Privacy Policy

Our Privacy Commitment

We collect only what is necessary. We do not sell your data. We may show clearly-labelled banner advertisements, but advertisers never receive your personal data. Your information is used solely to provide GeoShia's community services. You have the right to access, correct, and delete your data at any time.

GeoShia.com is a community platform for Shia Muslims worldwide. Data Controller: GeoShia Contact: [email protected] For GDPR enquiries, contact our Data Protection Officer (DPO) at the same address.

We collect the following personal data: • Email address — required to create an account (OTP login system) • Display name — optional, chosen by you • Profile information — voluntarily provided (bio, city, country, links) • IP address — logged for security and abuse prevention • Usage data — pages visited, features used, timestamps (no third-party tracking) • Content you submit — scholar profiles, events, forum posts, comments • Contact form submissions — name, email, message content We do NOT collect: • Passwords (we use passwordless OTP authentication) • Payment card data • Precise geolocation • Biometric data

• Account creation & login: necessary for performance of service contract • Security logging (IP): legitimate interest in preventing abuse • Content moderation: legitimate interest in maintaining a safe platform • Contact enquiries: your consent (by submitting the form) • Analytics (aggregated, anonymous): legitimate interest in improving the platform

• Account data: for as long as your account is active, plus 12 months after deletion request • Security logs: 90 days • Contact messages: 2 years • Content (posts, comments): removed promptly upon deletion request unless required by law You may request earlier deletion at any time (see §6).

We do not sell, rent, or trade your personal data. We share data with: • Cloudflare (R2 storage) — for media/file hosting; subject to their privacy policy • Email providers — for sending OTP verification codes • Stripe — for processing advertiser payments • Banner advertisements are clearly labelled; ad performance is measured with anonymous counters only — no advertising network tracks you • No data brokers • Law enforcement — only when legally required All third-party processors are bound by data processing agreements.

Under GDPR, you have the following rights: • Right of access — request a copy of your personal data • Right to rectification — correct inaccurate or incomplete data • Right to erasure ('right to be forgotten') — delete your account and data • Right to data portability — receive your data in a machine-readable format • Right to restrict processing — limit how we use your data • Right to object — object to processing based on legitimate interests • Right to withdraw consent — at any time, without affecting prior processing To exercise any of these rights, email [email protected]. We will respond within 30 days.

GeoShia uses the following cookies: • Session cookie — required for login and security (essential, cannot be disabled) • Language preference cookie — stores your language choice (en/ur/ar) • Muharram mode cookie — stores your Muharram mode preference We do NOT use: • Advertising cookies • Social media tracking pixels • Analytics services that track individuals (no Google Analytics, Meta Pixel, etc.)

We take data security seriously. All data is transmitted over HTTPS. Sensitive operations use rate limiting and bot detection. We store media on Cloudflare R2 with restricted access. We scan uploaded files for malware. No system is 100% secure — if you discover a vulnerability, please report it responsibly to [email protected].

GeoShia is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

We may update this policy from time to time. We will notify registered users of significant changes by email. Continued use of GeoShia after notification constitutes acceptance.

For privacy questions: [email protected] If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your national data protection authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany).