Privacy — UmmahSphere
Last updated: 26 August 2026. The app: UmmahSphere 5.9.0.
Written from the code, not from a template
Every statement below comes from a file that exists in the app. Where the app cannot know something, it says so outright instead of going around it.
1. Who runs the app and the server
The app and the chat server are run by the same operator. They are not separate services and they do not belong to anyone else.
The chat server is at cloud.atomtech.ro. It is an ordinary relay: it receives the messages and passes them on. It is not a decentralised network, and no message goes straight from one phone to another.
There is no support team and there is no round-the-clock moderation. Requests go to a single address, the one in section 9, and the answer can be slow in coming.
2. What stays on your phone
There is no account. Local data stays in the app's private space. Selected preferences and journals may be retained in the encrypted Android backup of your Google account and restored after reinstalling; chat keys and sessions are excluded.
- ummah_native_prefs
- the city you chose, the calculation method, the manual corrections in minutes, the school for Asr, the high-latitude rule, the theme, the language, the Adhan sound and the tasbih counter
- ummah_qadha_khatam_prefs
- the Qada log, that is the prayers you have to make up, and the record of your khatms
- ummah_quran_bookmarks
- your bookmarks and your notes on verses, exactly as you wrote them
- ummah_quran_position
- the last verse you reached, so that you can go back to it
- ummah_quran_reciter, ummah_quran_audio
- the reciter you chose and which recitations you have downloaded to your phone
- ummah_prayer_tracker
- the ticks for the five prayers, day by day
- ummah_hifz
- what you have memorised, how sure you are of each portion and when the next review falls
- ummah_ramadan_prefs
- your fasting and the Ramadan record
- ummah_consent_prefs
- what you said yes to, and when. The date is kept, not a bare yes, so that it can be said when you accepted
- ummah_moderation_prefs
- the list of people you have blocked, with the name they had at the time
- ummah_community_prefs
- the key that gives you your identity in the chat, the display name and the colour you chose. The key does not go into the backup, so that two installations do not end up as the same person
- ummah_jamat_push, ummah_jamat_notification_dedupe
- your Jamat choice, the installation’s pseudonymous ID and secret, country, H3 cell, language and time zone used for routing, calls awaiting confirmation and recently delivered IDs. They are device-bound and excluded from both Android backup and manual export
- ummah_adhan_reliability
- the log that says whether the Adhan actually sounded, at what time and with what delay
- ummah_daily_content_prefs, ummah_overpass_cache, ummah_mosque_directory_cache, ummah_metal_prices, ummah_stream_config
- temporary caches: the content of the day, the answers from the place search, the last gold price and the list of radio stations. They rebuild themselves if you delete them
- adhan_silence_state, ummah_backup_prefs
- the app's own bookkeeping: the ringer profile and the Do Not Disturb state from before the Adhan, kept for as long as the quiet window lasts so they can be put back afterwards, and the date of the last backup and the last restore, the same one you see in Settings → Backup
What does not exist at all
No account, password or advertising ID. We include no ads, analytics or automatic crash reporting. Firebase Messaging and Play Integrity App Check are included only for optional background Jamat Call delivery and abuse protection; if you enable it, a device token and an approximate H3 cell may be processed, never your exact coordinates.
3. What leaves your phone
Ten destinations, that is all. Each one has a real caller in the app; nothing is listed here just to be on the safe side.
| Host | What is sent | When | Can be stopped |
|---|---|---|---|
cloud.atomtech.ro (chat, WebSocket) | The display name you choose, the text of the messages, the pseudonymous identity and the channel you enter. | Only if you have switched the chat on. While it is off, the app does not open the connection. | Yes. Settings → Community chat. |
cloud.atomtech.ro (streams.json) | Nothing about you, apart from your IP address. | Once a day, when you open Radio. | No, but the request holds nothing personal. |
muslim.atomtech.ro (mosques) | The country code, a level-7 H3 cell — an area of about 5 km², not your point — and how many results are asked for. Plus the app name and version. The search radius stays here: the distance filtering happens on the phone. The exact coordinates do not leave either, but the cell does reveal the approximate area. | When you press Search in Radar. The screen states in advance that an approximate area will be used. | Yes — do not search. The list already downloaded stays on your phone and can be read without internet too. |
muslim.atomtech.ro (Jamat push) | On activation: the FCM token, a pseudonymous public key, an installation ID and secret, country, resolution-6 H3 cell, language and time zone. On a call: the prayer, cell or mosque, scheduled/expiry times and a deduplication ID. Exact coordinates do not leave. | Only after you explicitly enable Jamat push; routing is updated when the area or token changes, and a call leaves only when you confirm it. | Yes — turn off Jamat push. The app requests registration revocation, stops Firebase and deletes the local token; if revocation cannot reach the server, server data follows the documented retention period. |
Google Firebase Messaging / Play Integrity App Check | Firebase processes the FCM token and technical data needed for delivery. Play Integrity processes technical app and device signals to issue the App Check attestation. A push contains the call ID, prayer, scheduled and expiry times, optional mosque ID and deep link. Notification text is generated locally in the interface language; the push contains no H3 cell or exact coordinates. | After explicit activation: when the token is issued or rotated, when an App Check attestation is obtained, and when a Jamat Call is delivered. | Yes — turn off Jamat push. The app disables automatic initialization and requests token deletion; Google may retain data under its own policy and legal obligations. |
overpass-api.de | For halal places and butchers: a point rounded to a cell of about 1.1 km and the requested radius, plus the app name and version. When the mosque directory is sparse in the area, OSM mosques from the same response supplement it with no extra request. | Only when you press the search button, and only after you have agreed. | Yes. Settings → Place search. |
everyayah.com | Which surah, which verse and which reciter you are listening to or downloading. | On playback, or when a recitation is downloaded. | Yes — do not listen to or download audio. |
qurango.net, cdn-globecast.akamaized.net | That you are listening to that station, and how long you keep it on. | While the radio station or the video feed is running. | Yes — do not start the station. |
api.gold-api.com | Nothing apart from your IP address. No amount and no calculation leaves your phone. | When you open the Zakat calculator. | Yes — do not open the calculator. |
api.frankfurter.dev | Only the currency code: the one you chose, or RON on first open, when you have not chosen yet. | In the Zakat calculator as well, and only if the currency in the calculator is not USD. | Not entirely. The calculator starts on RON and asks for the rate on first open, before you get to choose the currency. While the currency is USD, nothing more goes to this host. Nothing goes at all only if you do not open the calculator. |
Everyone sees your IP address
Every host in the table sees your IP address. That is how a connection works and there is no way for it to be otherwise. The IP shows roughly the city.
Why the table can fall behind
The list of radio stations is served by our server and can name hosts other than the ones above. What is in the list today is in the table. On the day the list changes, the table becomes incomplete — which is why this is written here, in plain sight, and not in a footnote.
4. Location
The prayer times, the Qibla direction and the calendar are worked out on your phone. For them, your position goes nowhere — there is no prayer-times server.
In Radar, halal search sends Overpass a coordinate rounded to about 1.1 km and the requested radius. Mosque search sends the ATOM server the country and an approximate H3 cell; exact coordinates stay on your phone. Both requests reveal an approximate area and do not make you anonymous.
The location permission can be refused, and the app carries on with the city you chose by hand from the list. Nothing in it is locked because you said no.
5. The community chat
It is off until you switch it on, and before that we show you what leaves your phone. While it is off, the app does not open the chat connection and sends nothing about you to the relay. The one request that still reaches cloud.atomtech.ro is the radio station list, if you open Radio — it is the streams.json row in the table in section 3.
You are pseudonymous: you choose the display name yourself, and the identity is derived from a key generated on your phone. The relay keeps no register of users — it has no accounts, no passwords and not your e-mail address.
The relay keeps the last 100 messages of each channel, so that someone joining now sees the conversation. Reports are kept for 90 days, then deleted.
Your block list stays on your phone. The relay receives it at each connection and forgets it when the connection closes, so that no map of who avoids whom builds up on the server.
Messages are not end-to-end encrypted
They pass through the relay in the clear, and whoever runs the relay can read them. The connection is TLS, so the messages are protected on the way, not at the end. Do not write anything there that you would not say in public.
6. Children
To switch the chat on, you declare that you are at least 16 years old. The declaration and its date are kept, and nothing else.
Nothing in the app verifies your age and nowhere do we claim to have verified it. We ask for no document, we ask for no card, and we do not guess it from other data. What you declared is what stands.
The rest of the app — the prayer times, the Qur'an, Qibla, Qada — does not ask about age, because it sends nothing about you anywhere.
7. Your rights, and how you use them
Erasing the data from your phone
Uninstalling deletes the local files in the app's private space. The encrypted Android backup may remain in your Google account and restore selected data after reinstalling; you can manage or delete it in Google/Android settings. Manual exports remain wherever you saved them.
Erasing the messages from the relay
Send an e-mail to the address in section 9 and write the identity below into it. Without it there is nothing for anyone to look for: the relay does not know who you are, does not have your name and does not have your e-mail address. The identity is the only thing that ties the messages to you.
Consent is withdrawn from Settings, with a single tap — as easily as it was given. Withdrawing it for the chat closes the connection on the spot; withdrawing it for the place search makes the next search ask you again.
Your identity in the chat
This is everything the relay knows about you. Copy it and put it in the erasure request.
Your identity is different on every phone, so a web page has no way of knowing it. You will find it in the app under Menu → App → Privacy, with a “Copy the identity” button. The same screen says which of the two places below holds the key on your phone — or that the phone could not generate one, in which case nothing has gone to the relay and there is nothing to ask to have erased.
Where the key is kept
- In the AndroidKeyStore. The private key does not leave it — not even the app can read it as bytes; it only asks for signatures with it.
- In a private file of the app, when the AndroidKeyStore could not sign. The file can be read by root on a rooted phone. It is not as strong as the option above, and there is no point pretending that it is.
8. Changes
When the text changes, the date at the top of the page changes with it. The version published on the web is generated from the text in the app, with tools/build-privacy-html.js — so that the published policy cannot end up describing an app other than the one installed.
If the terms of the chat change, the old acceptance no longer holds and we ask you again. The version accepted is kept beside the date, precisely so that an old yes cannot pass for a new one.
9. Contact
For any question, erasure request or report about a message, write to contact@atomtech.ro.