No events match your filters.

Last updated: October 2026

1. Who We Are

Manarah is a service by Karamah Collective, a community organisation supporting Finnish Muslims through practical guidance and compassionate connections. This policy explains how we handle your information when you use this app.

2. Information We Collect

We collect information only when you voluntarily submit it, sign in, or choose to save/sync items:

Add a Place / Edit Place forms:

• Place name, type, address, Google Maps link, and tags
• Additional notes you choose to include

Contact form:

• Your name and email address (required)
• Phone number (optional)
• Your message

Signing in, ratings, reviews & saved places:

• Writing a review, or syncing your favourites, saved pins, visited places, and home location across devices, requires signing in through Firebase Authentication with Google, Microsoft, Facebook, or email/password
• For email/password accounts, Firebase handles sign-up, sign-in, password resets, and email verification. We never see or store your password
• Your rating (1 to 5), optional review text, and any review photos you choose to upload
• Saved place IDs, saved pin coordinates/names, visited-place IDs, and home location coordinates/name that you choose to sync
• If you choose “Add to timeline” while signed in, your device checks locally whether you are within 150 metres of the place and whether the location fix is precise enough. We store the place, a server-generated date/time, and a one-way account hash so you can see your private timeline; raw device coordinates and GPS accuracy are not sent or stored
• A one-way cryptographic hash of your verified email address — never the email address itself — used to link your reviews and synced saved data to your account and to prevent duplicate or abusive submissions

Place submissions are anonymous. Reviews and their uploaded photos are shown publicly without displaying your email address or any other sign-in detail.

3. What We Don't Do

• No advertising cookies, advertising pixels, ad targeting, or sale of personal data
• No analytics cookies, analytics local storage, identification profiles, or session replay
• Timeline checks are one-time and user-triggered, not background tracking. The server receives only the selected place ID after a successful device-side check; it cannot independently prove that a browser location fix was genuine
• Your timeline is your private account data. We do not publish it, share it with other users, use it for advertising, or use it to build a profile about you
• No live location tracking or current-position storage — your current position is used only in your browser for the map and is never sent to our servers. If you set a home location or save a custom pin, that chosen location is stored locally while signed out and synced to your account while signed in
• We use Cloudflare's approximate IP-based country/city signal only to show the correct regional context, such as a better first map view. It is not stored as your home location.
• We will never sell personal information or share it for advertising
• Contact details (name, email, phone, and message) are used solely to respond to your enquiry. They are sent by email through Brevo, so email delivery and SMTP processing are handled by Brevo rather than by us
• We do not store your email address for reviews or account sync — only a one-way hash, used solely to link them to your account. No plaintext email data is retained from any new review.

4. Cookieless product analytics

We use PostHog’s cookieless mode to understand aggregated use of Manarah, such as searches, place views, directions clicks, and feature use. It does not set cookies or use browser local or session storage. It does not create user profiles, link activity across days, identify signed-in accounts, or record sessions.

PostHog uses EU endpoints and a privacy-preserving daily server-side hash to count visitors. The hash is derived from technical connection information, including IP address, browser user agent, and hostname, with a changing daily salt; PostHog states that the raw inputs are not retained in the resulting hash. We send only the minimal event properties described here, never exact GPS coordinates, raw search text, names, email addresses, phone numbers, form or review text, Firebase details, or authentication tokens. We use these aggregate signals to improve Manarah, never for advertising.

Read PostHog’s Privacy Policy and its cookieless tracking guidance for more about this mode.

5. Cloudflare Web Analytics

We use Cloudflare Web Analytics to count visitors and understand general usage patterns. It is privacy-first by design:

• No cookies are set
• No personal data is collected or stored
• No cross-site tracking or fingerprinting
• Data is processed by Cloudflare, who already handles all traffic to this site

Cloudflare's privacy practices are described in the Cloudflare Privacy Policy.

6. Cloudflare Turnstile

We use Cloudflare Turnstile to protect forms and community actions from automated abuse. Turnstile may process technical browser and network information to determine whether an interaction is legitimate. It is governed by Cloudflare's Privacy Policy and Website Terms.

7. Third-Party Services

Manarah relies on the following external services. Each handles its own data independently:

• PostHog — Cookieless aggregate product analytics through EU endpoints. It does not receive user profiles, session replay, raw search text, precise location, or the contact and account data described above.
• Digitransit (HSL & Waltti) — Our primary routing and geocoding API. The HSL endpoint, provided by Helsinki Regional Transport Authority (HSL), covers the Greater Helsinki area. The Waltti endpoint covers the Turku / Föli region. Both are used to calculate public transport routes and to search for addresses in Finland. Governed by the Digitransit API terms.
• Transitous — Open-source community transit routing, used as a fallback when Digitransit is unavailable. Data sourced from GTFS feeds under open licences.
• OSRM (OpenStreetMap Routing Machine) — Fallback routing service for walking, cycling, and driving, used when Digitransit is unavailable. Powered by OpenStreetMap data under the ODbL licence.
• Nominatim / OpenStreetMap — Address search and reverse geocoding fallback. Data © OpenStreetMap contributors under ODbL.
• OpenFreeMap — Provides the map tiles and fonts powering the base map. Built on OpenMapTiles and OpenStreetMap data.
• Esri / ArcGIS — Satellite imagery layer, provided by Esri. Subject to Esri's terms of use.
• AlAdhan API — Prayer time calculations based on your device's location (using the Muslim World League method). No personal data is stored by this service.
• MapLibre GL JS — Open-source map rendering library used to display the map.
• Firebase Authentication — Handles signing in with Google, Microsoft, Facebook, or email/password. We never see or store your password; Firebase issues a verified identity token, which we reduce to a one-way hash before storing synced account data. Governed by Google's Privacy Policy, and additionally by Microsoft's Privacy Statement when signing in with a Microsoft account and Meta's Privacy Policy when signing in with Facebook.
• Brevo — Sends Manarah contact form messages to manarah@karamahcollective.com by email. Brevo handles the email delivery and SMTP processing for those messages under Brevo's own privacy policy. Contact form messages from new submissions are not stored in our D1 database.

8. Data Storage & Security

Place submissions, reviews, events, wishes, and account-synced saved data are transmitted over HTTPS and stored in a private Cloudflare D1 database accessible only to authorised Karamah Collective team members. Review photos are stored in a private Cloudflare R2 bucket and served publicly only while their review is published. Contact form messages are transmitted over HTTPS to our Cloudflare Function and sent to manarah@karamahcollective.com through Brevo; Brevo, not Manarah, handles the email delivery and SMTP processing for those messages. New contact messages are not stored in D1. Contact details are retained only as long as necessary to address your enquiry. Signing in is handled by Firebase Authentication (Google, Microsoft, Facebook, or email/password) — we never receive or store your password. Reviews and synced favourites, saved pins, visited places, and home location are linked to your account using only a one-way hash of your verified email address, retained to enforce review integrity (for example, one review per place per account) and provide account sync — your actual email address is never stored alongside this data. We implement appropriate measures to safeguard data against unauthorised access or loss.

Verified timeline events contain the canonical place ID/name and server-generated date/time, not raw device coordinates or GPS accuracy. They are stored only so your private timeline can work, are not published or used for advertising, and are removed by the existing “Erase my data” action.

9. Your Rights (GDPR)

Under EU data protection law, you have the right to access, correct, or request deletion of any data associated with your submissions. For place submissions (which are anonymous), please include details that help us identify the relevant entry. For contact form emails, include the email address you used and the approximate submission date. For reviews, review photos, and account-synced saved data, we can locate your data using the email address associated with your account.

Contact: manarah@karamahcollective.com

10. Children's Privacy

This service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16.

11. Featured Places

Some places in the app are marked as Featured. These are sponsored placements — businesses that support Manarah in exchange for increased visibility. Sponsored places are shown in the app as "Featured" for full transparency.

What this means in practice:

• Featured places appear in a highlighted carousel and receive a slight boost in list and search relevance
• All listings — featured or not — are community-sourced and subject to the same review process
• Being featured has no effect on a place's halal verification status or tags
• We do not sell, share, or monetise any user data — featuring is the only form of promotion on this platform
• We do not guarantee the accuracy of any listing, including featured ones
• Featured places are clearly labelled in-app so users are always aware

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above will be revised accordingly.

13. Contact

Questions about this policy? Reach us at manarah@karamahcollective.com

Karamah Collective · Helsinki, Finland