Trust & Security
Here is exactly what UmmahCity tracks, stores, and shares. No hidden parts.
Who runs this
Ummah Media Group LLC — a real, Muslim-owned company registered in the United States, serving the Ummah since 2009. Real people build and operate UmmahCity, and we answer for it by name, not through an anonymous support portal.
Reach us any time at salaam@ummah.city. A person reads it.
Your data
- We never sell member data. Not to advertisers, not to data brokers, not to anyone.
- No ad-tracking of members. Ads on our surfaces are contextual — matched to the page, not built from a profile of you.
- Analytics are self-hosted on our own servers, with bots excluded. Your usage data never leaves infrastructure we operate.
- No Google fonts anywhere. We use Bunny Fonts, a privacy-respecting alternative, plus our own mail and our own self-hosted analytics. Zero Google code runs on any ummah.city page today.
The full detail is in our privacy policy.
Your money
- Payments are processed by Stripe, one of the most widely used payment processors in the world. Your card number goes to Stripe, never to our servers — we never see or store it.
- Membership is pay what you like. You choose what Ummah One is worth to you. There is no dark-pattern pricing and no surprise charge.
- 10% of every membership payment is set aside for Muslim charities.
Your account is yours
- Export your data — self-service, whenever you want it.
- Delete your account — email us and a person deletes it within a few business days. No self-service button yet, no runaround either.
- Your @handle is your address across the city — one identity you carry, not one we rent back to you.
How we secure the platform
- HTTPS everywhere. All traffic between your device and our servers is encrypted in transit (TLS), and HSTS with preload tells browsers to refuse insecure connections to us.
- No third-party scripts run on ummah.city. Frame and content-type protections are on every response.
- Self-hosted on servers we rent in Europe and run ourselves — no Big Tech cloud. No third-party cloud holds your inbox or your community.
- Live status, in the open. Every core service is monitored around the clock and the results are public — check them yourself anytime at status.ummah.city. The history is real and starts the day we launched it; nothing is backfilled.
- No app-store middleman. You install UmmahCity directly from the web — the app you get is the app we published, with no store in between.
Honest limits: Direct messages in UmmahChat are end-to-end encrypted. Group Rooms, calls and email are encrypted in transit, not end-to-end. Owned, not Meta — that is the honest line.
Report a security issue
Found a vulnerability or something that looks wrong? Tell us — you are protecting the whole city.
- Email salaam@ummah.city with “SECURITY” in the subject line.
- Include what you found, where, and how to reproduce it. Please do not access other members’ data while demonstrating it.
- We read every report and will respond to you. We do not run a paid bounty program today, but we thank reporters — publicly, with your permission.
Machine-readable contact details live at /.well-known/security.txt (RFC 9116).