Salam.life

Privacy Policy

Last updated: 15 July 2026

1. Who we are

Salam.life is a global online community for Muslims and anyone else who wishes to take part in respectful conversation around faith, culture, family and daily life. The service is operated by IT RESOURCE (AITI RESURS), LLP, BIN 230240046213, with its registered office at 73 Mezhdunarodnaya Street, Apt. 3, Turksib District, Almaty 050037, Kazakhstan ("Salam.life", "we", "us" or "our"). We are the data controller for the personal data processed through the salam.life website and through the Salam.life mobile applications distributed via the Apple App Store and Google Play (together, the "Service").

You can reach us at any time at info@salam.life. This same address is the single point of contact for users under Article 12 of the EU Digital Services Act and for Member State authorities, the European Commission and the European Board for Digital Services under Article 11 of that Regulation. Communications may be sent in English.

This Policy explains, in plain language, what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, how we protect it, and the rights you have over it. It is written to satisfy Articles 12 to 14 GDPR, the equivalent provisions of the UK GDPR, the notice-at-collection requirement under the CCPA as amended, the App Store and Google Play disclosure rules and the disclosure requirements of the Digital Services Act and the EU AI Act.

We make this Policy available in several languages for your convenience. In the event of any inconsistency between versions, the English text prevails.

2. The Service in plain terms, and what that means for your data

Salam.life is a social network. You create an account, choose a public handle and display name, optionally add a short biography and avatar, and share posts, comments, votes, follows and blocks with other members of the community. The feed is organised into two gender-separated streams, /brothers and /sisters, so that members who prefer that arrangement can take part comfortably; this is the only reason we ask you to indicate gender when you register. We do not ask for your religion. Members are free to mention faith, practice, school of thought or anything else they wish inside their bio or posts, but there is no structured "religion" field in your profile.

Because the Service is openly marketed to the worldwide Muslim community, we understand that the very act of using Salam.life may be perceived by some people as revealing a religious affiliation. We have therefore deliberately designed the platform to minimise the personal data we hold about you: we do not profile you on the basis of inferred beliefs, we do not show third-party advertising to you inside the Service, we do not sell your data or share it with data brokers, and we do not maintain a separate "religion" attribute about you in our systems. Our website carries no third-party advertising or cross-site tracking technologies. Our mobile app does, however, use Google's Firebase Analytics and Crashlytics to measure how the app is used, to diagnose crashes, and to measure the effectiveness of our own advertising campaigns — for example, how many people who installed the app after seeing one of our ads went on to register. We describe this in detail in sections 3, 7 and 8. We do not use these tools to display third-party advertising inside the app, and we do not sell your personal data.

3. The personal data we collect

We collect only what we need to run the Service.

Account data. When you register, we ask for your email address, a password (which we store only as a salted cryptographic hash and never in plain text), a public handle, a display name, your gender (male or female, used only to route your participation to the /brothers or /sisters stream), your country expressed as a two-letter ISO code, and your preferred interface language. You may optionally add a profile picture and a short biography.

Content you publish. Posts, comments, upvotes, downvotes, follows, blocks, content you report, and any images you choose to attach to a post are stored on our infrastructure and are, by their nature, visible to other members in accordance with the feature you used to publish them. Reports you submit about other members or their content are stored as part of our moderation record.

Technical data. When you use the Service we automatically receive and log technical information that is generated by the basic operation of the internet and our applications: your IP address, the date and time of your requests, the URLs and endpoints you accessed, the user-agent string of your browser or app, the session token associated with your login, and the time and method of your most recent sign-in. We use this data to operate the Service, secure accounts, prevent fraud and abuse, debug issues and meet our legal record-keeping obligations.

Analytics and usage data. To understand how the Service is used, to improve it and to measure the effectiveness of our own marketing, we collect events describing how you interact with the Service — for example when you open the app, start a session, view or expand a post, share a post, vote on or comment on content, follow another member, run a search, or when a post card appears in your feed. Depending on the surface, this data is collected in two ways:

  • Our own analytics. We send product-analytics events to an analytics database that we operate on our own server. Each event may include a randomly generated identifier that is not linked to your real-world identity ("anon_id"), a session identifier, the type of interaction and the post or content it relates to, your coarse country (derived from your IP address), your platform, app version and interface language, and a hashed, salted form of your IP address — we do not store your raw IP address in this analytics store. If you are signed in, the event is associated with your account identifier server-side.
  • Firebase Analytics and Crashlytics (mobile app only). Our mobile app includes Google's Firebase Analytics and Firebase Crashlytics software development kits (SDKs). Firebase Analytics records the same kinds of usage events together with a Google-assigned app-instance identifier and, on Android, may use your device's advertising identifier (AAID); it feeds Google Analytics for Firebase and lets us measure conversions from our own advertising campaigns in Google Ads. Crashlytics records diagnostic information when the app crashes — such as the type of error, the state of the app at the time, the device model and operating-system version — so that we can find and fix stability problems. This data is processed by Google as described in section 8.

Communications. If you contact us at info@salam.life, we keep the message and our reply for as long as we need it to resolve your enquiry and to demonstrate that we handled it properly. We send only transactional emails — account verification, password reset and security notices — and no marketing email. The Service currently sends no push notifications.

We do not require or solicit any of the special categories of personal data described in Article 9 GDPR — such as data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation — and we do not maintain structured profile fields for any of those categories. Members may, of course, choose to mention any topic, including their faith or beliefs, in the free text of their bio, posts or comments; in that case we process the content of those publications only to operate the Service, as further described in section 5.

We do not collect biometric identifiers, precise location data, contacts, calendar or motion data, or data from connected accessories. Our mobile apps do not request access to the camera, the microphone, location, contacts, the calendar, health data, motion sensors, Bluetooth devices or biometric sensors. Apart from the App Tracking Transparency prompt shown on iOS, which governs analytics tracking (see section 7), the only optional device permission the app requests is access to your photo library, and only at the moment you choose to attach a picture to a post.

4. Why we use your data, and on what legal basis

For users in the European Economic Area, the United Kingdom and other jurisdictions whose data protection laws are modelled on the GDPR, we rely on the following legal bases.

We process the data needed to create your account, authenticate you, run the gender-segregated feed, deliver content you have chosen to share with other members and provide the social-network features of the Service on the basis of performance of a contract with you (Article 6(1)(b) GDPR): without this processing, we cannot provide the Service you have asked for.

We process technical data, session information and moderation records on the basis of our legitimate interests (Article 6(1)(f) GDPR) in operating a safe, available and lawful platform, in keeping records of moderation decisions so that we can review them, in preventing fraud, spam, harassment and abuse, in defending and exercising legal claims, and in maintaining the security and integrity of our infrastructure. We have considered the impact of this processing on you and we believe that, taken together with our minimisation, retention and access controls, these interests are not overridden by your interests or fundamental rights.

We process analytics and usage data — including the product-analytics events we collect on our own server and the data collected through Firebase Analytics and Crashlytics in the mobile app — to understand and improve how the Service is used, to keep it stable and secure, and to measure the effectiveness of our own advertising campaigns. Where the applicable law allows, we rely on our legitimate interests (Article 6(1)(f) GDPR) in operating, improving and promoting the Service for this processing, balanced against your interests as described above and mitigated by measures such as storing only a hashed, salted form of your IP address in our own analytics store. Where the applicable law instead requires your prior consent for analytics or for the storage of identifiers on your device — as is generally the case in the European Economic Area and the United Kingdom — we will obtain that consent before the processing begins and you will be able to withdraw it at any time. On iOS, Firebase analytics collection additionally depends on your response to Apple's App Tracking Transparency prompt: if you decline, we disable it.

We process the data we need to comply with our legal obligations on the basis of Article 6(1)(c) GDPR. This includes responding to lawful requests from competent authorities, keeping tax and accounting records where required, complying with the obligations that apply to online platforms under the Digital Services Act, and reporting suspected child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as required of electronic-service providers under 18 U.S.C. § 2258A.

Where we ever rely on your consent — for example if you choose to opt in to a future optional feature — we will make that clear at the moment we ask, and you will be able to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

For users covered by the UK GDPR, the same legal bases apply under the equivalent provisions of UK law. For users in other jurisdictions we rely on the equivalent lawful grounds available under local law, including, where applicable, performance of a contract, legitimate interests of the controller, compliance with a legal obligation and consent.

5. A note on gender and on the religious context of the platform

We collect a binary gender indicator (male or female) at registration because the feed itself is structured as two parallel streams and we need this single attribute to route your activity to the appropriate stream. Gender, in this sense and in the absence of any health or sexual-orientation data, is treated by us as ordinary personal data and used for that one operational purpose. We do not infer your sexual orientation from this attribute, we do not share it with third parties for any purpose other than running the Service, and we do not use it for profiling or advertising.

We are aware that the Service is marketed primarily to Muslim users and that some members will, in their bio or posts, voluntarily share information about their religious or philosophical beliefs. Any such information is information you have chosen to publish, and we treat it accordingly: we do not enrich your profile with religious attributes, we do not build inferred religious profiles of you, we do not use the content of your posts to categorise you by belief, and we do not share post content with advertising networks. We process the content you publish only to make the Service work as you have asked it to.

6. AI-assisted features ("Post with AI")

Salam.life offers an optional Post with AI feature that helps you draft, translate or refine your own posts and comments. When you use it, the text you type as a prompt is sent over a secure connection to a third-party model provider for one-time inference; the provider returns suggested text, and you then decide whether to edit it, publish it as your own post or discard it. We do not train our own AI models on your content, and your prompts are not retained by us beyond the time needed to deliver the response unless you choose to publish the resulting content as a post or comment, in which case the published content is stored as ordinary user-generated content.

We are mindful of the transparency obligations introduced by the EU AI Act (Regulation (EU) 2024/1689), and in particular by Article 50, which becomes applicable on 2 August 2026. Because you remain the author and editor of anything you publish through Post with AI — the feature exists to assist you, not to publish on your behalf — you exercise editorial responsibility over the final content. We will continue to monitor the Commission's guidance and Codes of Practice on transparency for AI-generated content and will update this Policy and the in-app experience as needed to reflect any further obligations that apply to the way the feature is used.

7. Cookies and similar technologies

The Salam.life website uses two categories of cookies and equivalent local-storage items.

Strictly necessary cookies, which are essential to deliver the Service in the form you have requested: an authentication cookie that keeps you signed in, a language-preference cookie that remembers the interface language you have chosen, and a theme cookie that remembers whether you prefer light or dark mode. These cookies are set automatically and do not require your consent.

Analytics cookies, set by Google Analytics (provided by Google LLC). We use Google Analytics to understand aggregate website traffic — how many people visit, which pages are popular, where visitors come from and how the Service performs technically. We have configured Google Analytics so that IP addresses are anonymised before processing, we do not link analytics data to your account, and we do not enable Google Signals or any advertising-related features. We ask for your consent before placing analytics cookies on your device, through a cookie banner shown on your first visit to salam.life. You can change your choice at any time by reopening the cookie settings on the website. Refusing analytics cookies does not affect your ability to use the Service.

On the website, we do not use cookies for advertising, profiling, cross-site tracking or behavioural-advertising audience-building, and we do not embed Facebook Pixel, advertising SDKs or similar third-party advertising technologies.

Mobile app analytics and diagnostics. Our mobile app does not use browser cookies, but it does include two Google SDKs — Firebase Analytics and Firebase Crashlytics — and it stores a small number of identifiers on your device for analytics purposes: a Google-assigned app-instance identifier used by Firebase, and a randomly generated "anon_id" used by our own analytics. Firebase Analytics measures how the app is used and lets us measure conversions from our own advertising campaigns in Google Ads; on Android it may also use your device's advertising identifier (AAID). Crashlytics collects diagnostic data when the app crashes so we can fix stability problems. On iOS, before any analytics tracking that relies on your advertising identifier takes place, the app shows Apple's App Tracking Transparency prompt; if you decline, we disable Firebase Analytics collection. On any platform you can limit or reset your advertising identifier in your device's system settings, and you can opt out of personalised Google advertising through Google's own controls.

Because our mobile app uses Google's analytics and crash-reporting SDKs, our app-store disclosures reflect this. In Google Play's Data safety section we declare that the app collects app-activity, diagnostics and device-identifier data and shares analytics and diagnostic data with Google; and when the iOS app is released, in Apple's App Privacy framework we will declare the corresponding Usage Data and Diagnostics data types and, where the advertising identifier is used, the associated tracking disclosure. We still do not sell your personal data, and we do not display third-party advertising inside the app.

8. Who we share your data with

We share personal data only with the carefully chosen service providers we need in order to run the Service, and only to the extent each provider needs the data to do its job. They act as our processors under written agreements that bind them to use the data only on our instructions, to protect it with appropriate security measures, and to delete or return it when their service ends.

The current categories of sub-processors are:

  • a cloud infrastructure provider hosting our servers and databases in the European Union;
  • an image storage and content-delivery provider that stores and serves the avatars and images you upload;
  • a transactional email provider that delivers verification, password-reset and security messages on our behalf;
  • a website analytics provider (Google LLC, operating Google Analytics), used only to measure aggregate traffic and performance of the salam.life website;
  • a third-party AI model provider, accessed for inference only, used to power the Post with AI feature;
  • Google LLC, whose Firebase Analytics and Firebase Crashlytics services (used in our mobile app only) process usage-analytics events, a Google-assigned app-instance identifier and — on Android — the device advertising identifier, and receive crash-diagnostic data; this processing also lets us measure conversions from our own advertising campaigns in Google Ads; and
  • Apple Inc. and Google LLC, which distribute our mobile apps through their respective app stores and process basic data necessary for that distribution.

The product-analytics events described in section 3 are stored in an analytics database that we operate ourselves on our own server; that server is not a third-party service, but because it is located outside the European Economic Area it is covered by the transfer safeguards described in section 9.

If you choose to sign in to the web version of the Service using your Google account, Google LLC also acts as a sign-in provider; in that case Google shares with us only the basic identity information required to create or log you into your Salam.life account.

We do not sell your personal data. Apart from the usage-analytics and crash-diagnostic data that our mobile app shares with Google through the Firebase SDKs — which we use for our own analytics and to measure the effectiveness of our own advertising, as described in sections 3 and 7 — we do not share your personal data with third parties for their own independent purposes, and we do not otherwise share it for cross-context behavioural advertising. We do not disclose it to anyone other than the providers described above unless we are legally required to do so — for example by a valid court order, a binding legal request from a competent authority, or in connection with reports we are required to make to NCMEC under U.S. federal law in cases of suspected online child sexual exploitation.

If we are ever involved in a reorganisation, merger or sale of all or part of our business, personal data may be transferred to the relevant successor entity; in that case we will ensure that the successor is bound by terms at least as protective as those in this Policy and that you are informed.

9. International data transfers

Our primary infrastructure — the application servers, the main database and image storage — is located in the European Union, so the core of your personal data is stored on servers in the EU regardless of where you live. Two elements of the Service, however, involve processing outside the European Economic Area: the product-analytics events described in section 3 are stored on an analytics server that we operate ourselves outside the EEA, and the Firebase Analytics and Crashlytics data collected by our mobile app is processed by Google LLC in the United States and other countries where Google operates. Our team, however, operates the Service from outside the European Economic Area, including from our registered offices in Kazakhstan, which means that our personnel — together with some of our service providers — may access personal data hosted in the European Union from a third country. Where personal data is transferred outside the European Economic Area or the United Kingdom to a country that has not been recognised as offering an adequate level of data protection, we rely on the appropriate safeguards permitted by Article 46 GDPR (and the equivalent provisions of the UK GDPR), in particular the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 and, for transfers from the United Kingdom, the corresponding international data transfer mechanisms recognised by the UK's Information Commissioner. We put in place appropriate technical and organisational measures to maintain an essentially equivalent level of protection, including storing only a hashed, salted form of your IP address in our own analytics store.

10. How long we keep your data

We keep your personal data only for as long as we have a legitimate need for it.

We keep your account profile and the content you have published for as long as your account is open. When you delete your account, we delete the underlying data from our production systems within seven days and from our backups within thirty days, except for the limited categories described below. Server logs that contain technical and security information are retained for up to ninety days and then deleted or aggregated beyond recognition. Moderation records — including reports about content or members and the decisions we took in response — are retained for up to twenty-four months so that we can detect repeat behaviour and comply with our obligations under the Digital Services Act. We do not retain inputs sent to the third-party model provider for the Post with AI feature beyond the time needed to deliver the response, unless you choose to publish the resulting content as a post or comment, in which case the published content is stored as ordinary user-generated content and follows the retention rules above. Records that we are legally required to retain (for example, tax records, records of reports made to law-enforcement authorities and information that is the subject of a preservation request) are kept for the period required by the applicable law and then deleted.

Product-analytics events stored on our own analytics server are retained for up to twenty-four months and are then deleted automatically. Analytics and crash-diagnostic data collected through Firebase is retained in accordance with Google's retention settings and policies; we configure Google Analytics for Firebase to retain event-level data for the shortest period consistent with our reporting needs and rely on Google to delete or aggregate it thereafter.

11. Your rights

If you are located in the European Economic Area or the United Kingdom, you have the following rights in relation to your personal data, exercisable at any time by writing to info@salam.life or by using the controls inside the app and the website: the right to be informed about how your data is processed (which this Policy is designed to satisfy); the right of access to your data; the right to rectification of inaccurate or incomplete data; the right to erasure of your data ("right to be forgotten"); the right to restriction of processing; the right to data portability for the data you have provided to us and which we process by automated means on the basis of your consent or of a contract with you; the right to object to processing based on our legitimate interests; the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (we do not make such decisions about you); and, where we have asked for your consent, the right to withdraw it at any time.

If you are a California resident, you also have, under the California Consumer Privacy Act as amended by the California Privacy Rights Act, the right to know what personal information we have collected about you, the categories of sources, the business or commercial purposes for which we use it and the categories of recipients with whom we have disclosed it; the right to access that personal information, including information collected more than twelve months before your request; the right to correct inaccurate personal information; the right to delete personal information; the right to opt out of the sale or sharing of personal information (we do not sell or share personal information in the sense the CCPA gives to those terms, including for cross-context behavioural advertising); the right to limit the use and disclosure of sensitive personal information; and the right not to be discriminated against for exercising your CCPA rights. The categories of personal information we collect are described in section 3, the purposes are described in section 4 and the recipients are described in section 8; all of those categories are collected from you directly or generated by your use of the Service. The only category of "sensitive personal information" as defined by the CCPA that we collect is your account log-in credentials (email and salted password hash), which we use only to authenticate you to the Service, as permitted by section 7027(m) of the CCPA regulations; we do not use or disclose any sensitive personal information for purposes that would trigger a right to limit it.

We acknowledge that residents of Brazil (under the LGPD, Law No. 13,709/2018), Indonesia (under the Personal Data Protection Law, UU PDP 27/2022), Turkey (under the KVKK, Law No. 6698), Malaysia (under the PDPA 2010), the Kingdom of Saudi Arabia (under the PDPL), the United Arab Emirates (under Federal Decree-Law No. 45 of 2021), Pakistan (under the PDPA) and the People's Republic of China (under the PIPL), among others, are granted analogous rights by their domestic data-protection laws. We will give effect to those rights to the extent the relevant law applies to our processing, and you can reach us in the usual way at info@salam.life.

To exercise any of these rights, write to info@salam.life. We will respond within the time limits set by the applicable law (one month under the GDPR and UK GDPR, extendable by two further months for complex requests; forty-five days under the CCPA, extendable by another forty-five days). We may need to ask you for information that allows us to confirm your identity before we act on your request, in order to protect your data from being disclosed to someone else.

If you are in the EEA you also have the right to lodge a complaint with the data protection supervisory authority of your country of residence, work or alleged infringement. If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ico.org.uk). We would, however, appreciate the opportunity to address your concerns ourselves first.

12. Account deletion

You can delete your Salam.life account at any time from inside the app, under Settings → Delete account, and from the website at salam.life. You may also send a deletion request to info@salam.life from the email address associated with the account. Deleting your account permanently removes your profile, your published posts and comments, your votes, follows and blocks from our production systems within seven days; backups are purged on the rolling schedule described in section 10. Information that we are required by law to retain, and the limited moderation records described in section 10, are kept for the periods set out in those sections and then deleted.

13. Security

We protect personal data with security practices proportionate to the scale and nature of the Service, including encryption of data in transit, hashing of passwords using a modern salted algorithm, network and application-level access controls and the principle of least privilege for access to production systems. No method of transmission or storage is perfectly secure, but we work continuously to keep the risk of a security incident as low as reasonably possible.

14. Children

The Service is for users aged 16 and older. We do not knowingly create accounts for, or knowingly collect personal data from, anyone under that age. Within the United States, in accordance with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) and its implementing rule (16 C.F.R. Part 312), we additionally affirm that we do not knowingly collect personal information from any child under 13. If you believe that a person under our minimum age has provided us with personal data, please contact us at info@salam.life and we will take steps to delete that data and close any associated account.

15. Reporting and content moderation

You can report content or accounts that you believe violate our rules or applicable law through the in-app Report function on each post, comment and profile, or by writing to info@salam.life. We act on credible reports within a reasonable time and may remove content, suspend accounts or take other appropriate measures where we conclude that our rules or applicable law have been breached.

Where we become aware of facts or circumstances suggesting the presence of child sexual abuse material or other offences described in 18 U.S.C. § 2258A on the Service, we report them to the CyberTipline of the National Center for Missing & Exploited Children (NCMEC), as required of electronic-service providers, and we cooperate with competent authorities in accordance with the applicable laws.

Notices alleging that content on Salam.life infringes copyright or other intellectual-property rights, including notices that follow the form of the U.S. Digital Millennium Copyright Act, can be sent to info@salam.life, which is our official channel for such notices.

For users in the European Union, info@salam.life also serves as our single point of contact for users and for communications from Member State authorities, the European Commission and the European Board for Digital Services in relation to the EU Digital Services Act. Communications may be sent in English.

16. Changes to this Policy

We may update this Policy from time to time to reflect changes in the Service, in our practices or in the law. If we make material changes, we will notify you by an appropriate means before they take effect, for example through an in-app notice or by email. The "Last updated" date at the top of this Policy always reflects the latest revision.

17. How to contact us

For any question, request or complaint relating to this Policy or to your personal data, please write to:

IT RESOURCE (AITI RESURS), LLP 73 Mezhdunarodnaya Street, Apt. 3, Turksib District, Almaty 050037, Kazakhstan Email: info@salam.life

We aim to respond to every enquiry in a timely manner, in the language in which it was sent where we are able to, and in any event in English.