গোপনীয়তা নীতি

Privacy Policy (English)

Last updated: 27 September 2026 · Qafila · qafilapro.com

This is an English rendering of the Bengali policy above for readers and reviewers. Where the two differ, the Bengali text is the one we act on.

1. Who we are

This policy covers the Qafila Android app (package com.recorp.qafila), our websites qafilapro.com and hajjmatepro.com (we operate both) and the server behind them. “We” means the team that operates Qafila. Contact: email [email protected], or phone / WhatsApp +880 1846 569599, 10:00–22:00 Bangladesh time.

2. Two roles, two responsibilities

Qafila coordinates Hajj and Umrah groups. A Muallim (group leader, working for a travel agency) records his pilgrims and his books; a Hajji (pilgrim) uses the same app for his own journey. The agency is responsible for the pilgrim data it enters — obtaining consent, keeping it accurate, deleting it when it is no longer needed. We store and synchronise that data on the agency's behalf and do not use it for any purpose of our own. A pilgrim's own entries — notes, dhikr counts, the decision to share location, what he asks the assistant — are handled by us together with him.

3. What we collect

• Identity: name (Bengali/English), email (Muallim sign-in), phone numbers (own, Saudi, guardian), address, date of birth or age, gender, photograph.
• Government identifiers: passport number and expiry, national ID (NID) number.
• Financial: payments, outstanding balances, expenses, agreed package amount, payment references.
• Health: blood group, medical conditions, regular medications — entered by the Muallim for the care of an elderly pilgrim.
• Location: approximate and precise location, only while sharing is switched on (section 4).
• Photos and files: pilgrim photographs, document scans, note photographs, backup files.
• Audio: voice recordings, only while you hold the dictation button.
• Text: notes, messages to pilgrims, prompts to the AI assistant.
• Activity: Tawaf/Sa'i lap counts, dhikr counts, leaderboard totals.
• Device: push notification token, device id and label.

Live voice interpreter and AI tokens. When you start the live interpreter or ask the assistant by voice, microphone audio from you and the person you are talking to is streamed to Google (Gemini Live) for translation and answers. We do not record, listen to or store that audio or its transcript on our servers. Consent is requested before each one-hour block and you can stop at any time. Pitch and speaking-speed measurements used to select a nearby prebuilt voice stay on the device; this is voice selection, not voice cloning. We store the AI-token balance, purchases and amount of voice and AI usage tied to the account while the account exists.

The Muallim's own books live in an encrypted database on his phone, with a copy on the server while sync is enabled so that a lost phone is not lost work.

4. Location, in detail

• Off by default. Nothing leaves the phone until a pilgrim turns “location sharing” on himself.
• Visible only inside his own group — his Muallim and that agency's authorised staff. Never another agency, never a stranger.
• Always visible while running. An ongoing notification is shown for the whole time location is being reported, and for the whole time the Tawaf/Sa'i counter runs.
• Every look is logged, and the pilgrim can read that list in the app.
• A one-off alternative. A pilgrim who does not want continuous sharing can be sent a request (“PING”) and answer it with one tap, or not answer it.
• Turning sharing off deletes the history. Revoking consent removes his last position and his stored location history from the server in the same operation.
• The Google Play version does not collect location while the app is closed. That build does not hold the “allow all the time” permission at all. The version distributed from our website does, still only after the pilgrim switches it on, and only after a plain-language explanation shown before the Android permission dialog.
• A Muallim's own location is read only when he taps “use my location” — one fix, one point.

5. Why each Android permission is asked for

• Location — the uses in section 4. Refusing it leaves the rest of the app working.
• Camera — pilgrim photographs and document scans; for a pilgrim, reading the pairing QR his Muallim shows him (the code can also be typed).
• Microphone — for held-button dictation, the live interpreter, or asking the AI assistant by voice. Live voice does not run in the background with the screen off and needs no extra location or foreground-service permission.
• Notifications — reminders, urgent messages, location requests.
• Exact alarms — so a medicine or departure reminder is not delayed.
• Battery optimisation exemption — optional, so that urgent notifications are not held back by aggressive power management.
• Run after reboot — to re-arm pending reminders.

No gallery or storage permission is requested: the app uses the system photo and document pickers, so it receives only what you choose.

6. Who we share with

We do not sell personal data and the app itself shows no advertising. Data reaches:

• The pilgrim's own Muallim and agency — his details, his ledger and, while switched on, his location.
• Google — push notifications (Firebase Cloud Messaging) and maps (Google Maps).
• Google (Gemini Live) — audio from you and the other speaker for live translation or a voice answer. The app uses a short-lived, one-use token; our secret key is never placed on the phone. The app asks for consent before each one-hour block, and you should tell the other speaker before starting.
• The AI provider (Anthropic or OpenAI) — what you type or say to the assistant, plus the context needed to answer (your name, your group's name, the relevant ledger figures). Nothing is sent if you do not use the assistant.
• The Bangladesh government Bangla voice service (voice.bangla.gov.bd) — voice recordings are sent there to be turned into text. Nothing is sent if you do not use dictation.
• Meta (Facebook / Instagram), advertising suppression only — we send a one-way scrambled form (a SHA-256 hash) of your email address and mobile number so that Meta can leave you out of our app-install advertisements once you already have an account. Meta does not receive your name, location, health, ID or any ledger data from us, and we do not use it to find or profile new people. If you do not want this, email [email protected] and we will leave you out of the list.
• Our hosting provider — where the server and database run.
• Legal requests — where a valid order requires it, limited to what is required.

The dhikr leaderboard is worth stating separately: it shows your name and count to other users. Tell us if you do not want your name shown.

On the ride-sharing board other agencies see your agency's name, the road, day, time, head-count and the note you wrote — never a phone number or anything about a pilgrim. When you send a request, your name and number are shown only to that post's owner; if they accept, you see theirs. A report keeps the reported text and the reason for our review; the reported agency is never told who reported it.

7. Health and identity data

Passport numbers, NID numbers and medical details are the most sensitive data here. They are entered by an agency for the purpose of running its group. We do not use them for advertising, analytics, profiling or any third-party purpose, and there is no reason for them to be sent to the AI provider.

8. How long we keep it

• Raw location history — pruned automatically after a short window (14 days by default), and deleted immediately when sharing is switched off.
• Group, pilgrim and financial records — while the agency's account is active or accounting requires it; otherwise on request under section 10.
• Voice recordings — sent for transcription; not retained by the app.
• Assistant conversations — not stored in the app; the transcript ends with the exchange.
• Live conversation audio and translations — not retained by us; on-screen text disappears when the app closes unless you copy it.
• AI-token balances, purchases and usage records — while the account exists, except where accounting law requires a record to be kept.
• Voice-matching measurements — only on the phone and removed when the app is removed.
• Security and abuse logs — for a limited period.

9. Security

• The on-device database is encrypted at rest (SQLCipher-format encryption), chosen because it holds passport and NID numbers.
• All traffic between app and server is over HTTPS.
• Android system backup of app data is disabled, so this data is not copied elsewhere by the platform.
• Access to a pilgrim's location is logged with the name of whoever looked.
• No system is perfectly secure. If an incident affects your data, we will tell you.

10. Deleting your account and data

You can have your account and its data deleted.

From inside the app:

• Pilgrims — Me → Delete my account. Confirmed with your PIN, and done immediately.
• Muallims and agencies — More → Request account deletion. The owner raises the request and the work is completed within 30 days; it can be withdrawn before the work starts.

Or by request: email [email protected], or message phone or WhatsApp +880 1846 569599, saying which role you use (Muallim or Hajji) and the phone number or email the account was created with. After we verify who you are, deletion is completed within 30 days.

• Deleting a pilgrim's account removes the account, its device links, push tokens, location history, his notes, his dhikr records and his orders.
• However, the row describing him as a pilgrim in his agency's books — name, package, payments — is that agency's accounting record and stays with them. To have that removed, ask the Muallim or agency; they can do it from the app.
• Deleting an agency account removes that organisation's groups, pilgrim records, ledgers, photographs and documents from the server. The copy on the Muallim's own phone is removed by uninstalling the app.
• Where law or accounting requires a record to be kept for a set period, it is deleted when that period ends.

Removal from backup copies can take up to a further 30 days.

11. Your rights

You may ask what we hold about you, have it corrected, have it deleted, withdraw location consent at any time from inside the app, and revoke any Android permission from system settings. Requests about a pilgrim's record are usually fastest through his Muallim or agency, because the record is theirs.

12. Children

The app is for adults; nobody under 18 should create an account. Where a group includes a child pilgrim, the agency records that child's details with the guardian's consent, not as the child's own account.

13. Changes

If this policy changes, the date at the top of this page changes with it. Significant changes are announced in the app or by notification.

14. Contact

Any privacy question, request or complaint: email [email protected], or phone or WhatsApp +880 1846 569599, 10:00–22:00 Bangladesh time. The About us screen inside the app lists every way to reach us.