Privacy Policy

Shia Online Community has been online since 2002 and is maintained by the Shiasoft Network, a non-profit effort run by volunteers, with its roots in Karachi, Pakistan. For anything in this policy, write to info@shia-online.com.

Browsing without an account. Our servers receive the technical details every website receives: your IP address, browser type, the pages you request and when. We use these to serve pages, to rate-limit abuse, and to keep short-lived security logs. We also use Google Analytics 4 to understand which pages are read (see section 6).

Creating an account. Your email address, a display name, a password (stored only as a salted hash we cannot reverse) and, if you choose, a username. Email is verified with a one-time code sent to that address.

Your profile, all optional. Photo and cover image, a short bio, tagline, pronouns, website and social links, gender, phone number, and a free-text location. You decide whether your profile is public and whether it appears in search engines (Settings → Privacy).

Your location, only if you share it. If you allow location access to see gatherings and content near you, we store a coarse grid reference of the position (about a neighbourhood in size), never the exact coordinates, and you can clear it at any time.

What you do here. The collections (“wicks”) and items you submit, comments, likes and votes, people and topics you follow, reports and suggestions you make, and a record of the item pages you open (used only to count views and to avoid counting twice).

Files you upload. Images, audio and video you add are stored on a content delivery network and served publicly by design. Please remove location data (EXIF) from photos before uploading if that matters to you.

Notifications. If you turn on browser push notifications we store the subscription your browser gives us so we can deliver them; you can revoke it in your browser or in Settings at any time.

• To run the service: sign you in, show your content under your name, deliver notifications.
• To keep it safe: detect abuse, throttle automated traffic, moderate content, investigate reports.
• To send you email you asked for or need: verification codes, and — only if you leave them on — notifications about activity you follow.
• To understand what is read, in aggregate, so volunteers know what to prioritise.
• To meet legal obligations and respond to lawful requests.

Mail comes from no-reply@shia-online.com and is sent from our own mail server. Every optional message carries an unsubscribe link and header; you can also email unsubscribe@shia-online.com from your account address, or switch notifications off in Settings. After that you receive only security messages you trigger yourself, such as a password-reset code. Addresses that bounce or that mark our mail as spam are automatically excluded from further mail.

We keep a log of each message we send (address, subject, whether it was delivered) for 7 days so that failed deliveries can be retried; verification codes themselves are never stored in that log.

We use a small number of strictly necessary cookies: a session cookie that keeps you signed in, a short-lived cookie that ties a sign-up to the browser that started it, and a cookie that opens our staff webmail. Your theme and Hijri-calendar preferences are kept in your browser's local storage and never sent to us as personal data. There are no advertising cookies.

Google Analytics sets its own cookies to measure usage (section 6). Embedded media from third parties (section 7) may set cookies when you play it.

We use Google Analytics 4 to see which pages are visited, from which countries, and on which devices. Google processes this data on our behalf; IP addresses are not stored in the reports we see. You can block it with a browser extension or by disabling JavaScript for this site; the site works either way.

We share personal data only with service providers that help us run the site, and only what each one needs to do its job. They act on our instructions under data-processing terms:

• Hosting. Our servers and database run in a data centre in the European Union.
• Edge and security network. A content delivery and protection service sits in front of the website to serve it quickly and block attacks; it sees your IP address and requests.
• File storage. A storage and delivery network holds uploaded files and encrypted database backups.
• Analytics and sign-in. An analytics service that measures page views in aggregate, and the identity provider behind the third-party sign-in option if you choose to use it.
• Media platforms. When a page embeds a video or audio player from another platform, that platform collects data under its own policy as if you had visited it directly.

Our news wire republishes articles from other Shia news outlets with attribution and a link to the source. We may disclose personal data if required by law, or to protect the rights and safety of our community. We never sell it.

Content you publish — collections, items, comments, uploaded media — is public and attributed to your display name and username, and may be indexed by search engines and quoted by AI assistants. Your profile page is public by default; you can make it private, hide it from search engines, hide your likes, or hide your activity from the site-wide feed in Settings → Privacy. Your email address, phone number and exact location are never shown publicly.

• Your account and content: until you delete them or ask us to (section 10).
• Sign-in sessions: 30 days of inactivity, or until you sign out.
• Verification codes: 10 minutes. Mail delivery log: 7 days.
• Read notifications: 90 days; unread ones: 180 days.
• Moderation and security records (reports, bans, admin audit trail): as long as needed to keep the community safe.
• Encrypted backups: 14 days on the server, 8 weekly copies off-site.

You can edit or remove most of your profile in Settings, delete your own content, change your privacy switches, and turn email off. To get a copy of the data we hold about you, to correct it, or to delete your account entirely, email info@shia-online.com from your account address; we answer within 30 days. Deleting an account removes your profile and personal details; content you published may remain in anonymised form where removing it would break the archive for others, unless you ask for it to be removed too.

If you are in the European Economic Area or the United Kingdom you have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and the right to complain to your data-protection authority. Our lawful bases are performance of our service to you, our legitimate interest in running a safe community archive, and your consent where we ask for it (location, notifications).

Connections are encrypted (HTTPS), passwords are hashed with scrypt, staff access is limited by role and logged, backups are encrypted, and our mail server authenticates every message with SPF, DKIM and DMARC. No system is perfect; if you find a problem, please tell us at info@shia-online.com before telling anyone else.

The service is for people aged 13 and over. We do not knowingly collect data from younger children; if you believe a child has created an account, write to info@shia-online.com and we will remove it.

We will update this page when our practices change and update the date at the top. For material changes we will also notify signed-in members. Continued use after a change means you accept the updated policy. The Terms of Use govern your use of the service itself.