VHajj privacy policy

Who runs the service

VHajj is run by the app's developer: the party named as "Developer" on the VHajj page of Google Play. You reach the service with an invitation code from the travel agency you travel with, or with a single journey bought inside the app. The agency hands out codes; it does not run the service. Contact: [email protected].

What the app collects from your phone

• Precise location for the whole journey, also while the app is closed: latitude/longitude, accuracy, altitude, speed, bearing, and the time and source of each reading. It runs as a service with a persistent notification; it starts on your tap (activating the code, or "Share my location again") and you can stop it at any time without deleting anything in Settings or with the "Stop sharing" button on the notification, after you confirm. While it is stopped nothing is collected and it does not come back by itself. In battery-saving mode the GPS is off and we use only positions the phone has already computed.
• Nearby Wi-Fi networks: the fixed identifier (BSSID) and signal strength of up to ten nearby access points, every 30 seconds to 3 minutes. We never join them, never send their names and never see their traffic. Purpose: a better position inside buildings.
• Motion sensors: raw accelerometer and gyroscope readings (up to 50 per second), barometric air pressure, compass heading, and per-second step count and motion intensity. The "physical activity" permission is requested for the step count. Purpose: to tell your walk apart from the people around you in the Haram broadcast.
• Device identifier: this app's Android ID on your phone (ANDROID_ID) — not a random identifier of ours — and the phone model name. It binds your code to one phone, so a copied code does not work elsewhere.
• Device diagnostics: battery level and charging state, network type (Wi-Fi or mobile data), satellite status (count, signal strength, sky positions, GPS chip model), permission, power-saving and thermal state, which sensors the phone has, whether a position is simulated (mock location), and your phone clock's offset from true time. To set the time the app asks the time server time.google.com, sending it no data about you.
• Family group data (only if you create a group yourself or join one by entering its code): the name you give yourself, the quick messages and emergency alerts you send, and your latest position and battery level, which only the members of your group see. Neither the app nor the server ever puts you in a group by itself, and a travel agency's pilgrims are not grouped together: someone holding a code from the same agency does not see where you are.
• Purchase records (only if you buy in the app): the Google Play purchase token, order number, purchase time, product, a salted hash of the phone identifier, and the code issued to you. Google Play handles the payment; we never see your card.

Not collected: microphone, camera, contacts, messages, call log, photos or files. The app only writes your own clips into Movies/VHajj on your phone.

What the server makes for you

Video clips cut for you from the public Haram broadcast, their thumbnails and their delivery status. They do not come from your phone, but they belong to your account and are deleted with it.

Why

To find the moments your phone was within the broadcast cameras' view, recognise your walk in them, cut your clip and deliver it in the app; to bind the code to one phone; and to show your family group's positions if you use it. Nothing is used for advertising or marketing tracking, and nothing is sold.

Who we share it with

We do not share your location, movements or videos with the travel agency. The agency sees only the code and service status and the number of clips prepared or delivered, with no media, location or motion data. Members of your family group see only what is described above. We sell your data to no one.

How long we keep it

• Journey data — the location record (with its Wi-Fi networks, steps, motion intensity, air pressure and compass heading), diagnostics, family group, photos, clips and the memories film: none of it is kept more than 30 days. Every reading, picture or clip that is 30 days old is deleted automatically, and the whole journey is deleted 30 days after the last data we received from it (or earlier, when you delete it yourself).
• A video after it reached you — a clip or the film is deleted on our side 7 days after it was delivered to your app (the first time it was downloaded whole to your phone, or the VHajj team sent it to you), and never later than the 30 days. Under each clip the app tells you when it will be deleted: save it on your phone before then.
• Raw accelerometer and gyroscope readings: processed in the server's memory for a few minutes for the matching, never written to disk.
• The phone identifier is kept with your session and deleted with it.
• Purchase records are kept to stop one purchase from being used twice and to handle refunds; they contain no location or motion.
• On your phone: without internet, positions wait in a queue inside the app until they are sent, for at most 48 hours.
• Technical server logs (connection times, session number, phone model, errors) are used to run and protect the service; your precise location is not written in them, every line older than 30 days is removed from them, and every line with your session number is removed when your session is deleted.

Your rights

Delete all your data at once in the app ("End the service and delete my data"): the app stops the service immediately, so nothing more is collected; the server deletes your data; then the app clears the waiting positions, its cached clips and its settings from your phone, together with the deleted account's own paid journey code. If the server's reply does not arrive, the request stays open with the service stopped, and the app tries again by itself. A paid journey code from another purchase that has not been used yet stays on the phone, shown in Settings, so a journey you paid for is never lost; it goes once it is used or refunded. Or use the data deletion page with your invitation code and session number together — both are shown in the app's Settings. After any deletion (in the app, on the page, by a refund or at the end of the retention period) the invitation code stops for good, and the next time the app contacts the server it is told, stops and clears the phone. Stopping the service or uninstalling the app stops sending at once. Clips saved in your phone's gallery are yours; we cannot reach them.

Security

Everything the app sends travels encrypted (HTTPS) to the VHajj server only.

Children

The service is for people over 18.