Privacy Policy

2.1 Personal data that may be processed

Processed data may vary by role (member, moderator, admin) and by how the service is used. This may include:

• Full name, mobile number, and membership-related email.
• National ID used for sign-in.
• Profile photo if uploaded by the member.
• Membership and account status data (such as membership status and role).
• Device identifier linked to the account during activation or sign-in.
• Push notification tokens when notification features are enabled.
• Location data when checking in or verifying an event geofence.
• Attendance sessions, logs, and event-related operational records.
• Attendance and participation points, and warnings or restrictions where applicable.
• Information submitted through the website support form (name, email, subject, message, inquiry type, and may include page locale, source page, and a browser technical summary).

2.2 Membership and account data

A member account is created within Almudaraj1 to manage membership, events, and attendance. Account data may include identity information, attendance history, points balance, and administrative warnings or restrictions where applied.

Some actions — such as sign-in or membership activation — may be limited by membership status or administrative restrictions configured in the system.

2.3 National ID and sign-in

The app uses a 10-digit National ID as the primary sign-in identifier. A system authentication email is created in the format {nationalId}@almudaraj.app for sign-in purposes. This address is not intended as the member's public contact email.

Authentication data is used to verify the registered user and link sessions to the membership profile. Sign-in credentials must not be shared with others.

3.1 Device data and device binding

A device identifier may be stored on the member profile during activation or sign-in. It is used to bind the account to a specific device according to system rules, and sign-in from a different device may be rejected if the account is already bound elsewhere.

Members are responsible for their device and must not share accounts. Administrative steps may be required to re-bind a device in specific cases.

3.2 Location data

Self check-in depends on verifying that the member is within the event geofence. The app may request location permissions when attendance or session verification is needed.

Location may be used during events, and iOS settings may include background location capability as defined in the app configuration. Accuracy depends on the device, network, and environment.

Opening the app alone does not record attendance. Location is used to verify eligibility according to event settings, not for unrelated commercial tracking.

4.1 Attendance data

When attendance is recorded, the system may create sessions and operational logs including verification status, timestamps, and event- and location-related data. Verification logs may include location coordinates and accuracy measurements used for geofence checks. This is used to track, approve, and summarize attendance for administrators.

Verification may fail if the member is outside the geofence, location permission is disabled, or technical or event settings prevent validation.

4.2 Points data

Some events may grant attendance or participation points based on configured values for each event. Points are calculated from approved attendance completion percentage, and absence penalties may apply according to event settings.

After attendance is finalized, the member points balance may be updated server-side. Administrators may manually adjust points in specific cases. Points may be shown in the app and used in member rankings where enabled.

4.3 Event data

Event data includes organizational information such as title, schedule, location, attendance geofence, points settings, and permissions. It is used to operate member and admin experiences and attendance workflows.

5.1 Roles and permissions

The system defines roles such as member, moderator, and admin with different permissions. Admins and moderators may access broader data to manage events, attendance, and members within their authorization.

5.2 Warnings and restrictions

Members may receive warnings, restrictions, temporary blocks, or permanent blocks according to membership policies configured in the system. These records are kept for administrative purposes and may limit access to certain features.

6.1 Technical logs

The system may generate operational and technical logs related to attendance, sessions, and administrative actions. These logs support service operation, troubleshooting, and operational compliance.

6.2 Purposes of processing

Data may be processed for the following purposes, depending on type:

• Providing membership accounts and sign-in.
• Organizing events and managing members.
• Verifying attendance through location and processing results.
• Calculating and updating attendance and participation points.
• Managing permissions, warnings, and restrictions.
• Responding to support inquiries submitted through the website.
• Maintaining service stability and security.

6.3 Basis for processing

Data is processed to provide the service requested or used within the membership system, and to operate the platform according to granted permissions. Some processing may also rely on operational obligations or legitimate interests in managing membership and attendance, without excessive collection.

7.1 Technical services and providers

The app relies on Google Firebase services, including Firebase Authentication, Cloud Firestore, and Cloud Functions, for authentication, storage, and server-side processing. Data may be processed on Google infrastructure according to project settings.

The app also uses Expo/React Native libraries to run on devices. The app does not currently use separate commercial analytics or crash reporting services.

The website may create a Freshdesk (Freshworks) support ticket when you submit the support form, limited to the support-form data described below.

The website uses Cloudflare Turnstile to help protect the support form from automated submissions. Technical request data (such as IP address or technical summaries) may also be processed by website hosting and rate-limiting infrastructure to operate the support form securely.

7.2 Data sharing

We do not sell user data.

• Data may be shared with technical service providers necessary to operate the app and website within the scope of providing the service.
• Authorized admins and moderators may access member and attendance data within their permissions.

7.3 Processing outside the Kingdom

Some data may be stored or processed through Firebase/Google infrastructure. Some data may be processed on servers outside the Kingdom of Saudi Arabia according to provider settings.

8.1 Data retention

Data is kept for as long as needed to operate the service and manage membership and attendance, unless otherwise decided administratively or regulatorily.

8.2 Data deletion and account deletion

To request deletion of your data or closure of your account, contact us using the email below. Requests will be reviewed according to permissions and operational requirements.

Support form data on the website may be deleted or anonymized after the inquiry is handled, according to operating practices.

9.1 User rights

You may request clarification or correction of your data within what the system and your permissions allow. Some requests may require identity verification. Contact:

support@almudaraj.com

9.2 Data protection

Appropriate technical and organizational measures are applied within the app architecture, including authentication and access controls. No online system can be guaranteed to be completely secure.

9.3 Membership and age scope

The service is intended for members of Almudaraj1 within the Al Ahli community according to approved membership policies. If you are a guardian and believe a minor's data was submitted improperly, contact us.

10.1 Website support form data

When using the Send us a message form on the support page, we may collect: name, email, inquiry type, subject, message text, and optional membership number, as well as page locale, source page, a browser User-Agent summary, and a submission timestamp. This information is used to review and respond to your inquiry and to operate technical protections for the form.

Messages may be processed through Freshdesk to create a support ticket for the support team at support@almudaraj.com. The form does not request passwords, OTP codes, or sensitive sign-in credentials.

10.2 Policy changes

We may update this policy when the service or regulatory expectations change. The Last updated date at the top of the page indicates the current version.

10.3 Language

This policy is available in Arabic and English. If there is a difference in meaning, both texts should be reviewed together before a final decision.

10.4 Contact

For privacy-related inquiries:

support@almudaraj.com