What Basirah keeps

Anonymous reports

An anonymous report is not linked to a Basirah account. Its report record has no name, email, phone number, user ID, IP address, or browser details. Your claim code is shown once; Basirah keeps only a one-way hash of it.

Accounts and contact details

Supabase Auth stores the email and account information needed to sign you in. A report saved to your account is linked to that account by an internal ID.

The optional name, email, and phone fields inside the report form are different: they stay in this browser to prefill your next report and are not sent with the report. They are not separately encrypted by Basirah. You can remove them by clearing Basirah's site data in your browser.

Location

If you choose “Use my location” on the map, the coordinate is cached in your browser and used to request nearby mosques. It is not added to Basirah's database. If you type a location into an incident report, that location becomes part of the report and is saved.

Security and access

Data is sent over HTTPS. Reports and account data are kept in Supabase with access rules. Uploaded evidence and report PDFs are in private storage and open through short-lived signed links. The reporter and authorized verification staff can access a signed-in report as needed to review it.

When the anonymous-report security check is enabled, Cloudflare Turnstile processes browser and device signals to decide whether a submission is automated.

Optional writing help

If you choose “Fix spelling and grammar,” the text in that box is sent to OpenAI for copy-editing. This is optional. Your report-form name, email, and phone fields are not included, and no suggested wording replaces yours unless you accept it.

Deleting a signed-in report

“Delete for me” only removes the report from your account view. “Delete for everyone” removes the report and its related records from Basirah's active database, along with its PDF and uploaded files from storage.