Privacy at UmmahPass

What UmmahPass collects

• Your account - your name, your email address, and your password, which is stored only as a bcrypt hash. We never store or see the plain text.
• What you choose to add - screenname, profile photo, additional email addresses, and verification documents if you apply for Muslim verification.
• Payments - if you become a paying member, Stripe handles your card. We never see or store your card number; we keep what you paid, when, and for which membership, so we can honour it.
• Server logs - like every website, our servers log requests (IP address, page, time, browser) for security, abuse prevention, and debugging, and keep them for a limited period.

The cross-site activity system reports here

UmmahPass is not just another site that runs UMG's first-party activity system - it is the site that hosts it. The script the other UMG sites load is served from ummahpass.io, and the events it sends land in our database here, attached to your UmmahPass account. That is why the switch is on this site and nowhere else.

It is on by default for a new account, and the profile it builds is used to recommend content, businesses and missions across the ecosystem. It is never sold and never shared outside Ummah Media Group. Every site that runs it says so on its own privacy page, and the complete audited list is published in one place: the sites that run it.

Turn it off - and erase what is already there

The umg_id cookie, in full

This is the one page in the ecosystem that documents this cookie - the canonical policy links here for it.

• When you sign in, we set a cookie named umg_id on .ummahpass.io. It holds a signed token (a JWT) carrying your UmmahPass user ID, your screenname, your membership tier, and which memberships are currently active. It carries no payment details, no contact details, and no message content.
• It expires after 30 days and is sent only over HTTPS. It is deliberately readable by JavaScript on our own domains - that is what makes the next point work.
• Other UMG sites recognise you by reading it through a small page we serve at https://ummahpass.io/identity-bridge.html, loaded in a hidden frame. Only origins we have explicitly allow-listed can read a result from it.
• Signing out clears it immediately, and signing out of the ecosystem clears it everywhere. You can also delete it in your browser at any time.
• Your browser also stores two anonymous identifiers - up_anon_id (localStorage) and up_session_id (sessionStorage) - which stitch a single visit together before and after you sign in.

Your rights, and "Do Not Sell or Share"

We do not sell or share your personal information with third parties for money or other valuable consideration - there is nothing here to opt out of, because we do not do it. Your rights to know, access, correct, delete and port your data, and to opt out of the activity system, are set out in full in the canonical policy; the controls themselves are in your profile. To exercise any of them, use those controls or email privacy@ummahpass.io - we answer within 30 days.

One commitment, quoted exactly

"We never sell your data. Not to advertisers, not to data brokers, not to anyone."

- quoted verbatim from section 2, What we will NEVER do. Every commitment in that list binds UmmahPass too.

Contact