On this page
If you have a prayer app on your phone, it knows where you are five times a day. That is not sinister in itself — it cannot tell you when Maghrib is otherwise. The question is what happens to that knowledge after the calculation.
A few years ago that question got a concrete, documented answer, and it is worth knowing what was actually reported rather than what got passed around afterwards.
What was actually reported
In November 2020, Joseph Cox at Motherboard reported that Muslim Pro — one of the most widely installed prayer apps in the world — was sending granular location data to a data broker called X-Mode, and that Muslim Pro's privacy policy did not mention X-Mode.
The company's response, in the same report: it was "immediately terminating our relationships with our data partners", it "never share[s] any personal identifiable information", and it had launched an internal investigation and was reviewing its data governance policy.
Two follow-ons are part of the record. In December 2020, Apple and Google removed X-Mode from their app stores. And in 2021, Motherboard reported that another prayer app, Salaat First, was recording and selling users' location data to a broker called Predicio.
The part worth sitting with is not that one company made one bad vendor choice. It is that nothing in the app's own privacy policy would have told you. A user who did the responsible thing and read it would have learned nothing.
The wider picture: a scan of 175 apps
Comparitech's Paul Bischoff ran a broader test, published and updated October 2023: 175 apps made for Muslims on Google Play — prayer, Quran and others — analysed by scanning their Android packages for the permissions they request.
| What the apps requested | Share |
|---|---|
| Device ID and call information | 96% |
| Storage, including photos and media | 63% |
| Location | nearly 40% |
| Contacts | 7% |
Why a prayer app asks for location at all
This part is genuinely legitimate, and it is why "just refuse location" is not useful advice on its own.
Prayer times are an astronomical calculation. Given a latitude, a longitude and a date, you can work out where the sun will be, and from that when each prayer begins. The Qibla is a second calculation: the direction of a great-circle path from where you are to Makkah. Both need a position on the earth.
What neither needs is a server. The arithmetic is small enough to run on a phone from the 2010s. An app can:
- take your location from the phone, compute locally, and send nothing, or
- let you pick a city from a bundled list, and never touch the location permission at all.
So when an app asks for location, the honest reading is: it needs a position. Whether it also sends that position somewhere is a separate question, and the permission prompt cannot tell you which it is. That is what the next section is for.
How to check the app on your phone
Three checks, in order of how much they tell you for the effort.
1. Read the Data safety section on the Play listing. Google requires developers to describe the types of user data their app collects, whether it shares that data with third parties, and which types are shared. It is on the store listing; tap See details for the full breakdown. This is the developer's own declaration — it can be wrong, but a declaration that says "location, shared with third parties, for advertising" is telling you something plainly.
2. Check the permissions the app actually holds. On Android, Settings → Apps → the app → Permissions. On iPhone, Settings → the app. Then ask of each one: does a feature I use need this? A prayer app with your contacts, your microphone or your photo library is worth a question. Revoke anything that does not map to something you use; if a feature breaks, you have learned what the permission was for.
3. Look for an advertising SDK by looking for ads. If the app shows ads, an advertising network is in it, and that network is receiving device identifiers and an IP address at minimum. That is not hidden or unusual — it is how ad-supported apps work — but it is the main route by which data leaves an app that otherwise does nothing wrong.
The airplane-mode test
The single most informative thing you can do takes about fifteen seconds.
Put the phone in airplane mode, then open the app. Does today's prayer timetable still appear? Does the Qibla compass still point? Does your saved Quran position, your dhikr count, your tracker still load?
If yes, the app is computing on the device, and whatever it does with a connection, it does not need one for the thing you opened it for. If the screen is blank or spinning, then the app you rely on five times a day is a window onto someone's server, and you are trusting that server.
It is a crude test and it does not prove an app sends nothing. But an app that works fully in airplane mode has a far smaller surface to worry about, and that is most of what you can establish from the outside.
A note on the app I build
Disclosed interest: Qurbah is mine, so weigh this accordingly.
I built it around the checks above rather than around a feature list. It has no ads, which removes the advertising SDK entirely; no account, so there is nothing to attach a profile to; and no analytics. Prayer times and the Qibla are computed on the device, and if you would rather not grant location at all, you can set your city by hand and the app still works fully offline — the airplane-mode test above is one it is designed to pass.
None of which you should take on my word. The three checks in this post work on my app exactly as they work on anyone else's, and that is the point of writing them down.
Frequently asked questions
Did Muslim Pro sell location data to the US military?
Motherboard reported in November 2020 that Muslim Pro was sending granular location data to the broker X-Mode, and that the app's privacy policy did not mention X-Mode. The company said it was immediately terminating its relationships with its data partners, that it never shares personally identifiable information, and that it had launched an internal investigation.
Do prayer apps need my location?
They need a location to work out prayer times and the Qibla direction, but that is a calculation, not a transmission. A latitude and longitude — or just a city you pick from a list — is enough to compute both on the phone. Needing a location is not the same as needing to send it anywhere.
How can I check what a prayer app collects?
Open its Google Play listing and read the Data safety section, where Google requires developers to describe the data the app collects, whether it is shared with third parties, and their security practices. Then check the permissions the app actually holds in your phone's settings, and revoke what does not match its features.
Is there a prayer times app that works with no internet?
Yes, several. Prayer times are an astronomical calculation from your coordinates and the date, so an app that ships the calculation can run entirely offline. The quick test is to put the phone in airplane mode and see whether today's times, the Qibla and your saved content still appear.
What should I look for in a private Islamic app?
No account requirement, no advertising SDK, a Data safety entry that matches what the app actually does, permissions limited to its features, and the ability to set your city by hand instead of granting location. An app that works in airplane mode has little opportunity to send anything anywhere.