Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains what personal information MawaddaWaRahma (“we”, “us”, “our”) collects when you use our website and web application (together, the “Service”), how we use it, who we share it with, and the choices and rights available to you.

It should be read alongside our Terms and Conditions, which explains how the Service itself works — how matching, wali disclosure, and account deletion function. This Policy focuses on the data side of the same mechanics.

By creating an account, you agree to this Privacy Policy, including our collection and use of the sensitive information described in Section 4. This agreement is captured through a single confirmation at account creation, alongside your acceptance of our Terms — it is not collected as a separate consent step.

2. Who we are

This Privacy Policy is issued by MawaddaWaRahma. You can contact us using the details in Section 17.

3. Information we collect

3.1. Account information. When you sign up, we collect your email address, password (handled by our authentication provider, AWS Cognito — we never see or store your password ourselves), and your gender. We do not collect or store your phone number, home address, or physical location as part of your account.

3.2. Profile information. Once your account exists, building a profile may involve providing information across several categories: identity and demographic (display name, date of birth, gender, country and city of residence, nationality, ethnicity); marital and family (marital status, children, family circumstances); physical description (height, weight, body type); lifestyle (occupation, employment status, education, languages, willingness to relocate); religious practice (madhab/sect, Islamic background, prayer consistency, hijab or niqab practice, beard style, a religious bio); free text (a general bio, hobbies and interests, and a “what I'm looking for” description); and marriage-specific preferences (marriage timeline, stance on polygyny, and whether you want children).

We do not collect or display photographs anywhere on the Service.

3.3. Wali (guardian) information. If you are a female user, we collect the name, phone number, and relationship of your wali. This information belongs to a third party (your wali), not to you — Section 8 explains the extra care we take with it.

3.4. Verification documents. If you choose to verify your profile, you upload a copy of a government-issued identity document (such as a passport, national ID card, or driving licence). Section 9 explains what happens to this document.

3.5. Activity information. We keep records of how you use the Service in order to operate its core features: interests you send or receive and their status; profiles you save to your private favorites list; profile views (when you view another profile, this is recorded and may be shown to that user, for example in a “Visitors” list); and your credit balance and history.

3.6. Communications with us. If you contact support, submit feedback, or report another user or profile, we collect what you send us — including any free-text description you provide.

3.7. Technical information. We collect standard technical information needed to operate a secure web application — for example, authentication tokens and session information managed through AWS Cognito, and server logs. We do not use third-party advertising or analytics tracking technologies (such as Meta Pixel or Google Analytics) on the Service today; if that changes, we will update this Policy and, where required, ask for your consent first.

4. Sensitive information

Some of the information described above — in particular, your religious practice (madhab, prayer consistency, hijab/niqab, Islamic background) and your ethnicity — is sensitive personal information. In many jurisdictions, this kind of information receives special legal protection.

We collect it because it is core to how MawaddaWaRahma works: it is what other users rely on to assess religious and cultural compatibility, and it is central to the matrimonial purpose of the Service. We do not use it for advertising, and we do not sell it.

Because these fields are part of completing a profile, providing this information (and your agreement to its use for matching, as described in Section 5) is necessary to use the core matching features of the Service. If you are not comfortable providing it, the Service will not be able to match you with other users, though you may still be able to hold an account.

5. How we use your information

We do not use your information for advertising, and we do not sell your personal information to anyone.

6. Who can see your information

6.1. Other users. Depending on your profile's visibility, other eligible users (opposite-gender accounts) may see your profile information (Section 3.2) when browsing or searching. This does not include your wali's information or your verification document — see Sections 6.3 and 9.

If you pause your profile, other users see a reduced version: display name, age, gender, city, and occupation only. A user with an existing accepted match, or an unresolved pending interest from you, continues to see your full profile even while paused.

6.2. Profile views. If you view someone's profile, they may see that you did (Section 3.5). If someone views your profile, you may see that they did.

6.3. Wali information. Your wali's details are shown only to you, and to a matched user once your interest with them has been mutually accepted. They are never visible while browsing, searching, or before a match — see Section 8.

6.4. Our team. A small number of authorized personnel can access account, profile, and report information as reasonably necessary to operate the Service — for example, to review a report, action a verification request, or respond to a support enquiry.

6.5. Service providers. We use Amazon Web Services (AWS) to handle authentication (sign-up, login, password reset) via AWS Cognito, to host the Service, and to securely store uploaded verification documents (Section 9) via Amazon S3, in a private bucket not accessible to other users. AWS processes information on our behalf and under its own security commitments; it does not use your information for its own purposes.

We do not currently use any other third-party processor (no separate email/SMS marketing tool, no analytics vendor, no ad network) — if that changes, we will update this section.

6.6. Legal and safety disclosures. We may disclose information where required by law, to respond to a valid legal request, or where we reasonably believe disclosure is necessary to protect the safety of a user or the public.

7. No in-platform messaging

Because the Service does not include a messaging feature, communication beyond a mutual match (for example, contacting a disclosed wali by phone or WhatsApp) happens entirely outside the Service. Any personal information you share in that communication is not something we receive, store, or control — see our Terms, Section 7.

8. Wali (guardian) information — extra care

Your wali did not create an account and did not agree to this Policy directly, so we treat their information with particular care:

1. we collect it from you, on the basis that you have their permission (or another lawful basis) to share it — see our Terms, Section 5.2;
2. it is used only to facilitate a possible introduction, and is disclosed only to a mutually accepted match (Section 6.3);
3. we do not use it for marketing, and we do not share it with anyone beyond what's described in Section 6; and
4. if you delete your account, your wali's information is deleted — see Section 10.

9. Identity verification documents

When you upload a government-issued ID document for verification, authorized personnel review it to compare the name and details against your profile. The document itself is used only for this comparison and is deleted no later than 30 days after a decision is made (approved or rejected) — kept briefly beyond the decision itself only so a review can be revisited if needed, not indefinitely.

We retain a limited verification record — confirmation that a document was reviewed, the type of document, the date, and the outcome — rather than the document itself, so that the “Verified” indicator can be displayed and audited. We may retain the document itself for longer where reasonably necessary — for example, if it's relevant to an active fraud, safety, or legal investigation.

A “Verified” badge reflects this limited, point-in-time check only. It is not a background check and does not confirm character, safety, or anything beyond the identity comparison itself — see our Terms, Section 2.1.

10. How long we keep your information

10.1. While your account is active. We retain your account and profile information for as long as your account remains active, in order to provide the Service.

10.2. When you delete your account. Deleting your account, as described in our Terms, Section 12, results in:

1. your profile being made invisible and its personal content (bio, occupation, religious bio, etc.) cleared;
2. your wali record being deleted;
3. pending and accepted interests being ended;
4. your email address being retained in an altered, non-usable form for support and audit purposes; and
5. your stated reason for leaving being retained in a form that isn't linked back to your identity, to help us understand why users leave.

Records of your favorites, profile views, and any reports involving your account may also be retained after deletion, to preserve a safety and moderation trail.

We permanently remove this retained information no later than 12 months after your account is deleted, except where we need to keep it longer for safety, fraud-prevention, or legal reasons — see Section 10.3.

10.3. Reports and safety records. Information connected to a report or safety concern may be retained for longer than ordinary profile information, where reasonably necessary to protect users, investigate misconduct, or comply with a legal obligation.

11. Your choices and rights

• Access and correction — you can view and update most of your profile information directly from your account.
• Deletion — you can delete your account at any time; see Section 10.2 for what that does and does not remove.
• Withdrawing consent — where we rely on your consent (in particular, for the sensitive information in Section 4), you can withdraw it by deleting the relevant profile field or your account. Because that information is necessary for the Service's core matching function, withdrawing it may mean we can no longer provide that function to you.
• Further rights — depending on where you live, you may have additional rights over your personal information — for example, to request a copy of it, to object to certain processing, or to complain to a relevant regulator. Contact us using the details in Section 17 and we will do our best to assist, consistent with applicable law.

12. Security

We rely on AWS Cognito for authentication, which includes measures such as encrypted password storage and secure token-based sessions. We restrict internal access to user records to personnel who need it for their role.

No system can be guaranteed completely secure. You can help protect your account by using a strong, unique password and not sharing your login credentials.

13. Children

The Service is intended for users aged 18 and over, and this is enforced at the point of profile creation. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account or provided us with information, contact us at contact@mawaddawarahma.app and we will investigate.

14. International data handling

We host our infrastructure with Amazon Web Services (AWS). Depending on where you and our infrastructure are located, your information may be processed in a country other than the one you live in. Wherever your information is processed, we take reasonable steps to keep it secure and only work with providers who apply appropriate safeguards.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time — for example, alongside a Terms update when we introduce payments, or a new third-party service. We will post the updated Policy with a revised effective date, and where a change is material, we will look for an appropriate way to bring it to your attention.

16. Law enforcement requests

16.1. We may receive requests from law enforcement or other government authorities for information about a user. We disclose information in response to such a request only where we are satisfied it is required by law or is based on valid legal process issued by a court or authority of competent jurisdiction (for example, a subpoena, court order, or search warrant) that identifies the specific account or information sought.

16.2. Requests should be sent in writing to contact@mawaddawarahma.app, marked for the attention of Law Enforcement Requests, and should include the requesting agency, the legal basis for the request, and enough detail (such as an account email or profile identifier) for us to locate the account in question.

16.3. Where an authority asks us to preserve account information pending receipt of formal legal process, we will do so for a reasonable period while that process is obtained.

16.4. Where legally permitted, we will notify the affected user before disclosing their information, unless we are prohibited from doing so by law or court order, or we reasonably believe notice would endanger someone or compromise an investigation.

16.5. In an emergency involving a risk of death or serious physical harm to a person, we may voluntarily disclose limited information to an appropriate authority without legal process, as described in Section 6.6.

17. Contact us

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to contact@mawaddawarahma.app.