This Privacy Policy explains what information MadarsaHub collects, why, who it is shared with, and the choices you have. It applies to the MadarsaHub website (madarsahub.com), the web app used at each madrasa's own address (for example yourmadrasa.madarsahub.com), and the MadarsaHub Android app (package name com.madarsahub.shared). MadarsaHub is run by the MadarsaHub team; contact details are at the end of this page.

In short

  • The MadarsaHub web app and Android app contain no advertising, analytics, or tracking tools.
  • We never sell personal information, and we never share it with advertisers or data brokers.
  • A madrasa's records are visible only to that madrasa's authorized users. Other madaris cannot see them.
  • Our own team accesses data only as needed for support, maintenance, and security.
  • Information is stored with the infrastructure providers listed below. They run it for us and do not use it for their own purposes.
  • The Android app asks only for permission to show notifications. It does not access your location, contacts, camera, microphone, SMS, or call history.
  • Accounts are created by madaris, not by individuals. There is no public sign-up in the app.
  • Our public website (madarsahub.com) is separate from the app: it uses Google Analytics for visit statistics (see Cookies and local storage below).

Who is responsible for the data

MadarsaHub provides software that madaris use to manage their students, staff, attendance, fees, and progress. Each madrasa decides what information about its students, guardians, and staff to enter, and is responsible for that information. MadarsaHub stores and processes it on the madrasa's behalf, only to run the service. Each madrasa's data is kept separate from every other madrasa's, and only that madrasa's authorized users can see it.

Information we handle

  • Madrasa details: name, address, contact number, logo, theme, and subscription and payment records (including payment screenshots a madrasa uploads).
  • Staff and teachers: name, email, phone number, role, joining date, salary records, and login credentials. Passwords are stored in hashed form by our sign-in provider, never as plain text.
  • Students and guardians: name, father's or guardian's name, gender, phone number, address, CNIC or B-Form number, photo, admission details, class, attendance, Quran and academic progress, exam results, and fee records. A madrasa may also mark a student as zakat-eligible or as a free (Sabeel Lillah) student. A madrasa may give a student or guardian a login so they can see that student's own records.
  • Login and activity information: login and logout times, and the time you were last active in the app.
  • Device information: if you allow notifications, a push notification token for your installed app (an identifier issued by Google Firebase), and a random identifier the app creates on your device, used only to count how many devices use a madrasa's app. We do not read your advertising ID, location, or contacts from your device. Your language and theme choices are saved on your device.
  • Files you choose to upload, such as student photos, madrasa logos, and payment screenshots. You pick each file yourself. Reports (PDF) you download are saved on your device only when you choose to save or share them.
  • Technical logs: our hosting and database providers keep logs (such as IP address, time, and the page requested) to run and protect the service.
  • Website visitors: if you request a demo, the details you type into the form (your name, madrasa name, city, WhatsApp number, email, and message).

How we use information

  • To provide, secure, and maintain the service, including signing people in and showing each person only what their role allows.
  • To send notifications and reminders (such as attendance and progress reminders and announcements) that a madrasa chooses to send.
  • To give support, handle subscriptions and payments, and send service messages about a madrasa's account.
  • To keep the service safe, prevent misuse, and fix problems.
  • To understand how many devices use a madrasa's app, so we can give support.
  • To understand how our website is used, so we can improve it.

We do not sell personal information, and we do not show advertising.

Children's information

MadarsaHub is a management tool for madaris, used by madrasa staff, teachers, and parents or guardians. It is not designed for children to use on their own. A madrasa may give a student a login to view that student's own records, but students do not sign themselves up. Many students are children. Their information is entered by their madrasa, and we do not collect it from the child for any other purpose. We use it only to provide the service to that madrasa. We do not show advertising to children, do not build profiles of children, and do not share their information except with the service providers listed below. A parent or guardian who wants to see, correct, or delete a child's information should contact the madrasa first, or contact us (see Contact).

Who we share information with

We use trusted service providers to run MadarsaHub. They handle information only to perform their service for us:

  • Supabase: database, sign-in, and file storage (such as student photos and logos).
  • Vercel: hosting of the website and web app (it also keeps technical logs, including IP addresses).
  • Google Firebase Cloud Messaging: delivering push notifications to phones (it receives the device token and the notification text).
  • Resend: sends internal service emails to our own admin inbox, for example subscription alerts.
  • EmailJS: delivers demo requests from our website form to us.
  • Google Fonts: used on our website, in the web app, and so inside the Android app, to load fonts. When the fonts load, Google receives your IP address and browser details.
  • Google Analytics: on our public website only (madarsahub.com), for visit statistics. It is not used in the web app or the Android app.
  • ipapi.co: on our website only, to estimate your country from your IP address so we can choose Urdu or English by default.

We may also disclose information if the law requires it, or to protect the rights and safety of MadarsaHub, its users, or others. When you tap a WhatsApp link, WhatsApp opens on your own device and its own privacy policy applies.

Where information is stored

Our providers' servers may be located outside Pakistan, so information may be processed in other countries. We choose providers that apply standard security practices.

How long we keep it

A madrasa's data is kept while its account is active, and a madrasa can delete records it no longer needs. If a madrasa ends its subscription, or asks us to delete its data, we delete it from our live systems within 30 days, except where we must keep something by law or for security and fraud prevention. Backups are overwritten on our provider's regular backup cycle. Login records, activity times, and notification tokens are deleted when the account they belong to is deleted.

Deleting your account or data

To request deletion of your MadarsaHub account and its data, or of your child's information:

  • Accounts are created and managed by madaris, so the quickest way is to ask your madrasa. Its administrator can remove records in the app, or ask us to.
  • If you cannot reach your madrasa, email madarsahub@gmail.com (or message us on WhatsApp) with your madrasa's name and your username, and say what you want deleted. We may ask you to confirm who you are first.
  • We reply within 7 days and complete a verified request within 30 days.

What is deleted, and what may be kept:

  • Deleted when an account or a madrasa's data is deleted: the profile and sign-in details; student, staff, attendance, progress, exam, fee and salary records; photos and uploaded files; login and logout records, activity times, the device identifier and notification tokens.
  • May be kept: records we must keep by law, and security logs kept by our hosting and database providers, which are removed on their own schedule, typically within 30 days. Backups are overwritten on the provider's regular backup cycle.

Security

We use encrypted connections (HTTPS), role-based access, and separation between madaris to protect information. No system is completely secure, so please keep your login details private and tell your madrasa straight away if you think someone else has used them.

Cookies and local storage

The web app and the Android app (which shows the web app) use cookies to keep you signed in, and local storage on your device to remember your language, theme, your madrasa's address, and the random device identifier described above. These are needed for the service to work. Our public website also uses Google Analytics, which sets cookies to measure visits; you can block these in your browser settings.

Permissions the Android app asks for

  • Notifications: to show announcements and reminders. You can allow or block this at any time in your phone's settings.
  • Internet and network state: to load your madrasa's app and to show a message when you are offline.
  • The app does not ask for access to your location, contacts, camera, microphone, SMS, call history, or storage. When you upload a photo or file, you choose it yourself with your phone's own file picker and only that file is sent.

Your choices and rights

  • To access, correct, or delete information about you or your child, contact your madrasa, or contact us (see Deleting your account or data above).
  • Notifications: you can turn them off at any time in your phone's settings.
  • Website: you can decline analytics cookies in your browser.
  • For questions or requests directly to us, see Contact below.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If a change is significant, we will tell madaris through the app or by message.

Contact

Developer and operator of the MadarsaHub app: MadarsaHub. Questions about privacy? Email madarsahub@gmail.com or message us on WhatsApp at 0301-1474211.