Privacy

What UmmahPlaces collects

• Your account - name, email, and a photo if you add one. Optionally, dietary notes you choose to save (allergies and the like) so you don't have to re-check the same menus. That field is yours, kept on your account only, and never shown to a business or used to target anything at you.
• What you post - reviews with their ratings, photos and text, questions you ask a business, and answers you give. These are public, under the name on your account. They are screened automatically when you post; anything that trips the filter is held for a person to look at before it appears.
• Bookmarks and check-ins - places you save, and a check-in if you scan a listing's QR code. Check-ins store a one-way hash of your IP address rather than the address itself, used only to stop the same phone counting twenty times in one day.
• Site search - when you search, we keep the words you typed, the number of results, a one-way hash of your IP address and a session token, for 30 days. We also keep which site the search was on (UmmahPlaces), the place you chose to search in (a city, a state, a postal code or a country), and whether you used the near-me path. We never keep your device's location for this: only the place you chose. We use it to see what people look for, on which site, and where, and to stop one machine counting many times. We do not link searches to your account, and no search record identifies you.
• Business claims - if you claim a listing, we keep who claimed it, when, the evidence you gave, and an edit log of the changes made to the listing afterwards.

Most of the directory itself - names, addresses, hours, menus - is business information, not personal data. Ratings sourced from Google or Yelp are labeled with where they came from, and are never mixed into UmmahPlaces' own review scores.

Professionals we list from public pages

For some professions - doctors, dentists, lawyers, realtors and similar - we add an entry for a professional from a public page (a practice website, a professional association's page, a professional directory) before they have joined UmmahPlaces. We show only what that page said: their name, profession, city, practice name, a headshot we copy and host ourselves (never linked from someone else's server), and a link to the page it came from. Every such entry says where it came from and that it is not claimed yet, and links to its source, on the card and on the page. The label says "own public page" only when the source is the professional's own site. For an association or a directory it names that body, and for any other page it names the website. We do not show a rating, a review, a "verified" badge, or an "open for clients" claim on these entries, because nobody has confirmed any of that.

The professional - or anyone who believes an entry is wrong - can claim it for free, which lets them edit or remove it, or ask us to remove it without claiming, from a link on the entry itself. A person reviews every removal request before anything is taken down.

The newsletter

If you sign up for the "New Listings & City Updates" newsletter (footer form on any page), we collect your email, how often you asked for it ("weekly digest" or "every new listing"), and where you signed up. This is double opt-in: signing up sends a confirmation email, and nothing else sends until you click it. Every newsletter email has an unsubscribe link (one click, no login). We do not track whether you open or click these emails - no tracking pixels. If you unsubscribe, we keep your address on file only to remember not to email you again (suppression), or delete it entirely on request.

The country waitlist

If you visit from a country we do not cover yet, one form lets you ask us to tell you when we do. That form collects your email, the country you chose, and, only if you give it, your city. Nothing else: no name, no phone, no street address, and no device location. We use the address for one purpose only, to email you when UmmahPlaces reaches your country.

It is one email at most: a confirmation now, and one notice when we get there. Our own mail server sends it (Stalwart, at mail.ummah.email); no outside mailing platform is involved. If your address is at a provider such as Gmail or Outlook, delivery of course passes through that provider, the way all email does.

Every email we send carries a link that removes you in one click. Removal deletes your row in the same request, and we keep no suppressed copy of the address. We keep your email until you remove it, or until we have written to you about your country, whichever comes first. We do not store your IP address beside your email; our own abuse limit counts requests by address for a few minutes and then forgets.

Help Mode - an admin viewing your dashboard

If you own a claimed listing and ask us for help, a UMG admin can open your business dashboard as you. The session must carry a written reason, expires automatically after 20 minutes, and is recorded in an append-only log: who opened it, why, from what address, and what they did. Changes that carry money or legal weight - billing, deleting or transferring a listing, halal-compliance attestations - are blocked outright while it is active.

One honest exception. We do not currently email you when a Help Mode session is opened on your listing. The record exists and you can ask us for it at any time; sending you the notice automatically is built but not yet switched on, and until it is, this page says so rather than implying otherwise.

Activity tracking on this site

UmmahPlaces loads UMG's own first-party behavioral system, which links your activity here to your UmmahPass profile across our sites and is used today to improve the product. It is on by default, fully disclosed, and you can turn it off - which deletes the profile, not just future collection - in your UmmahPass privacy settings. Aggregate traffic measurement uses Matomo on our own servers, and the explore map draws on OpenStreetMap data served through OpenFreeMap, whose tile servers see your IP address like any web request does. No Google Analytics and no Meta pixel run on this site. EPOM, our ad server, does run here and can set a cookie. Some paid ads it serves carry a Google ad tag. Our full privacy policy explains what that tag does.

Search by meaning

When you search UmmahPlaces, we look for your exact words first. We also send the words you typed, as plain text, to OpenRouter, a routing service, which passes them to DeepInfra, the company that turns text into numbers for us. We use the numbers to find places whose description is close in meaning to what you typed. Those places show under a "Close matches" heading, after the places that contain your words. We send the words only: not your account, your IP address or your location.

We keep no new record of the words. The 30-day search log described above is the only place we keep them. OpenRouter says it does not store the text of a request unless an account owner switches on logging, and we have not switched it on. DeepInfra says it does not store the data sent to its API on disk, deletes the text from memory when it has the answer, does not log the content of requests and does not train on it. Each request asks OpenRouter to use only an endpoint that it lists as zero data retention. If none is free, the request fails and you see exact-word results only. Neither company gives a number of days for holding the text, because neither says it keeps it. Both keep request details, such as time, size and cost, without the text. We read these statements on October 10, 2026, on OpenRouter's data collection page and DeepInfra's data privacy page.

Find near me and your location

The explore map's Find near me button uses your location only on your own device, and only at the moment you tap it. Your browser asks your permission first. If you allow it, the map sorts nearby places in your browser. The location is not sent to our servers, and we do not store or log it. When you close the page, it is gone. If you decline, the map still works; you can use the site search to find a city instead.

The homepage near-you rail, the homepage search, and the category pages wait for a tap before they ask your browser for your location. Nothing on those pages asks for it on its own. When you tap Find near me or Use my location and allow it, your position is sent with that request (at most one follow-up within 50 km if too few places are found nearby) so the results can be sorted by distance. It travels in the body of that request, not in the page address, so it is not written into the link you could copy, it is not written into our access logs, and it is not stored. If you decline, the page keeps its normal order, and you can type a city or ZIP instead. Results sorted this way are for your screen only: the address stays clean, and a link you copy shows the default order.

The commitment that matters most here

"We never generate fake activity - reviews, donor counts, member counts. What you see on our surfaces is real or clearly labeled."

Quoted from section 2 of the ecosystem privacy policy. On a directory that is the whole product: a review here was written by a real account, or it carries the name of the outside platform it came from.

The rest of the policy

Contact

Questions, or a request to see or delete what we hold: salaam@ummahmediagroup.com.