Privacy Policy

This Privacy Policy describes how the operator of Fahm ("Fahm," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with the website at fahm-al-khutbah.com and the Fahm service (the "Service"). This Policy applies to mosque account holders, mosque staff, listeners, and visitors to the website.

The data controller responsible for the processing of personal data described in this Policy is the operator of Fahm, with its principal place of operation in Dresden, Germany. Requests concerning this Policy, and the exercise of the rights described in Section 8, may be directed to salaam@fahm-al-khutbah.com or through the Contact page.

• Mosque account data: the organization's name, the name and email address of the account owner and any invited staff, telephone number, physical address, and a password stored as a salted cryptographic hash. Plaintext passwords are never stored.
• Khutbah content: the Arabic transcript of broadcast sermons and the resulting translations into up to five languages, retained as part of the mosque's session history together with associated metadata, including date, duration, peak listener count, and language usage.
• Listener feedback: an optional rating and free text comment that a listener may submit anonymously following a khutbah. Listeners are not required to register an account or provide any identifying information.
• Contact submissions: the name, email address, and message content submitted through the Contact page.
• Technical data: IP address, processed transiently for rate limiting and abuse prevention and not retained in association with an identified individual beyond what is necessary for that purpose; browser and device type; and standard web server log data.

Listeners are not required to provide, and the Service does not collect, any personal data beyond what is described above in order to listen to a khutbah.

We process personal data for the following purposes and on the following legal bases under Article 6 of the General Data Protection Regulation ("GDPR"):

• To provide the Service requested by you or your mosque, including account administration and the live translation functionality, on the basis of the performance of a contract (Article 6(1)(b) GDPR).
• To respond to inquiries submitted through the Contact page, on the basis of the performance of a contract or our legitimate interest in responding to communications addressed to us (Article 6(1)(b) or (f) GDPR).
• To maintain the security of the Service and prevent fraud or abuse, including rate limiting and abuse prevention on registration, on the basis of our legitimate interest in protecting the Service and its users (Article 6(1)(f) GDPR).
• Where you have provided it, on the basis of your consent, such as your agreement to the Terms of Service and this Policy at registration (Article 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of processing carried out before its withdrawal.

We engage the following third party providers to operate the Service. Each receives only the data necessary to perform its function and is engaged under a data processing agreement where required by applicable law.

• Anthropic, PBC: receives transcript text to generate translations.
• Deepgram, Inc.: receives streamed audio to perform automated speech recognition.
• Resend: receives the recipient's email address and relevant message content to deliver verification codes, two factor authentication codes, password reset codes, staff invitations, and replies to inquiries.
• Hetzner Online GmbH: our hosting provider, based in Germany, which operates the servers and database storing the data described in this Policy.
• Sentry: receives technical error reports for the purpose of diagnosing and fixing software defects, configured to avoid capturing personal data to the extent reasonably practicable.

We do not sell personal data, and we do not use personal data for advertising or share it with third parties for their own marketing purposes.

Certain providers identified in Section 5 may process personal data outside the European Economic Area, including in the United States. Where this occurs, the transfer is conducted on the basis of an adequacy decision of the European Commission, Standard Contractual Clauses adopted under Article 46 GDPR, or another safeguard recognized under applicable data protection law, as applicable to the relevant provider.

• Mosque account data and khutbah session history are retained for as long as the account remains active. An account holder may permanently delete an individual session, or the entire account and all associated data, at any time through the dashboard. Deletion is immediate and permanent.
• Contact submissions are retained until deletion is requested.
• Database backups are retained on a rolling fourteen day basis, after which they are automatically and permanently deleted.

If you are located in the European Union, the European Economic Area, the United Kingdom, or another jurisdiction granting equivalent rights, you have the right, subject to the conditions and exceptions provided by applicable law, to:

• Obtain access to the personal data we hold about you (Article 15 GDPR).
• Request rectification of inaccurate personal data (Article 16 GDPR).
• Request erasure of personal data (Article 17 GDPR).
• Request restriction of processing (Article 18 GDPR).
• Receive personal data you have provided to us in a structured, commonly used, machine readable format (Article 20 GDPR).
• Object to processing carried out on the basis of legitimate interest (Article 21 GDPR).
• Lodge a complaint with a supervisory authority in the European Union member state of your habitual residence, place of work, or the place of the alleged infringement (Article 77 GDPR). Where the place of the alleged infringement is Germany, the competent authority for the jurisdiction in which Fahm operates is the Sächsischer Datenschutzbeauftragter (Saxon Data Protection Commissioner).

To exercise any of these rights, contact salaam@fahm-al-khutbah.com.

The Service does not use third party advertising or tracking cookies. The Service uses browser local storage, which is distinct from cookies, to maintain a signed in session, remember language and theme preferences, and, for a paired television display, remember the access code for a private room. Data held in local storage is not transmitted to or shared with any third party.

The Service's listener functionality may be accessed by persons of any age attending a khutbah. The Service does not knowingly collect personal data from minors beyond the anonymous, optional feedback described in Section 3, which requires no identifying information. Registration of a mosque account is intended for adults authorized to act on behalf of the relevant organization.

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encrypted transmission, hashed password storage, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may amend this Policy from time to time to reflect changes to the Service or applicable law. Material changes will be reflected by an updated date at the top of this page. Continued use of the Service after a material change constitutes acceptance of the amended Policy to the extent permitted by applicable law.

This Policy is originally drafted in the English language. Translations into Arabic, German, Turkish, and Russian are provided for the convenience of users and do not constitute the authoritative text. In the event of any conflict, ambiguity, or inconsistency between the English version and a translated version, the English version prevails and governs.

Questions regarding this Policy, or requests to exercise the rights described in Section 8, may be directed to salaam@fahm-al-khutbah.com or through the Contact page.