Worship tools record sensitive patterns: where you pray (location), when you pray (timing), and sometimes what you read or recite. A site that promises "no ads, no tracking" but loads a tracking pixel from a third party is not honouring that promise — even if the operators do not realise it.
How to spot a privacy-respecting Islamic website
- Open the browser DevTools Network panel before tapping any utility. Filter by domain. There should be no requests to ad networks (DoubleClick, Facebook, TikTok, AdSense), analytics SDKs (Google Analytics, Hotjar, Clarity, PostHog, Mixpanel), or affiliate trackers.
- Inspect cookies after using the tool. A privacy-first site sets zero cookies, or a single strictly-necessary one whose purpose is documented.
- Inspect localStorage. Personal preferences should appear only after you opt in to "save on this device".
- For "near me" features, watch the network panel. Your latitude/longitude should never appear in any request URL or body.
How QiblaWeb implements its promise
- Geolocation, compass, and zakat calculations all run in your browser. Your exact data never reaches our server.
- D1 (our database) has no visitor table, no sessions table, no preferences table. Adding one would require a spec amendment and is documented as a hard incident.
- Every deploy passes through a CI grep that fails the build if any analytics SDK or ad script appears.
- Donation flow redirects to Stripe-hosted pages. Card data and donor identity stay with Stripe.
Source
Permission and tracking patterns summarised from web.dev permissions best practices (retrieved 2026-05-09).