and the notice’s title and words. Anything else the notice carries is an id.
    In the code
    packages/communications/src/infrastructure/ExpoPushReachTransport.ts:24

A masjid that streams its khutbah links to the video host it chose. Following that link takes you to the host, under its own terms.

How long records are kept

Ruled 21 September 2026 by canon/adr/ADR-0054.md D1, which answers open question #4. What is not named below is not yet ruled.

A child’s given name, family name and date of birth
While they hold a place, and 30 days after the place ends — withdrawn, or the class closed. Then deleted from the live database.
An assistance case’s detail — the applicant’s account, phone, email and address, and the notes on each action
12 months after the case closes. Then purged; the record of what was decided, who decided it and the money moved stays.
Ledger facts — donations, purchases, receipts
At least 7 years. They hold ids and amounts only; no donor name or email is stored in the ledger itself.
The receipt address of someone who gave without an account, and a guest ticket buyer’s name and address
Until the person asks the masjid to erase them, and at most 7 years after their last gift or purchase. Then erased; the donation or the ticket stays in the masjid’s records without them.
The names someone gave when they asked to join a masjid
While the masjid’s 30-day joining window is open, then as a lapsed request; 12 months after the request was settled — joined or refused — the whole record is deleted. A request the office has not yet judged stays until it does.
A question someone asked the imam, and the answer written to it
Where the asker left an address for the reply, the address — and the name they chose to give — leave the moment the question is archived. The question’s own words, and the answer, are kept 12 months after the archive for the masjid to read, then replaced by a marker; the record that the question was asked, answered and archived stays.
Application logs
30 days.
Database backups
The ruled ceiling is 30 days. Production keeps them for 7 days today, which is also how long an erasure takes to leave every copy once it is requested.

Your choices

  • To see, correct or remove what a masjid holds about you, ask that masjid first, or write to us at salam@qutb.one.
  • Signed in on your masjid’s own site, your account page lets you download a copy of what that masjid holds about you, erase your name and number, and leave the masjid. In the Qutb app, “Delete my Qutb account” erases you from every masjid you belong to and closes your sign-in. Your donations and their receipts stay in each masjid’s records without your name — a receipt is never rewritten. Every way to close the account, and what stays, is on the account-deletion page.
  • For what the account page does not reach — a donation made without an account, an application to bring a masjid to Qutb — write to us at salam@qutb.one.
  • You can give to a masjid without making an account.

Security, and reporting a weakness

Each masjid’s records are kept apart from every other masjid’s by the database itself: every query runs under that masjid’s row-level security, and an attack suite tries to read across that line against a real database.

If you find a weakness, write to salam@qutb.one before telling anyone else, and give us time to fix it. Please do not read, change or delete more of any masjid’s records than you need to show the problem. The same address is published for scanners at /.well-known/security.txt.

Changes to this notice

Last updated on 10 October 2026. The list of organisations above is checked against the code by the platform’s own tests, so it cannot quietly fall behind what the platform does.