Privacy notice
What we collect, why we collect it, and what you can do about it.
Last updated 30 October 2026 · Concept draft, to be checked before launch
Early preview. Accounts, rooms and messages are stored with Google Firebase in London. Rooms marked “Sample” are examples written by us. This notice is a draft and will be reviewed before Jiraan fully launches.
Who we are
Jiraan is run by [full name and postal address, to be added before launch], an individual in England trading as Jiraan, who is the controller of your personal data. Contact us about privacy at hello@jiraan.uk. The rules for using Jiraan are in our terms of use.
The short version
- We collect only what’s needed to match rooms and keep members safe.
- Your email, phone number and full address are never shown to other members.
- We never sell your data and we don’t use advertising cookies.
- You can download or delete your data at any time from your account page.
What we collect and why
| What | Why we need it | Legal basis | How long we keep it |
|---|---|---|---|
| First name | Shown to people you message, so they know who they’re talking to. | Contract: needed to provide the service you signed up for. | Until you delete your account. |
| Email address (from Google, or the one you join with) | To sign you in, send the link that confirms it’s your email, send password reset links you ask for, and send important account notices. Never shown to other members. | Contract. | Until you delete your account. |
| Password, only if you join with email | To sign you in. It’s stored scrambled (hashed) by Google Firebase, so nobody at Jiraan can read it. If you use Google, we never see a password at all. | Contract. | Until you delete your account. |
| Brother or sister | To keep sections separate: you only see and message people in your own section. | Contract. | Until you delete your account. |
| That you’re Muslim (implied by joining) | Jiraan is a service for Muslims, so having an account reveals your religious belief. | Explicit consent (UK GDPR Article 9(2)(a)), given when you join. Withdraw it by deleting your account. | Until you delete your account. |
| Listing details: area, rent, room, household, halal details and photos | To show your room to people in your section. We ask for the area and postcode district only, never your full address. | Contract. | Until you take the listing down or delete your account. |
| Permission declaration: whether you rent, own or have a mortgage, and that you have your landlord’s or lender’s permission | To protect the people who move in from losing their home over an unauthorised sublet, and to act on reports. | Legitimate interests: keeping members safe and housing secure. | Deleted with the listing. |
| Room-wanted profile, if you post one: city, areas, budget, move-in date, student or professional, university, a short description, lifestyle tags and whether you’d rent with a group | So people with rooms in your section can find you and message you. Only your first name is shown. | Contract: you choose to post it, and can remove it at any time. | Until you remove it or delete your account. |
| Lifestyle tags on listings and profiles (for example prays at home, quiet home, or ones you write yourself) | To help people find a home that suits how they live. They’re optional. | Contract, and your explicit consent for anything that reveals religious practice. | As long as the listing or profile they belong to. |
| Messages | To deliver your messages. A moderator reads a conversation only if one of the two people in it reports it. | Contract, and legitimate interests for safety reviews. | Each message is deleted 12 months after it’s sent. Everything goes sooner if either person deletes their account, unless the conversation has been reported: then it’s kept until 12 months after its last message. |
| Reports you make, or that are made about you: what was reported, why, and who reported it | To deal with scams, fake listings, harassment and people in the wrong section. | Legitimate interests: keeping members safe, and our duties under the Online Safety Act. | Until we’ve dealt with the report, then 12 months. |
| People you’ve blocked | To stop them messaging you, and you messaging them. | Contract. | Until you unblock them or delete your account. |
| If we ban an account: the first name on it, the reason and the date | To stop someone who broke the rules using Jiraan, and to answer an appeal. | Legitimate interests: safety. | While the ban lasts. |
| Technical data: IP address, browser and device type, error logs | To keep the site secure, stop abuse and fix faults. Collected by our hosting providers, not by Jiraan’s own code. | Legitimate interests: security. | Vercel keeps request logs for about an hour. Google keeps the IP addresses used to sign in for a few weeks. |
| Cookie choice | To remember whether you allowed analytics. | Legal obligation (PECR). | Until you change it or clear site data. |
| Marketing preference | To send occasional news about Jiraan, only if you ticked the box. | Consent. Untick it on your account page at any time. | Until you withdraw consent or delete your account. |
What we don’t collect
We don’t ask for your phone number, date of birth, full address or bank details. We don’t collect ID documents. If we add identity checks later, we’ll update this notice and ask you first.
Who we share it with
We share data only with companies that run the service for us, under contracts that protect it:
- Google Firebase, for sign-in and the database. Data is stored in London (europe-west2).
- Vercel, for hosting the website.
Sign-in and some support systems of these providers may process data in the United States. Where they do, transfers are covered by the UK’s data bridge with the US or by standard contract clauses. We share data with the police or other authorities only when the law requires it, to report a crime such as child sexual abuse, terrorism or an offer of a room for sex, or to protect someone from serious harm.
Your rights
Under UK data protection law you can:
- get a copy of your data (use “Download my data” on your account page);
- correct anything that’s wrong;
- delete your account and data;
- withdraw consent at any time, which doesn’t affect what we did before;
- object to processing based on legitimate interests;
- ask us to restrict processing, or to move your data elsewhere.
Go to your account page, or email hello@jiraan.uk. We’ll reply within one month.
Age
Jiraan is for adults aged 18 and over. We delete accounts we find belong to anyone younger.
Cookies
See the cookie notice.
Complaints
Please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.