What we know about you

Under the Australian Privacy Principles, religious belief is explicitly a sensitive category of personal information. Who visits a Shia centre’s website is therefore not an ordinary analytics question.

For that reason the Centre built its own counting, and it is the one described below: no cookie, no stored IP address, no identifier that could be correlated with anything. Those are structural, not promises.

Since 31 August 2026 the site also carries Google Analytics, which does not work that way: it sets cookies and Google receives visitors’ IP addresses. It was added so the Centre can see how people find the site. We name it plainly here rather than leave it for you to discover in your browser, and a tracker blocker or third-party-cookie block will prevent it without affecting anything you came here to read. Since 7 October 2026 the same tag also reports to Google Ads, for the Centre’s grant-funded search ads, with ad personalisation switched off.

The Centre’s own counting writes one thing into your browser: the date you last opened the site, such as 2026-10-04. Everyone who visited that day holds the same date, so it identifies nobody, and it is never sent to us. What is sent, on your first page of a later day, is a single yes: “this browser has been here before.” No cookie, no session storage, no identifier of any kind. (Google Analytics, described above, does set its own cookies.) Our record of a page view holds:

• the page address
• the host you arrived from — google.com, not the full link, because a full link can carry a search term
• whether you are on a phone, a tablet or a desktop
• your country, and the city and region your network reports
• campaign tags, if you followed a tagged link
• whether your browser had opened the site on an earlier day (yes or no)
• how far down a page you scrolled, files you downloaded, links you followed out
• which listings on the community business directory you saw, and which of their phone, WhatsApp, email or website buttons you used
• how quickly the page loaded, so we can tell when the site is slow

What you type into the site’s search box is kept separately from that, with no link to you and none to a visit — a question with no questioner. The value of it is the searches that find nothing, which is how the Centre learns what the library does not have yet.

If you use the FZIC chatbot (the “Ask FZIC” button), we keep each question and the answer it gave, a random code made by your browser tab so a follow-up can be read beside the question before it, and whether you said the answer was helpful. We do not keep your internet address, your name or anything that links the questions to you, and email addresses and phone numbers are cut out of a question before it is stored. The Centre reads these to correct and improve the answers, and they are deleted after 90 days. The answer itself is written by an AI service (currently Cloudflare Workers AI), which receives the conversation so far and the Centre’s published information to answer it, and nothing else about you.

If you use “Report a mistake” on a dua, a date, an event or any other page, we keep what you wrote, the page and line it was about, and a one-day hash of your network address, made with the same daily salt described next, which only stops one person sending a flood of reports. Giving an email address is optional, and it is used only to reply about that report.

If you report a listing on the community business directory, you do it as a signed-in member, and we also keep which member account sent it. The committee sees your name and email address, read from your account, so they can follow your report up; the business is never told who reported it. If you close your account, your name and email are no longer linked to the report; what you wrote stays with the committee.

If you tap the thumbs-up on a library text, it counts once per internet address. It is stored not as your address but as a one-way code made from your network address and that text, using a key only the Centre’s server holds, with no date or time attached. The code is different for every text, so without that key the codes cannot be matched to each other or turned back into an address; the server, which holds the key, could check a known address against them. Everyone sharing one internet address — a household, a workplace, public Wi-Fi, some mobile networks — shares one thumbs-up per text: they all see it pressed, and any of them can take it back, which deletes the code. Like every visit, the tap also appears in the web server’s ordinary access log, which is deleted after about two weeks.

On the community business directory the site also counts, for each listing, how often it is seen and how often its phone, WhatsApp, email or website button is used, so the Centre can tell each business how many people reached them through the site. As the list above says, the listings you saw or contacted are part of the record of your visit, and are deleted with it after 90 days. A listing’s count is a daily total that names nobody, kept while the listing exists, and it goes up at most once a visit and once a day from any one network — never for a visit the site does not count. To know that a network has already been counted that day, the site keeps your network address hashed with the same daily salt described next, never the address itself, and deletes it after two days.

Instead of an identifier, each visitor is a salted hash of their network address and browser. The salt is regenerated every day. That is the whole point of rotating it: Monday’s hash and Tuesday’s hash for the same person do not match, and cannot be made to match afterwards, even by someone holding the entire database. Where the site keeps count of how often something is used from one network — the chatbot, the report and request forms, notification sign-ups — the count is filed under your network address hashed with the same daily salt, never the address itself, and it is deleted within two days. (Signing in is counted differently; see below.)

We state the cost of that honestly. “Unique visitors” means unique per day; somebody who visits on Monday and Tuesday is counted twice, though Tuesday’s visit carries the yes above, and nothing ties it to Monday’s. Two people sharing a network and the same browser version are counted once. Both are the correct trade for a mosque.

Our network provider sends the Centre’s server more than the city: it also offers latitude, longitude and postcode. Those are discarded unread. A coordinate pair attached to “visited a Shia centre” is a different order of disclosure from a city name, and the point of this design is not to hold it.

Also never stored when you read the site: your IP address, your full browser string, the full address of any page that referred you, and any advertising or cross-site identifier. Where an internet address is kept at all, this page says so: the web server’s ordinary access log, the sessions of a signed-in account, and a sign-up for email updates.

An account is optional; most of the site works without one. If you make one we hold your name, email address, an optional phone number and photo, and your preferences — which marja you follow, which prayer calculation and language you want, the household you belong to, and the date your khums year starts. Your password is stored only as a cryptographic hash.

Signing in sets two cookies: one that keeps you signed in, and a short-lived, signed copy of your session that saves the server looking it up on every page. Continue with Google or Sign in with Apple adds one more for the few minutes the trip to Google or Apple takes. With two-step sign-in on, another lasts the few minutes between your password and your code, and if you tick “Trust this device”, a last one lets that device skip the code for thirty days. These are the only cookies this site sets itself, and none is used for analytics. (Google Analytics sets its own, described above.)

One honest difference: for signed-in accounts we do record the IP address and browser of each session. That is a security measure — it is how an account holder can tell that somebody else has signed in as them — and it applies only to accounts. Separately, to slow down password guessing, signing in, creating an account and asking for a password reset are counted per internet address, whether or not you have an account. Each count is filed under that address hashed with the daily salt described above, never the address itself, and is deleted within two hours of the last attempt.

An account also keeps the town, region and country your internet connection reported when you created it and when you last signed in — the same Cloudflare information as our page counts, never coordinates or a postcode. The committee sees these on its list of members, so it can tell roughly where people are joining from, and they go when the account does.

Listing a business on the community directory is for members. Your account’s confirmed email address becomes the email shown on the listing, alongside the name, phone number and website you give, on a public page search engines can show. Nothing is public until the committee approves it and your email is confirmed. Changes you make are checked automatically: most appear straight away, while a new phone number or website waits for the committee. You can take the listing down yourself at any time from your account, and closing your account deletes your listings. If a listing was added before you had an account, signing in with exactly its email address links it to you. Before the committee sees a new listing or a change, it is checked automatically: we note the country, region and city your internet connection reports (from the same Cloudflare information as our page counts), whether the website’s domain exists, and whether the suburb can be found on OpenStreetMap, which receives only the suburb’s name. Those results are kept with the listing and seen only by the committee.

You can turn on notifications without an account, in a browser or in the Centre’s phone app. For a browser we store only the address it gives us to deliver to, and the two keys needed to encrypt the message. For the app we store only the push token your phone is given for it. Either way: no name, no email, nothing that says who is being told about a majlis. If you are signed in, it is linked to your account so your devices and preferences stay together.

Delivery necessarily passes through a push service. For a browser it is whichever one your browser uses — Google, Mozilla, Microsoft or Apple — and the message content is encrypted to your browser, so they deliver it without reading it.

The app is different, and we would rather say so plainly. Its notifications go through Expo, the service the app is built with, and then Apple (or Google, on Android), and they are not encrypted end to end: Expo and Apple can read the text of each notification they carry — for a janaza notice, that includes the name of the person who has died. They are given the token and the message, nothing else about you. To learn which phones no longer have the app, we keep the delivery receipt Expo returns for each message until it has been read, and never longer than a day.

You can turn notifications off at any time — in the app, under More, then Notifications.

Requests to the Centre — a funeral, a nikah, a hall booking, a general enquiry — record your name, and the phone number, email address and message you give us. A request can be marked private, which restricts it to the committee members handling it.

Offering to host an iftar records your name, contact details, how many you can seat and what you intend to cook. Volunteering records what that form asks for.

Signing up for the Centre’s email updates without an account records your email address, the name you give, the lists you choose, and when you asked and when you confirmed, each with the internet address it came from. That is the record of your consent which the Spam Act asks a sender to be able to show, and only the committee can see it. Nothing but the confirmation email is sent until you confirm, and a sign-up that is never confirmed is deleted automatically.

Posting on the jobs board records what that form asks: a title and description, the organisation and suburb, a contact name, and whichever phone number, email address and application link you give. Nothing is public until the Centre publishes the post. From then those contact details are on a page anyone can read and search engines can show, which the form asks you to agree to first. A post comes off the board on its own after 60 days.

A janaza notice is different, because it concerns someone who has died and their family. It records the deceased’s name, the family’s connection, where the death occurred, the arrangements, and a contact name and phone number. Nothing is published until the family has asked the Centre to publish it. The contact number is for the committee and is not published with the notice.

You can give to the Centre online or by direct bank transfer. For a transfer, your bank shows us your transfer and the reference you used; the reference is what lets the committee put your donation into the right fund, which matters because several categories of Islamic giving are restricted in their use. The Centre has one bank account and every fund is paid into it, identified by its reference word: money given for one purpose is never spent on another.

Online donations are processed by Zeffy, a free donation platform. From Zeffy the Centre receives your name, your email address, the amount, the date and the form or appeal you gave to, and keeps that record for its accounts just as it keeps its bank-transfer records. Zeffy’s own privacy policy covers what it does with the details you give it at checkout.

We keep a record of donations: the donor name and email given, the amount, the fund, any note, and whether a receipt was issued. You may ask to be recorded under a different public name, or not named at all.

The Centre never sees or stores card numbers. When you give online, your card details are handled by Zeffy and its payment processor and never reach the Centre. A separate card payment option is also built into this site but is not switched on; if that changes, this page will say so before it happens.

The Centre is registered with the ACNC but is not endorsed as a deductible gift recipient, so donations are not tax deductible. Receipts are issued on request, as a record of your donation, not as a tax claim.

We keep this list short on purpose, and it is complete as at the date below.

Our host

The server this site runs on, and the database, are rented from a commercial hosting provider.

Our network provider

Sits in front of the site to keep it fast and to absorb attacks. It reports the visitor country and city we count.

Our mail provider

Sends the Centre’s email: verification, password resets and announcements you have asked for.

Zeffy

Takes online donations. Your card details go to Zeffy and its payment processor, never to the Centre.

Google Analytics

Records page views so the Centre can see how the site is found. It sets its own cookies and receives your IP address. A tracker blocker stops it.

Google Ads

Measures which of the Centre’s free, grant-funded search ads lead to visits and downloads, through the same Google tag. Ad personalisation is off. A tracker blocker stops it.

Google sign-in

Only if you choose Continue with Google: Google confirms your name, email address and profile picture to the Centre, and Google knows you signed in here.

Sign in with Apple

Only if you choose Sign in with Apple, here or in the Centre’s app: Apple confirms an email address to the Centre — your own, or, if you choose Hide My Email, a private Apple address that forwards to it — and, the first time only, the name you choose to share. Apple knows you signed in here. So that closing your account can end that link, as Apple requires, the Centre keeps a token Apple issues for that purpose with your account; closing the account revokes it with Apple and deletes it.

AI service for the chatbot

Only if you use the chatbot: what you type in that conversation, with published information about the Centre, goes to an AI service (currently Cloudflare Workers AI) that writes the answer. It is sent nothing else about you, not even your internet address.

Push services

Google, Mozilla, Microsoft and Apple, only if you turn notifications on in a browser, and only to deliver them.

Expo

Only if you turn notifications on in the Centre’s phone app: Expo receives the push token for your phone and the text of each notification, and passes them to Apple (or Google) to deliver. The text is not encrypted end to end, so both can read it.

Video

The preview picture on a YouTube recording loads from YouTube with the page. The player itself, from YouTube or Facebook, loads only after you click play, and YouTube is used in its no-cookie mode.

Recitation audio

Some Quranic audio is streamed from a public recitation archive when you press play, or saved from it to your phone when you ask the app to keep a surah.

OpenStreetMap

When a business listing is checked, the suburb it names is looked up on OpenStreetMap to confirm it exists. Only the suburb is sent, nothing about you.

Nothing else. The Centre does not sell, rent or trade your information, and does not share it with anyone for their own purposes. We disclose information only where the law requires it.

Two things worth naming because they are common elsewhere and absent here. The fonts this site uses are served from our own server, not fetched from Google, so reading a page makes no request to them. And the site’s search does not send your question to any AI service — that capability exists in the code and is switched off. The chatbot, listed above, is the one place that does.

Individual page views are deleted after 90 days, and so are the visit and click records kept beside them. What survives is a daily count — how many views, how many visitors, from which city, on what device — and those totals carry no visitor identifier at all, so they can be kept indefinitely without holding anything about a person.

Account details are kept while the account exists. Donation and financial records are kept as long as charity record-keeping requires.

Every email the website sends is recorded — who it went to, the subject, whether it was delivered to the mail server, and what it said — so the Centre can answer “did that email ever go?”. Only the Centre’s administrators can read that record, and each entry is deleted after 180 days. Emails that carry a sign-in, password or confirmation link are recorded without their content, so the record can never be used to get into your account.

For the things you send us — an enquiry or a request, a janaza notice, an offer to host an iftar, a volunteering form, a jobs-board post once it has come off the board, a confirmed sign-up for email updates (it stays, marked as unsubscribed, if you unsubscribe), and anything you type into the search box — no retention period has been set. The Centre holds them until it sets one. We would rather write that than a figure nobody has decided, and when a period is set this page will say what it is.

Asking for your account to be deleted does not reach those, and you should know that before you ask rather than afterwards. A request, a notice or a donation record you sent keeps the name and the contact details you gave at the time; a donation record in particular is one the Centre has to keep for its accounts.

Your own browser also remembers small things for your convenience — where you were up to in a text, your audio settings. That stays on your device and is never sent to us.

The Centre’s phone app shows the same information as this site, read from the same server, and what this page says about a search, a chatbot question, a report, a request, an account and notifications holds for the app in the same way.

Each time the app asks the server for something, the request appears in the web server’s ordinary access log, which is deleted after about two weeks, as it does when you read a page here. The app carries no Google Analytics and no advertising identifier, and what you read in the app is not recorded as a page view.

So that the Centre knows how many people use the app, the app counts itself. The first time it opens, it makes up a random number for that copy of the app: not your phone’s own identifier, its advertising identifier or its notification token. When you open the app, a few times a day at most, it sends that number with the app’s version, your phone’s model and the main version of its system (iOS 18, say), and a yes or no for whether notifications are allowed and whether somebody is signed in — never who: no sign-in goes with it. The server keeps with the number the town Cloudflare reads from the connection, never the address, and the days the app was opened, as dates without a time. None of it is tied to your account. Each of those days is deleted after 400 days, a copy not opened for that long is deleted altogether, and deleting the app ends it: a new copy makes a new number.

If something goes wrong in the app, it tells the Centre, so that it can be mended: what went wrong, in the words of the app’s own code, and where in that code it happened, with the screen it was on, the app’s version and update, and whether the phone is an iPhone or an Android. Before it is sent, and again before the server keeps it, email addresses, long numbers, sign-in tokens and ids, and whatever follows a question mark in a web address are taken out of it. It is sent only while the app counts itself, and none of it is tied to your account. To count how many phones had the same problem, the server keeps a code made from the app’s random number, not the number itself. A problem no phone has reported for 90 days is deleted.

While the app is open on your screen, and only while it counts itself, it also tells the server about once a minute that it is open: with the same random number, the app’s version, whether the phone is an iPhone or an Android phone, and which kind of screen is showing (the library, say, or a programme), never which text or which programme. The server holds that in its memory only, with the country Cloudflare reads from the connection, to show the committee how many phones have the app open and on which screens. It stops counting a phone as soon as the app is put away, forgets it two and a half minutes after it last heard from it, and keeps only how many were open each minute for the last hour and the day’s highest. None of it is written down. The committee never sees the number, and sees a screen, a version or a country only once at least three phones share it.

The Centre sometimes puts a short message on the app’s Today. To show you only the ones meant for you, the app asks for them with whether it is on an iPhone or Android, its version and a yes or no for whether somebody is signed in, and the server reads the country from the connection; it keeps none of that beyond the access log above. When a message is shown on your phone, its page opened or the message closed, the app sends the same random number with which message and which of the three, and the server keeps that with the date, never a time, so the Centre knows how many phones a message reached, never whose. Each is deleted after 400 days, or with the copy of the app. Nothing of it is sent while the Centre’s counting is off, and a message you close stays closed on your phone.

With the same number, the app tells the Centre when one of the Centre’s notifications is opened on your phone, or arrives while the app is open: which notification it was and the day, never the time and never who. That is how the Centre knows how far its notices reach. These are deleted after 400 days, like the rest of the count.

hyder.ai, linked for signed-in members from the front page and the app, is a service the Centre does not run: it opens on hyder.ai’s own site, where its own terms and privacy policy apply, and nothing about you is sent to it by the Centre. The Centre counts only how many times it was opened each day, from the website or the app, with no name, account, device or time kept with the count.

So that it opens quickly and works without a signal, the app keeps a copy of what it last read on your phone, with the choices you make in it: texts you save, the text size and reciter you pick, the a’maal you tick off and the warnings you close. They stay on your phone and are never sent to us.

What you download for offline use (a text with its recitation, a calendar year, the Centre’s own pages) is kept on your phone in the same way and is never sent anywhere. Nothing is downloaded until you ask, and under More, then Downloads, you can see what is kept and how much room it takes, and remove it.

If you sign in, the app keeps your sign-in token, with your account’s name, email address and chosen prayer calculation, in your phone’s secure storage, so it knows who is signed in without a signal. Signing out deletes them from the phone.

Sign in with Apple in the app happens on your phone: Apple gives the app a one-time proof of who you are, which the app passes to the Centre’s server, and nothing else. Continue with Google opens Google’s own page in a private browser window that keeps nothing once it closes; the server then hands your sign-in back to the app. Either way it is the same account as on this site, and the app keeps only what the paragraph above describes.

The app asks for your phone’s location only when you first use something that needs it. The Qibla compass works out the direction on the phone itself and sends nothing. Once you have allowed it, the app checks on the phone, when you open it, whether you are more than 50 km from the Centre, so that it can offer the prayer times for where you are; that check sends nothing either. If you choose prayer times for where you are, the app sends the server your position rounded to about a kilometre, with your phone’s time zone, each time it asks for the times. It goes in the body of the request, not its address, so it is not written to the access log; the server uses it to work out the times and keeps nothing. The name of the town shown with them comes from your phone’s own map service. The last place the app used, your reminders for it and the times on the home-screen widget stay on your phone, and the app’s Prayer times where you are screen removes them.

You may ask what the Centre holds about you, ask for it to be corrected, ask for your account to be deleted, or unsubscribe from announcements — every broadcast carries an unsubscribe link, and turning notifications off takes one tap.

There is one request we cannot fulfil, and we would rather say so than pretend otherwise: we cannot find, show or delete your anonymous visits, because nothing in that data identifies you. The design that protects you also puts it beyond reach.

The Centre handles personal information in line with the Australian Privacy Principles. If you are unhappy with how we have handled yours, tell us first — we would like the chance to put it right. You can also complain to the Office of the Australian Information Commissioner.

Accounts are intended for adults.

Write to admin@fzic.org, or speak to a committee member at the Centre.

If what the site collects changes, this page changes with it rather than afterwards. Last updated 25 October 2026. Terms of use.