Privacy Policy

ManasikLoc is a pilgrim safety and real-time location tracking platform operated by Manasik Technologies ("we", "us", "our"). Our service is designed exclusively for travel agencies and pilgrimage group leaders to monitor the safety of Hajj and Umrah participants.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the ManasikLoc mobile application (iOS and Android) or web dashboard (manasikloc.com). Please read it carefully.

For questions, contact us at privacy@manasikloc.com.

We collect the following categories of information:

Account Information

• Email address – used to create and secure your account.
• Full name – displayed to your group leader and fellow group members.
• Password – stored as a one-way cryptographic hash; we cannot recover it.
• Account role – Pilgrim, Agency Admin, or Family Viewer.

Location Data

• Precise GPS coordinates – collected only while a trip is active and you have granted location permission. Collection stops automatically when the trip ends.
• Background location – only on devices where you explicitly grant "Always" permission. This enables safety alerts even when the app is minimised.
• We do not collect location data outside active trip windows.

Device & Technical Data

• Battery level – displayed on the dashboard so group leaders can identify pilgrims whose phone may be about to die.
• Network connectivity status – used to manage offline sync.
• Device platform (iOS / Android) – for compatibility logging.

Social Sign-In Data

• If you sign in with Google, we receive your Google account email, name, and a unique Google user ID. We do not receive your Google password or any other Google account data.
• If you sign in with Apple, we receive your Apple email (or Apple's relay address) and name (first sign-in only) and a unique Apple user ID. Apple's "Hide My Email" feature is fully supported.
• We never post to your social accounts on your behalf.

We use collected information solely for the following purposes:

• Service operation – authenticating your account, displaying your location on your group's live map, sending safety alerts to group leaders.
• Safety features – generating proximity alerts (e.g., pilgrim strayed from group), low-battery warnings, and offline status indicators.
• Communication – transactional emails such as password resets, trip invites, and service notifications. We never send marketing emails without your explicit opt-in.
• Service improvement – aggregated, anonymised analytics to improve app performance and battery efficiency.
• Legal compliance – to comply with applicable law or respond to valid legal process.

We never use your data for advertising, profiling, or sale to third parties.

Location data is shared on a strict need-to-know basis:

• Agency Admins and Group Leaders of the trip you are enrolled in can see your real-time position on the live map.
• Family Viewers added to your account by your agency can see your location during active trips.
• Emergency Support staff (if your agency has enabled this role) can view your location to assist in an emergency.
• No one outside your trip can see your location. Other agencies cannot see your data.
• Location sharing automatically stops when a trip ends or expires.

We retain your information for as long as your account is active.

• Location history – raw GPS tracks are retained for 90 days after a trip ends, then automatically deleted.
• Account data – retained until you delete your account. You may request deletion at any time by emailing privacy@manasikloc.com.
• Anonymised aggregates (e.g., heatmaps of congestion areas, without any personal identifiers) may be retained indefinitely for service improvement.

We implement industry-standard security measures to protect your information:

• All data in transit is encrypted using TLS 1.2+.
• Passwords are hashed using bcrypt with a per-user salt.
• Short-lived access tokens (JWT) and longer-lived refresh tokens are used for mobile authentication.
• Our infrastructure is hosted on services that comply with ISO 27001 and SOC 2.
• Access to production databases is restricted to authorised personnel only.

No method of transmission over the Internet is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security.

Web Dashboard: We use strictly-necessary cookies for authentication (session tokens). We do not use advertising, retargeting, or third-party analytics cookies.

Mobile App: We use encrypted on-device storage (iOS Keychain / Android Keystore) to store your session tokens securely. No advertising SDKs are included in the app.

ManasikLoc integrates with the following third-party services, each governed by their own Privacy Policies:

• Google Sign-In – Google Privacy Policy
• Apple Sign In – Apple Privacy Policy
• Mapbox – map tile rendering. Mapbox may receive approximate viewport coordinates but not your personal location. Mapbox Privacy Policy

We do not embed Facebook, TikTok, Twitter, or advertising pixels of any kind.

ManasikLoc is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@manasikloc.com and we will promptly delete it.

Depending on your jurisdiction, you may have the right to:

• Access – request a copy of all personal data we hold about you.
• Correction – request correction of inaccurate data.
• Deletion – request deletion of your account and associated data.
• Portability – receive your data in a portable format (JSON).
• Restriction – request that we restrict processing of your data.
• Objection – object to processing based on legitimate interest.

To exercise any of these rights, email us at privacy@manasikloc.com. We will respond within 30 days.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or sending an email to the address on your account. Continued use of the service after the effective date of a change constitutes acceptance of the new policy.