Privacy Policy & Visitor Data

Our Core Privacy Commitment

We operate our own privacy-first analytics stack directly on our website hosting. We do not use third-party advertising networks, Google Analytics, tracking pixels, or third-party analytics SaaS. Your browsing data stays on the masjid's own server and is never sold, leased, or shared with third parties.

What We Collect

To ensure the website functions properly, understand community interest, and diagnose broken pages, we record pseudonymous interaction metrics:

• Page views and navigation: The page paths requested, timestamps, and route transitions.
• Interactions: Clicks on navigation links and buttons, and scroll milestones (25%, 50%, 75%, 100%).
• Form submissions: The name of the form submitted. We never record the contents, keystrokes, or text typed into form fields.
• Technical performance: Page loading speed and responsiveness metrics (such as LCP, FCP, TTFB, INP, and CLS) to optimize site performance on satellite and northern connections.
• Device context: Device category (desktop, tablet, mobile), browser, operating system, screen dimensions, and language preference.
• Referrers and campaigns: The referring domain that brought you here and any public campaign tags (UTM source, medium, campaign).
• Session replay (when enabled): Visual reproduction of user navigation with all input fields, sensitive text, and third-party contact details strictly masked and excluded.

Pseudonymous Identifiers & IP Protection

Our analytics is pseudonymous, not anonymous:

• No tracking cookies: We do not set third-party or persistent HTTP tracking cookies. Instead, a random 22-character identifier is kept in your browser's local storage to recognize returning visits across sessions.
• No raw IP storage: Your IP address is never written to disk or database. We calculate an ephemeral HMAC-SHA256 hash using a cryptographic salt that automatically rotates every 24 hours UTC. This detects malicious bot traffic without retaining your real IP.

Retention Policy

• Activity and event logs: Retained for at most 12 months, after which records are automatically pruned.
• Session replay chunks: Retained for at most 30 days, after which replay recordings are permanently deleted.

Honoring Your Privacy Preferences

We respect your browser's privacy signals:

• Global Privacy Control (GPC): If your browser sends the GPC signal, all telemetry is disabled automatically.
• Do Not Track (DNT): If your browser has Do Not Track enabled, no telemetry events or session recordings are sent.
• On-site opt-out: You can opt out at any time using the controls below.

Access & Deletion Requests

You have the right to request access to or deletion of any telemetry data linked to your browser. Because we do not collect your name or email, we identify your records solely by your pseudonymous Visitor ID. To delete your records, copy your Visitor ID below and send it to the masjid administration at our contact email. Once requested, your records are deleted immediately and a tombstone ensures no in-flight events can recreate them.