1Siapa kami
Iqamah ialah aplikasi waktu solat untuk Malaysia, dikendalikan oleh Teras Core Technology Sdn. Bhd. (No. pendaftaran 202601029932 (1692027)), beralamat di No 26-1 Jalan Sunsuria 1B/2, Jasper Square, Bandar Sunsuria, 43900 Sepang, Selangor, Malaysia. Dalam dokumen ini, "kami" bermaksud syarikat itu, dan "app" bermaksud aplikasi Iqamah pada iOS dan Android serta laman iqamah.my.
Untuk sebarang soalan privasi, emel hello@iqamah.my.
2Data yang kami kumpul
Kebanyakan orang yang menggunakan Iqamah tidak pernah mencipta akaun, dan kami tidak tahu siapa mereka. Jadual ini disusun mengikut apa yang anda buat, bukan mengikut kategori undang-undang, supaya anda boleh terus melompat ke baris yang berkenaan dengan anda.
Kalau anda hanya melihat waktu solat
| Data | Kenapa |
|---|---|
| Koordinat peranti (jika anda beri kebenaran) | Menentukan zon JAKIM anda dan menyusun tempat berdekatan mengikut jarak. Lihat seksyen 3. |
| Alamat IP dan laluan yang dipanggil | Dicatat oleh pelayan web kami untuk keselamatan dan had kadar (menghalang seseorang membanjiri API). |
| Tetapan app: bandar pilihan, waktu yang dinotifikasi, kiraan zikir, perjalanan tersimpan | Disimpan pada peranti anda. Jika anda log masuk, ia turut disegerakkan ke akaun anda (lihat bahagian akaun di bawah). Tanpa log masuk, ia tidak dihantar kepada kami. |
Kalau anda menghidupkan notifikasi
| Data | Kenapa |
|---|---|
| Token peranti daripada Apple atau Google | Alamat teknikal untuk menghantar notifikasi. Ia bukan nama dan bukan nombor telefon anda. |
| Kod zon, bahasa peranti, versi app, waktu app terakhir dilihat | Menghantar pengumuman kepada zon yang betul, dan mengenal pasti token yang sudah mati. |
Kalau anda mencipta akaun
| Data | Kenapa |
|---|---|
| Alamat emel dan nama paparan | Mengenal pasti akaun anda dan menghantar emel penting. |
| Kata laluan (hanya akaun emel lama) | Pendaftaran baharu hanya melalui Apple atau Google. Akaun emel yang dibuat sebelum ini menyimpan kata laluan sebagai hash sehala; kami tidak boleh membacanya. |
| Data sync: tanda Al-Quran, kiraan zikir, tetapan, perjalanan, itinerari dan maklumat kumpulan Umrah (nama hotel, alamat, mutawwif, nombor telefon, titik pertemuan) | Menyegerakkan data anda merentas peranti selepas anda log masuk. Dipadam apabila anda memadam akaun. |
| Pengenal Google atau Apple (jika anda log masuk secara sosial) | Memaut log masuk itu kepada akaun anda. Dengan Apple, kami menerima apa sahaja yang anda pilih untuk dikongsi, termasuk alamat emel lindung Apple. Dengan Google, kami turut menerima gambar profil jika ia dikongsi. |
| Log emel: template, alamat penerima, subjek, status hantar | Membuktikan emel penting (keputusan listing dan notis akaun) benar-benar dihantar. |
Kalau anda menghantar listing perniagaan
| Data | Kenapa |
|---|---|
| Nama tempat, kategori, keterangan, tawaran, alamat, koordinat, gambar | Inilah listing itu sendiri. Ia dipaparkan secara awam selepas diluluskan. |
Listing ialah kandungan awam. Jangan letak di dalamnya apa-apa yang anda tidak mahu orang ramai lihat.
3Lokasi anda, khususnya
Bahagian ini kami tulis panjang sedikit, kerana inilah data paling sensitif yang disentuh app waktu solat.
- Kebenaran ada di tangan anda. Tolak kebenaran lokasi dan app tetap berfungsi penuh, pilih bandar anda secara manual, dan semuanya berjalan seperti biasa.
- Untuk waktu solat di Malaysia, koordinat tidak perlu meninggalkan telefon langsung: app memadankan lokasi anda dengan zon JAKIM pada peranti, kemudian meminta takwim zon itu.
- Untuk tempat berdekatan dan waktu solat di luar Malaysia, koordinat dihantar kepada API kami untuk memulangkan jawapan. Kami tidak menulisnya ke dalam pangkalan data dan tidak membina sejarah pergerakan sesiapa. Permintaan itu muncul dalam log akses pelayan seperti mana-mana permintaan web lain, bersama alamat IP.
- Arah kiblat dikira pada peranti daripada lokasi dan kompas anda. Paparan camera dalam mod AR tidak dirakam, tidak disimpan, dan tidak dihantar ke mana-mana.
- Penerbangan menghantar lapangan terbang serta waktu tiket anda kepada API untuk mengira waktu solat sepanjang laluan. Jika anda log masuk, perjalanan yang anda simpan (destinasi, tarikh, penerbangan, nota itinerari) disegerakkan ke akaun anda supaya boleh dipulihkan pada peranti lain. Tiket atau tangkapan skrin yang anda import dibaca pada peranti anda dan fail asalnya tidak dihantar kepada kami.
4Apa yang kami tidak buat
- Tiada iklan pihak ketiga. Tiada banner, interstitial, atau video ads dalam app. Kad tajaan berlabel "Ditaja" daripada peniaga tempatan boleh muncul dalam senarai tempat. Ia dipilih ikut kawasan kasar anda (koordinat tidak disimpan), dan hanya kiraan paparan dan ketukan agregat direkod, tanpa pengenal pengguna, peranti atau IP.
- Tiada rangkaian iklan. Tiada SDK pengiklanan pihak ketiga, jadi tiada profil pengguna untuk dikongsi dengan sesiapa.
- Tiada analitik pihak ketiga. Tiada Firebase Analytics, tiada Google Analytics, tiada SDK Meta, tiada Mixpanel, tiada Amplitude.
- Tiada penjualan data. Kami tidak menjual, menyewa atau menukar data peribadi anda. Satu-satunya perkongsian dengan platform iklan ialah emel yang encrypted, dan hanya jika anda bersetuju secara berasingan (seksyen 5 dan 6). Menolak tidak menjejaskan mana-mana ciri app.
- Tiada pengumpulan data pengecam pengiklanan seperti IDFA. App tidak memintanya.
5Kenapa kami memproses data ini
Setiap perkara yang disenaraikan di seksyen 2 diproses untuk salah satu sebab berikut:
- Untuk memberi anda perkhidmatan yang anda minta: waktu solat, arah kiblat, tempat berdekatan, notifikasi yang anda hidupkan.
- Atas kebenaran anda: akses lokasi dan notifikasi, yang boleh ditarik balik bila-bila masa dalam tetapan peranti.
- Untuk menunaikan kontrak: listing perniagaan yang anda hantar.
- Emel pemasaran, atas persetujuan anda: jika anda bersetuju, Teras Core Technology Sdn. Bhd. menggunakan emel anda untuk menghubungi anda tentang ciri baharu, kemas kini dan app lain di bawah jenama dalam kumpulan kami. Anda boleh berhenti dengan pautan henti langganan dalam emel itu, dengan suis dalam Akaun, atau dengan mengemel hello@iqamah.my.
- Iklan sasaran, atas persetujuan berasingan anda: jika anda bersetuju dan membenarkan kebenaran penjejakan pada iPhone (ATT), emel anda encrypted (SHA-256) dan dimuat naik ke platform iklan seperti Meta supaya kami boleh menunjukkan iklan Iqamah dan app lain kami kepada anda atau orang serupa anda. Platform itu memprosesnya mengikut dasar mereka sendiri. Anda boleh menariknya balik dalam Akaun, dan kami mengeluarkan anda daripada khalayak iklan seterusnya. Menolak tidak mengubah apa-apa ciri app.
- Untuk keselamatan sistem: log akses dan had kadar yang menghalang penyalahgunaan.
6Pihak ketiga yang terlibat
Kami cuba menyimpan senarai ini sependek mungkin. Inilah keseluruhannya:
| Pihak | Apa yang mereka terima |
|---|---|
| Apple (APNs) | Token peranti dan isi notifikasi, untuk menghantarnya ke iPhone anda. |
| Apple (Sign in with Apple) | Hanya jika anda memilihnya. Kami menerima pengenal dan emel yang anda benarkan. |
| Google (Sign in with Google) | Hanya jika anda memilihnya. Kami menerima pengenal, emel dan gambar profil akaun Google anda. |
| ZeptoMail (Zoho) | Alamat emel dan isi emel transaksi yang kami hantar kepada anda. |
| TerasMap (Teras Core Technology Sdn. Bhd., operator yang sama) | Butiran tempat yang anda sumbang (status, parkir, tandas, akses, ruang wanita, kemudahan, alamat) dan gambar yang anda muat naik, bersama nama paparan anda sebagai penyumbang. Tiada emel, id pengguna atau IP dihantar. Perkongsian ini dua hala: sumbangan pengguna TerasMap turut dipaparkan dalam Iqamah. |
| Meta Platforms (Facebook, Instagram) | Hanya jika anda bersetuju untuk iklan sasaran dan membenarkan penjejakan. Emel anda yang encrypted (SHA-256), bukan teks asal. |
| DigitalOcean | Menghoskan pelayan dan pangkalan data kami. |
| JAKIM e-Solat | Tiada data pengguna. Kami mengambil takwim zon dan menyimpannya; permintaan anda tidak sampai kepada mereka. |
| OpenStreetMap | Tiada data pengguna. Sumber data lokasi masjid dan surau, dimuat turun sekali dan disimpan oleh kami. |
7Di mana data disimpan, dan berapa lama
Pelayan dan pangkalan data kami berada di Singapura pada DigitalOcean. Apple, Google dan ZeptoMail memproses data mereka di luar Malaysia mengikut dasar masing-masing.
| Apa | Berapa lama |
|---|---|
| Akaun, listing, pesanan | Selagi akaun anda wujud. Ia dipadam apabila anda memadam akaun. |
| Token refresh sesi | 30 hari, atau sehingga anda log keluar. Token akses hidup 15 minit sahaja. |
| Token peranti notifikasi | Sehingga anda mematikan notifikasi, memadam app, atau token itu ditolak oleh Apple. |
| Log emel | 12 bulan, kemudian dipadam secara automatik. |
| Log akses pelayan (termasuk IP) | Berputar mengikut saiz, lima fail, 20 MB setiap satu, kemudian ditimpa secara automatik. |
| Takwim waktu solat dan data masjid | Disimpan selama-lamanya. Ia bukan data peribadi. |
8Hak anda di bawah PDPA
Akta Perlindungan Data Peribadi 2010 memberi anda hak untuk meminta akses kepada data peribadi anda, membetulkan data yang tidak tepat, menarik balik kebenaran, dan menghadkan pemprosesan untuk tujuan tertentu.
Emel hello@iqamah.my dan kami akan membalas dalam masa 21 hari dari tarikh kami menerima permintaan yang lengkap. Kami mungkin perlu mengesahkan bahawa anda benar-benar pemilik akaun itu sebelum bertindak, supaya orang lain tidak boleh meminta data anda dengan berpura-pura menjadi anda.
9Cara memadam data anda
- Dari dalam app: Akaun → Padam akaun. Ini memadam akaun anda dan setiap listing yang anda hantar, terus daripada pangkalan data.
- Tiada akaun? Padam app sahaja. Semua tetapan dan kiraan zikir berada pada peranti anda, jadi ia hilang bersamanya.
- Notifikasi: matikan dalam tetapan iOS atau Android, dan token peranti berhenti berguna lalu dibuang.
Beberapa rekod mungkin kekal selepas pemadaman apabila undang-undang menghendakinya: contohnya rekod pembayaran untuk tujuan cukai dan perakaunan.
10Kanak-kanak
Iqamah sesuai untuk semua umur dan tidak mengandungi iklan pihak ketiga. Kami tidak mengumpul data peribadi daripada kanak-kanak dengan sengaja, dan akaun tidak diperlukan untuk menggunakan app. Kalau anda ibu bapa dan percaya anak anda telah mencipta akaun, emel kami dan kami akan memadamkannya.
11Perubahan pada dasar ini
Kalau kami mengubah dasar ini dengan cara yang penting, contohnya mengumpul jenis data baharu, kami akan mengemas kini tarikh di atas dan memberitahu dalam app sebelum perubahan itu berkuat kuasa. Kami tidak akan menambah rangkaian iklan atau penjualan data secara senyap dalam satu kemas kini.
12Hubungi kami
Emel: hello@iqamah.my
Operator: Teras Core Technology Sdn. Bhd. (SSM 202601029932 (1692027))
Alamat surat: No 26-1 Jalan Sunsuria 1B/2, Jasper Square, Bandar Sunsuria, 43900 Sepang, Selangor, Malaysia
Telefon dan WhatsApp: +60 18-588 2459, Isnin hingga Jumaat, 9 pagi hingga 6 petang (MYT)
1Who we are
Iqamah is a prayer-time app for Malaysia, operated by Teras Core Technology Sdn. Bhd. (Registration No. 202601029932 (1692027)), located at No 26-1 Jalan Sunsuria 1B/2, Jasper Square, Bandar Sunsuria, 43900 Sepang, Selangor, Malaysia. In this document, "we" means that company, and "the app" means the Iqamah app on iOS and Android, together with the iqamah.my website.
For any privacy question, email hello@iqamah.my.
2Data we collect
Most people who use Iqamah never create an account, and we don't know who they are. This table is organised by what you do, not by legal category, so you can jump straight to the row that applies to you.
If you only view prayer times
| Data | Why |
|---|---|
| Device coordinates (if you grant permission) | Determines your JAKIM zone and sorts nearby places by distance. See section 3. |
| IP address and route called | Logged by our web server for security and rate-limiting (to stop someone flooding the API). |
| App settings: chosen city, notified prayers, zikir counts, saved trips | Stored on your device. If you sign in, they are also synced to your account (see the account section below). Without signing in, they are never sent to us. |
If you turn on notifications
| Data | Why |
|---|---|
| Device token from Apple or Google | A technical address used to deliver notifications. It is not your name or phone number. |
| Zone code, device language, app version, last-seen time | Sends announcements to the right zone, and identifies tokens that have gone stale. |
If you create an account
| Data | Why |
|---|---|
| Email address and display name | Identifies your account and sends important emails. |
| Password (legacy email accounts only) | New sign-ups are only through Apple or Google. Email accounts created earlier store the password as a one-way hash; we cannot read it. |
| Sync data: Quran bookmarks, zikir counts, settings, Musafir trips, itineraries and Umrah group details (hotel name, address, guide, phone number, meeting point) | Syncs your data across devices after you sign in. Deleted when you delete your account. |
| Google or Apple identifier (if you sign in socially) | Links that sign-in to your account. With Apple, we receive whatever you choose to share, including Apple's private relay email. With Google, we also receive your profile photo if it is shared. |
| Email log: template, recipient address, subject, delivery status | Proves important emails (listing decisions and account notices) were actually delivered. |
If you submit a business listing
| Data | Why |
|---|---|
| Place name, category, description, offers, address, coordinates, photos | This is the listing itself. It is shown publicly once approved. |
A listing is public content. Don't put anything in it that you don't want the public to see.
3Your location, specifically
We've written this section a little longer, because this is the most sensitive data a prayer-time app touches.
- Permission is entirely yours to give. Decline location permission and the app still works fully, pick your city manually, and everything runs as normal.
- For prayer times inside Malaysia, coordinates never need to leave your phone at all: the app matches your location to a JAKIM zone on-device, then requests that zone's calendar.
- For nearby places and prayer times outside Malaysia, coordinates are sent to our API to return an answer. We do not write them to any database and we do not build a movement history for anyone. That request appears in the server's access log like any other web request, alongside its IP address.
- Qibla direction is calculated on-device from your location and compass. The camera view in AR mode is never recorded, never stored, and never sent anywhere.
- Flights send your airports and ticket times to the API to calculate prayer times along the route. If you sign in, trips you save (destination, dates, flights, itinerary notes) are synced to your account so they can be restored on another device. Tickets or screenshots you import are read on your device and the original file is never sent to us.
4What we never do
- No third-party ads. No banners, interstitials, or video ads in the app. Labelled "Sponsored" cards from local merchants may appear in place lists. They are chosen by your rough area (coordinates are not stored), and only aggregate view and tap counts are recorded, with no user, device or IP identifier.
- No ad networks. No third-party advertising SDKs, so there's no user profile to share with anyone.
- No third-party analytics. No Firebase Analytics, no Google Analytics, no Meta SDK, no Mixpanel, no Amplitude.
- No selling of data. We do not sell, rent, or trade your personal data. The only sharing with advertising platforms is of your hashed email, and only if you separately agree (sections 5 and 6). Declining does not affect any feature of the app.
- No collection of advertising identifiers such as IDFA. The app never requests them.
5Why we process this data
Everything listed in section 2 is processed for one of these reasons:
- To provide the service you asked for: prayer times, Qibla direction, nearby places, notifications you turned on.
- With your consent: location and notification access, which can be withdrawn at any time in your device settings.
- To fulfil a contract: the business listing you submit.
- Marketing emails, on your consent: if you agree, Teras Core Technology Sdn. Bhd. uses your email to contact you about new features, updates and other apps under the brands in our group. You can stop with the unsubscribe link in those emails, with the switch in Account, or by emailing hello@iqamah.my.
- Targeted ads, on your separate consent: if you agree and allow the tracking permission on iPhone (ATT), your email is hashed (SHA-256) and uploaded to advertising platforms such as Meta so we can show you, or people similar to you, ads for Iqamah and our other apps. Those platforms process it under their own policies. You can withdraw in Account, and we remove you from later ad audiences. Declining does not change any feature of the app.
- For system security: access logs and rate limits that prevent abuse.
6Third parties involved
We try to keep this list as short as possible. Here is all of it:
| Party | What they receive |
|---|---|
| Apple (APNs) | Device token and notification content, to deliver it to your iPhone. |
| Apple (Sign in with Apple) | Only if you choose it. We receive the identifier and email you authorise. |
| Google (Sign in with Google) | Only if you choose it. We receive your Google account's identifier, email and profile photo. |
| ZeptoMail (Zoho) | The email address and content of transactional emails we send you. |
| TerasMap (Teras Core Technology Sdn. Bhd., the same operator) | Place details you contribute (status, parking, toilets, access, women's space, facilities, address) and photos you upload, with your display name as contributor. No email, user ID or IP is sent. The sharing goes both ways: contributions by TerasMap users also appear in Iqamah. |
| Meta Platforms (Facebook, Instagram) | Only if you agree to targeted ads and allow tracking. Your hashed email (SHA-256), not the original text. |
| DigitalOcean | Hosts our server and database. |
| JAKIM e-Solat | No user data. We fetch and cache zone calendars; your request never reaches them. |
| OpenStreetMap | No user data. Source of mosque and surau location data, downloaded once and stored by us. |
7Where data is stored, and for how long
Our server and database are located in Singapore on DigitalOcean. Apple, Google and ZeptoMail process their own data outside Malaysia under their respective policies.
| What | How long |
|---|---|
| Account, listings, orders | As long as your account exists. Deleted when you delete your account. |
| Session refresh token | 30 days, or until you sign out. Access tokens live for 15 minutes only. |
| Notification device token | Until you turn off notifications, delete the app, or the token is rejected by Apple. |
| Email logs | 12 months, then deleted automatically. |
| Server access logs (incl. IP) | Rotated by size, five files, 20 MB each, then automatically overwritten. |
| Prayer-time calendars and mosque data | Kept indefinitely. It is not personal data. |
8Your rights under the PDPA
The Personal Data Protection Act 2010 gives you the right to request access to your personal data, correct inaccurate data, withdraw consent, and limit processing for specific purposes.
Email hello@iqamah.my and we will respond within 21 days from the date we receive a complete request. We may need to verify you are genuinely the account holder before acting, so that nobody else can request your data by pretending to be you.
9How to delete your data
- From inside the app: Account → Delete account. This deletes your account and every listing you submitted, straight from the database.
- No account? Just delete the app. All settings and zikir counts live on your device, so they disappear with it.
- Notifications: turn them off in iOS or Android settings, and the device token stops being useful and is discarded.
Some records may remain after deletion where the law requires it: for example payment records kept for tax and accounting purposes.
10Children
Iqamah is suitable for all ages and contains no third-party advertising. We do not knowingly collect personal data from children, and no account is required to use the app. If you are a parent and believe your child has created an account, email us and we will delete it.
11Changes to this policy
If we change this policy in a material way, for example collecting a new type of data, we will update the date above and notify you in the app before the change takes effect. We will not quietly add an ad network or start selling data in a routine update.
12Contact us
Email: hello@iqamah.my
Postal address: No 26-1 Jalan Sunsuria 1B/2, Jasper Square, Bandar Sunsuria, 43900 Sepang, Selangor, Malaysia