Trust & Security

Before you install anything or trust it with your email and your giving, you deserve straight answers. Here they are - plain, no marketing.

Who runs this

Ummah Media Group LLC - a real, Muslim-owned company registered in the United States, serving the Ummah since 2009. Real people build and operate UmmahCity, and we answer for it by name, not through an anonymous support portal.

Reach us any time at support@ummah.city. A person reads it.

Your data

We never sell member data. Not to advertisers, not to data brokers, not to anyone.
No ad-tracking of members. Ads on our surfaces are contextual - matched to the page, not built from a profile of you.
Analytics are self-hosted on our own servers, with bots excluded. Your usage data never leaves infrastructure we operate.
No Google trackers or Google fonts on member surfaces. We deliberately run degoogled infrastructure - our own mail, our own analytics, our own servers.

The full detail is in our privacy policy.

Your money

Payments are processed by Stripe, one of the most widely used payment processors in the world. Your card number goes to Stripe, never to our servers - we never see or store it.
Membership is Pay-What-You-Like. You choose what Ummah One is worth to you. There is no dark-pattern pricing and no surprise charge.
10% of every membership payment is set aside for vetted Muslim charities.

Your account is yours

Export your data - self-service, whenever you want it.
Delete your account - self-service, no phone call, no retention dance.
Your @handle is your address across the city - one identity you carry, not one we rent back to you.

How we secure the platform

HTTPS everywhere. All traffic between your device and our servers is encrypted in transit (TLS), and HSTS with preload tells browsers to refuse insecure connections to us.
Strict security headers - content-security-policy, frame protections, and content-type protections are enforced on our responses.
Self-hosted European infrastructure we own and operate. No third-party cloud holds your inbox or your community.
Live status, in the open. Every core service is monitored around the clock and the results are public - check them yourself anytime at status.ummah.city. The history is real and starts the day we launched it; nothing is backfilled.
No app-store middleman. You install UmmahCity directly from the web - the app you get is the app we published, with no store in between.

Honest limits: chat and email are encrypted in transit, but they are not end-to-end encrypted yet - treat them like normal email, not a sealed letter. We will say so plainly the day that changes. Owned, not Meta - that is the honest line.

Report a security issue

Found a vulnerability or something that looks wrong? Tell us - you are protecting the whole city.

Email support@ummah.city with "SECURITY" in the subject line.
Include what you found, where, and how to reproduce it. Please do not access other members' data while demonstrating it.
We read every report and will respond to you. We do not run a paid bounty program today, but we thank reporters - publicly, with your permission.

Machine-readable contact details live at /.well-known/security.txt (RFC 9116).