Privacy policy
Last updated: 10 November 2026
Who we are
Discover Haramain is an independent guide to the streets around Masjid al-Haram and Masjid an-Nabawi. It is run by Discover Haramain, which decides how your information is used. We are not affiliated with any government body or with the authorities of the Two Holy Mosques.
Contact: discovertheharamain@gmail.com
The short version
- You can use the whole site without an account and without telling us who you are.
- We do not ask for, record or infer your religion, nationality or health.
- We do not sell personal information, and we do not build a profile of you.
- Analytics cookies are off unless you switch them on.
- If you give us your email address, we use it only to send what you asked for, and every email has a one-click unsubscribe.
What we collect, and why
| When | What | Why | Legal basis |
|---|---|---|---|
| You visit any page | IP address, device and browser type, the page requested. Held briefly by our hosting provider. | To deliver the site and keep it secure | Legitimate interests |
| You visit any page | Page views and performance figures, counted without cookies and without identifying you (Vercel Analytics, Ahrefs Web Analytics) | To see which pages are used | Legitimate interests |
| You visit any page | Clicks, scrolling and taps on the page, recorded without cookies, with on-page text masked, and not linked between pages or visits (Microsoft Clarity) | To find parts of the site that are confusing or broken | Legitimate interests |
| You accept analytics cookies | A cookie identifier, pages viewed, approximate location (country and city), device type (Google Analytics) | To understand how visitors move through the site | Your consent |
| You choose a city or gate | Your choice, stored only in your own browser. It is never sent to us. | So the site remembers your gate | Needed to provide what you asked for |
| You open the map | Your IP address is seen by the map-tile provider (OpenStreetMap) | To draw the map | Legitimate interests |
| You sign up by email or ask for a guide | Email address, which guide or form you used, the topics you picked, the date you confirmed, and whether our emails were delivered, opened or clicked | To send the guide and the emails you asked for, and to keep the list accurate | Your consent |
| You report a problem on a page | The page, the problem you picked and anything you write. We ask for no name or email. Your IP address is used for a moment to stop abuse and is not stored. | To correct the site | Legitimate interests |
| A venue contacts us or sends photographs | The photographs, the licence given, and the contact details supplied | To show the venue accurately | Contract or consent |
We do not use your information for automated decisions about you.
Sensitive information
This is a guide to the areas around places of worship, so we take particular care. We do not collect information about religious belief, and we do not use the fact that someone visited this site to draw conclusions about them. Please do not put personal details about yourself or anyone else in a problem report.
Cookies and browser storage
| What | Set by | Purpose | Needs your consent |
|---|---|---|---|
| City and gate choice | This site, in your browser's storage | Remembers your gate | No — you asked for it |
| Cookie choice | This site, in your browser's storage | Remembers whether you said yes or no | No |
_ga | Google Analytics | Visitor statistics | Yes |
Microsoft Clarity, Vercel Analytics and Ahrefs Web Analytics run without cookies. You can change your choice at any time from here or at the foot of every page.
Who receives information
We use these companies to run the site. Each acts on our instructions.
| Company | What for | Based in |
|---|---|---|
| Vercel | Hosting, page-view counts | United States |
| Supabase | Database, including the email list | United States |
| Resend | Sending email | United States |
| Microsoft (Clarity) | Usability recordings, without cookies | United States |
| Ahrefs | Page-view counts, without cookies | Singapore |
| Google (Analytics) | Visitor statistics, only with your consent | United States |
| OpenStreetMap | Map tiles | United Kingdom |
| Telegram | Carries problem reports and venue messages to the site's editor | United Arab Emirates |
We do not sell or rent personal information, and we do not share it with advertisers. We may publish statistics that identify no one — for example, how often a particular gate is chosen. We will disclose information where the law requires it.
Transfers outside your country
Our providers store and process information outside the Kingdom of Saudi Arabia and outside the United Kingdom, including in the United States. Where they do, we rely on the safeguards the law provides for such transfers, such as approved contractual clauses, and we send only what is needed for the purposes described above.
How long we keep it
| Information | Kept for |
|---|---|
| Email address | Until you unsubscribe. After that we keep only a record that the address opted out, so that we never email it again. |
| Sign-ups never confirmed | Deleted after 30 days |
| Email delivery, open and click records | 24 months |
| Problem reports | Deleted once dealt with, and within 12 months |
| Google Analytics data | 2 months |
| Clarity recordings and heatmaps | Recordings 30 days; heatmap totals up to 13 months (Microsoft's limits) |
| Hosting logs | A few days at most |
Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you and give you a copy;
- correct it;
- delete it;
- stop using it, or object to how we use it;
- stop emailing you — every email has an unsubscribe link that works in one click, with no login.
Where we rely on your consent you can withdraw it at any time; this does not affect what was done before. Write to discovertheharamain@gmail.com. We reply within 30 days and never charge.
If you are unhappy with our answer you can complain to a regulator:
- Saudi Arabia: the Saudi Data & AI Authority (SDAIA)
- United Kingdom: the Information Commissioner's Office, ico.org.uk
- European Union: the data protection authority where you live
- Elsewhere: your local data protection authority
Children
The site is written for adults planning or making a visit. We do not knowingly collect information from anyone under 18. If you believe a child has given us an email address, tell us and we will delete it.
Security
Information is encrypted in transit, access to the database is limited to the site's editor, and no payment details are ever collected. If a breach is likely to put anyone at risk we will tell the regulators and the people affected, within the time the law sets.
Photographs
We do not publish photographs in which a person can be recognised. If you believe you appear in a photograph on this site, write to us and we will remove it.
Changes
If we change how we use information we will update this page and the date at the top. If the change is significant and we hold your email address, we will tell you before it takes effect.