This translation is provided for your convenience. Only the German version is legally binding.

Privacy Policy

Last updated: 31 October 2026

This page explains which personal data Imanana processes, for what purpose, on what legal basis and for how long – and what rights you have. In short: we only process what the community needs, and we use no cookies, no tracking and currently no advertising.

1. Controller

A data protection officer is not required by law and has not been appointed.

2. Specially protected data: religion

Imanana is a Muslim community. The mere fact that you have an account here may reveal your religious beliefs; your posts, groups, events and journal entries may also have religious content. Such data is specially protected under Art. 9 GDPR.

We only process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give when you register. You can withdraw it at any time with effect for the future by deleting your account (Settings → Account) or by writing to us. Processing carried out before then remains lawful. Without this consent we cannot offer you an account, because the platform is religious by its very nature.

3. Hosting and visiting the website

Imanana runs on a server of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in Germany. netcup processes the data solely on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit the website, the server necessarily processes your IP address and technical information about your browser in order to deliver the page in encrypted form (HTTPS).

Every request is recorded in an access log: time, IP address, the page or interface requested (without any attached parameters), the result (status code) and your browser's identifier (user agent). We use the log solely to detect and investigate attacks, abuse and errors. Entries are deleted automatically after 7 days, unless a specific incident needs to be investigated for longer. Application error messages are logged without IP addresses. For the contact form, the IP address is also held briefly in memory to limit abuse (for one hour at most).

The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Fonts are loaded from our own server; no data is transferred to third parties such as Google when you visit.

4. Registration and user account

For an account we process:

• username and email address,
• your password – only as a salted, irreversible hash (scrypt), never in plain text,
• the time of registration and whether your email address has been confirmed,
• your acceptance of the Terms of Use and your consent under Art. 9 GDPR (with time and version),
• login sessions (a random session identifier, valid for at most 90 days or until you log out),
• the time of your last activity, to show other members who is currently online,
• your settings (e.g. language, appearance, notifications).

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Username, email address and password are required for an account; without them we cannot create one.

5. Profile, posts, groups and events

You can voluntarily create a profile (display name, location, profile text, profile picture) and create posts, comments, reactions, groups, events, RSVPs and contacts (connections). This content is visible to other logged-in members – depending on where you share it (e.g. in a group). Saved posts and your reactions are linked to your account.

Legal basis: Art. 6(1)(b) GDPR and – where religious content is involved – your consent under Art. 9(2)(a) GDPR.

6. Messages, images and voice messages

Direct messages, images and voice messages are stored on our server so that they can be delivered and shown again later. They are transmitted in encrypted form (HTTPS) but are not end-to-end encrypted on the server. We do not read your messages unless content has been reported to us and we have to review it.

Messages and their files are deleted automatically after 180 days. Uploaded files are stored at a random, unguessable address; anyone who knows this address can access the file.

Legal basis: Art. 6(1)(b) GDPR, for religious content Art. 9(2)(a) GDPR.

7. Muhasaba journal

Your journal entries (gratitude, reflection, intention) are visible only to you. They are stored on our server so that you can see them on all your devices, but they are not end-to-end encrypted there. The optional PIN only locks the display in the app; it does not encrypt the entries. We do not look at journal entries.

Legal basis: Art. 6(1)(b) GDPR and Art. 9(2)(a) GDPR.

8. Notifications and push

In-app notifications (e.g. new comments or contact requests) are stored on our server.

You only receive push notifications on your device if you allow them in your browser. For this we store the push address your browser gives us. Delivery runs through the push service of your browser vendor (e.g. Google for Chrome, Mozilla for Firefox, Apple for Safari); these vendors may be based outside the EU, in particular in the USA. The content of the notification is transmitted encrypted according to the Web Push standard. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app's or your browser's settings.

9. Sending emails

For system messages (e.g. confirming your email address or acknowledging contact form messages) we use the email service Resend (Plus Five Five, Inc., USA). Your email address, your username and the content of the email are transmitted and stored in the USA. We have a data processing agreement with Resend; the transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(b) GDPR.

10. Contact form, feedback and reports

When you write to us via the contact form, the feedback function or by email, we process your information (name, email address, subject, message) to handle your request. Feedback and contact form messages are stored on our server; contact form messages are also forwarded to us by email (via Resend, see section 9). We delete them once the matter is resolved, and automatically after twelve months at the latest.

When you report content in the app, we store the report together with your username so that we can review it and inform you of the outcome. Once we have decided, we delete the report. If we remove content or suspend an account, we store the reason and tell the person affected. The reported person does not learn who reported them, unless we are legally required to disclose it.

Legal basis: Art. 6(1)(b) GDPR (for members), Art. 6(1)(c) GDPR in conjunction with the Digital Services Act (for reports of illegal content) and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

11. Browser storage, no cookies

Imanana does not set cookies. In your browser's local storage we keep only two things: your login session, so that you stay logged in, and your language choice. Both are strictly necessary for the service you requested (§ 25(2) no. 2 of the German TDDDG) and therefore require no consent. There is no tracking, no analytics and currently no advertising. If this changes, we will update this policy beforehand and ask for your consent where necessary.

12. Retention and account deletion

We store your data for as long as your account exists. You can delete your account at any time in the settings. We then immediately delete your profile, posts, comments, reactions, contacts, group memberships, notifications, push addresses, login sessions and your journal, as well as the images you uploaded and the groups and events you created (including the posts in them).

Messages you have sent to others remain in the recipients' chat history until they are deleted automatically after 180 days. If you want us to remove them sooner, write to us. Server backups are overwritten or deleted after 30 days at the latest.

13. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

To do so, write to mohammad.naoufal@gmail.com or use the contact form.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Data security

The connection to Imanana is encrypted throughout (HTTPS). We store passwords only as a salted hash. Access to the server is restricted to the operator.

15. Changes

If Imanana changes – for example if advertising is introduced – we will update this policy. We will inform you of significant changes in the app.