Privacy Policy

1. Who We Are

Battut is a family-friendly, Shariah-aligned social platform. This policy explains what personal data we collect, why, and the choices you have.

• Data Controller: Battut Sdn. Bhd. (Registration No. 202601011638 / 1673736-M).
• Registered Address: Unit 004, 7-2, Plaza Danau 2, Jalan 2/109f, Taman Danau Desa, 58100 Kuala Lumpur, W.P. Kuala Lumpur, Malaysia.
• Contact: [email protected] for any privacy question or request.

2. Information We Collect

We collect only what we need to run a safe, Shariah-aligned community and to give you a personalized experience.

• Account Data: Email address, username, and password (passwords are handled by Firebase Authentication and are never stored by us in readable form). Optionally, your date of birth (for age-based features and eligibility) and gender.
• Profile Data: Display name, biography, avatar, cover photo, social links, interests you select, and your content preferences.
• Content Data: Posts, reels, Khawater (text threads), stories, comments, and media you keep in your private Vault.
• Messaging Data: Direct messages and their contents — including text, images, videos, and voice notes — plus reactions, delivery/read status, and online presence (last-seen). Voice notes and media in chats are stored to deliver them.
• Engagement & Interest Data: Likes, saves, follows, blocks, watch time, and how you interact with the feed. We derive an on-device interest/affinity profile from this activity to rank and recommend content.
• Rewards Data: If and when our in-app rewards program launches, your Battut wallet balance and lifetime earnings. These fields exist but no live watch-to-earn payouts operate today.
• Location Data: If you use prayer-time or Qibla features, we read your device location (with your permission) to calculate them. Device location is used in the moment and is not stored on our servers; a location you enter manually is saved on your device only. You may also add a text location to a post yourself.
• Device & Log Data: IP address, device model, OS version, app version, and diagnostic logs (for security, abuse prevention, and debugging). We also use your IP address to estimate which country you are connecting from (never your precise location) and save that country with your account and on the posts you publish, for regional features, safety, and statistics. IP-to-country lookups use IP Geolocation by DB-IP (https://db-ip.com), licensed under CC BY 4.0.
• Push Tokens: With your permission, device push tokens (Firebase Cloud Messaging) so we can send notifications.
• Cookies & Local Storage: Essential storage to keep you signed in and remember your preferences, and — subject to your choice where required — analytics storage. See “Cookies & Analytics” below.
• Our Official Social Media Accounts: If you comment on or message Battut’s official accounts on other platforms (such as Instagram @battut.app), we receive that comment or message, your public username and profile photo, and the time it was sent, through the platform’s official API. Our team uses this only to read, moderate and reply to you. It is stored securely, visible only to Battut administrators, and never sold or used for advertising. Comments you delete on the platform are removed from our copy, and you can ask us to delete the rest at any time (see “Account & Data Deletion”).

3. How We Sign You In

You can create a Battut account with an email and password, or by using Sign in with Google or Sign in with Apple. When you use a third-party sign-in, we receive a limited set of information from that provider to create and secure your account:

• Sign in with Google: We receive your name, email address, profile photo, and a Google account identifier. We use only the basic profile and email scopes needed to authenticate you.
• Sign in with Apple: We receive your name and email address (Apple may provide a private “relay” email that forwards to you), and a secure token. You can choose to hide your email; sign-in still works.
• Email & Password: We create your account with the email and password you provide, and send a verification email.

We do not receive your Google or Apple password, and we do not access your Google or Apple data beyond what is listed above.

4. How We Use Your Data

We use your data to:

• Provide the Service: Account management, feed and content delivery, messaging, and profiles.
• Personalize your experience: Rank the feed and recommend posts, reels, and people based on your interests and engagement. Feed ranking runs on your device.
• Keep the community safe: Automated Shariah content analysis, moderation, reporting, and abuse prevention.
• Send notifications: Push and email messages about activity, security (e.g. email verification, password reset), and moderation outcomes — according to your notification preferences.
• Operate rewards (when live): Track engagement and watch time that would feed the Battut rewards and wallet system once it launches.
• Improve Battut: Analyze usage to fix bugs and optimize performance (e.g. video loading speed).

5. AI & Automated Processing

Battut is a family-friendly, Shariah-compliant platform, and we use automated systems to uphold that standard and to organize content.

• Shariah content scanning: When you upload media, our Shariah Guard AI scans it on secure servers before or shortly after it is published, to detect content that does not meet our standards.
• Content labeling: We use an AI service (Google Gemini) on our servers to label posts with topic categories and a quality signal. These labels help recommendations only — they are never the sole basis for a moderation decision.
• Translation: When you tap "See translation" on a post, comment or message, or choose a caption language on a video, that text is sent to Google Gemini on our servers to translate it. Translations are stored temporarily so they can be shown again, and are deleted automatically.
• On-device audio detection: A model (TensorFlow.js / YAMNet) may run on your device to detect music in a video you upload. This runs locally on your device.
• Music removal: Where music is flagged, an audio-separation process may mute or strip the music track from a video.

Media flagged as unsafe may be retained briefly for human review and to improve the system, after which it is deleted.

By using Battut, you consent to this automated analysis of your uploads to keep the community safe.

6. Advertising

Battut shows two kinds of ads, and every ad is subject to Shariah and admin review. Ads never appear in any Kids experience.

• Battut’s own ads: Businesses advertise through the Battut Business portal. To show a relevant ad, our servers may use your gender, age (derived from your date of birth), your selected interests, and coarse location/country. This targeting happens on our own systems; we do not hand your identity to advertisers.
• Third-party ads (web): On the web, we may display banner ads from the Muslim Ad Network. To render an ad, limited technical data — your IP address, device type, operating system, and app identifier — is sent to the ad provider, which may set its own cookie within the ad. We do NOT share your name, email, account details, or a device advertising ID with advertisers.

Third-party advertising partners handle the limited data they receive under their own privacy policies (muslimadnetwork.com). You can report an inappropriate ad to us at any time.

7. Cookies & Analytics

• Essential storage: Required to keep you signed in and remember your settings. This cannot be switched off.
• Analytics: On the web, we use Google Analytics to understand aggregate usage and improve the app. Analytics is not initialized in our native apps.
• Abuse prevention: We use Google reCAPTCHA Enterprise (via Firebase App Check) to protect our services from automated abuse.

8. Data Sharing & Sub-Processors

We do not sell your personal data. We share data only with service providers that process it on our behalf under strict security and confidentiality obligations, and where required by law.

• Google Firebase: Authentication, database (Firestore), file storage, push messaging, and backend functions.
• Cloudflare: Media storage (R2), content delivery (CDN), and edge security.
• Google (other): Google Analytics (web usage), Google Gemini (content labeling, video transcription and translation), Google Fonts (typography), and reCAPTCHA Enterprise (abuse prevention).
• Stripe: Card payments for Battut Plus on the web. Card details are entered on Stripe and are not seen by us.
• Apple & Google Play: In-app subscription billing on iOS and Android. Payment is handled by the app store; we receive a purchase token and subscription status.
• CHIP: A Malaysian payment gateway used for Battut Plus in supported regions.
• Muslim Ad Network: Third-party web banner ads (limited technical data only, as described above).
• Legal requirements: We may disclose data where required by law (e.g. a valid court order) or to protect our users and platform.

9. International Data Transfers

Battut operates globally and our service providers (such as Google, Cloudflare, and Stripe) process data on infrastructure located in various countries, including outside Malaysia and outside your own country. Our primary database region is Southeast Asia.

Where personal data is transferred across borders, we rely on reputable providers that offer appropriate safeguards and contractual protections for that data. By using Battut, you understand that your data may be processed in these locations.

10. Data Retention

We keep personal data only for as long as needed for the purposes above, unless a longer period is required by law.

• Account & content: Kept while your account is active. When you delete your account, your profile, content, and media are removed (see “Account & Data Deletion”).
• Disappearing messages: Deleted automatically after they expire (a scheduled process removes expired messages hourly).
• Stories: Removed after they expire.
• Flagged media: Retained briefly for human review and system improvement, then deleted.
• Reports & moderation logs: Retained to keep the community safe, ensure accountability, and comply with legal obligations.
• Diagnostic logs: Kept for a limited period for security and debugging.

11. Your Rights

You have the right to:

• Access & Correct: View and edit your profile and preferences directly in the app.
• Delete: Delete your account and associated data (see the next section).
• Withdraw Consent: Decline analytics where offered, adjust notification and content preferences, or stop using the Service at any time.
• Data Portability: Request a copy of the personal data you provided to us.
• Complain: Malaysian users may exercise their rights under the PDPA and, if unsatisfied, contact the Personal Data Protection Commissioner. Users elsewhere may contact their local data-protection authority.

To make a request, contact us at [email protected].

12. Account & Data Deletion

You can delete your account at any time from Settings › Account › Delete account. Deleting your account triggers a server-side cleanup that removes your profile, posts, comments, and stored media.

Some records may be retained where we are legally required to keep them or where they are needed for security and accountability (for example, transaction records, and moderation audit logs). Content you shared that others saved or that is embedded in another user’s conversation may persist in that context.

13. Security

We employ industry-standard measures — encryption in transit and at rest, role-based access controls, server-only protection of sensitive fields such as your wallet balance, and abuse protection via App Check. However, no method of transmission or storage can ever be completely secure, and we cannot guarantee absolute security.

14. Children's Privacy

If we become aware that we have inadvertently collected data from a child under 13, we will take immediate steps to delete it. A dedicated Battut Kids experience for younger children is not yet available; if and when it launches, it will require verifiable parental consent before any child data is collected.

If you believe a user is under 13, please report them to [email protected] immediately.

15. Changes to This Policy

We may update this Privacy Policy at any time, at our sole discretion, with or without prior notice. When we do, we will revise the “Last updated” date above; we may, but are not obliged to, provide any additional notice (for example, in the app or by email). Your continued use of Battut after any update means you accept the revised policy, and it is your responsibility to review it periodically.