Privacy Notice
This notice explains what this registration website does with personal information. It is written for UK GDPR, the Data Protection Act 2018 and PECR as they apply to a UK-operated site with an international audience.
1. Who is responsible
Test the Ummah, at testtheummah.com, is the controller for the registration information described here. Test the Ummah is the public name of this project. It is not a registered charity. For a privacy question, an access request or a deletion request, email testtheummah@gmail.com.
Visiting or registering does not mean we record you as holding any particular religion. The challenge is about Islamic knowledge. We do not ask you to state your religion, and we do not keep a religion field.
2. What we collect when you register
The registration forms ask for:
- your name;
- your country;
- your city, town, state or region, as one combined answer, not a street address;
- your email address;
- your acceptance of the Terms & Conditions.
If the place matches our location list, we also store that match, including a country code and a place code where we have one. We store the terms version and the time you accepted. We store a source label showing that the registration came from this Ramadan 2027 homepage.
We do not ask for a date of birth, a password, a phone number, payment details, or a statement of religion.
3. Verification and essential emails
We email a verification link to the address you gave. The link expires after the configured period, currently 48 hours, and works once. We store a SHA-256 hash of the token, the expiry time, whether the message was accepted by the email provider, and when the address was verified.
After verification we send a confirmation email. That message includes your invitation link. We expect to send further essential emails about the start of the challenge. Accepting the Terms & Conditions does not subscribe you to optional news. Those essential messages are part of providing the registration you asked for. They are not marketing.
Before you have verified, the verification screen can send a fresh link. You can also correct the email address from that screen. Correcting it cancels the link that was sent to the old address.
4. Accounts and future profiles
This website does not let the public create a password account. Sign-in on the site is for administrators.
If a user account with the same email already exists in the application database, we store a link between that account and the registration. That link is there so a future full profile could keep Ramadan progress together. This registration release does not build that profile, and it does not collect challenge progress.
5. Answers, scores and leaderboards
Today we do not collect quiz answers, scores, streaks or leaderboard positions. Homepage scenes that show names and ranks are illustrations. They are not records of real participants.
If the Ramadan 2027 challenge later stores answers, scores or rankings, this notice will need to be updated before that collection starts. We are not describing that future data as if it were already held.
6. Invitation links
Each registration has a referral code. Opening an invitation link stores that code in your session until you register or the session ends. If you then register, we store the inviter’s registration id on your record.
The inviter sees how many people verified through their link. They do not see those people’s email addresses on the welcome page. An administrator export can include the inviter’s email address, the code, and the verified invitation count.
Invitation counts are not sold and are not used as a prize.
7. Technical and security records
The registration table does not have a column for your IP address or browser. The web server that hosts the site may keep ordinary connection logs. We have not set a published retention period for those host logs in this application.
If a challenge email is not accepted, we log the registration id and a short reason. We do not log the recipient address, the verification link, or the mail provider’s API key in that warning.
A session stores the invitation code, and after you submit the form it stores your registration id so the welcome and verification pages can load. Laravel also uses a cookie to protect forms against cross-site requests.
8. Why we use information
- to create and confirm your free registration;
- to verify that the email address can receive challenge messages;
- to send essential registration and challenge emails;
- to avoid a second registration for the same email address;
- to count genuine invitation joins;
- to show a public count of verified registrations, without inventing sign-ups;
- to operate, secure and fix the website;
- to honour an older optional-news choice where one was actually recorded;
- to keep a record of the terms version you accepted.
9. Lawful bases
For the free registration you ask for, we rely on contract: creating the registration, verifying the address, sending essential challenge messages, and keeping the terms-acceptance record that goes with it.
We rely on legitimate interests for keeping one record per email address, rejecting automated submissions, securing the site, producing an admin export for operators, and keeping invitation counts honest. Those interests are running a free learning challenge without fake accounts or misuse. They are not used to send promotional email.
Optional news, where a real opt-in exists, relies on consent. The current registration forms do not ask for that consent. Accepting the terms is not consent to marketing.
Taking part may let someone infer an interest in Islam. Religious belief can be special-category data when information is used to identify it. We do not ask for or store a religion, and we do not use registration to build a belief profile. This notice is not consent to use information as a record of religious belief. If a later feature would collect that kind of information, this notice will be updated first.
10. Optional news and older consent records
The optional marketing checkbox was removed from both registration forms. You will not see it, and accepting the Terms & Conditions does not subscribe you to optional news.
If an earlier registration, or a direct submission that included the old choice, stored an opt-in, we keep the time, the wording, the version and the source of that choice. We do not treat a missing choice, or an older registration with no consent time, as opted in.
Promotional campaigns are switched off in the production configuration until they are deliberately enabled. They are not sent to anyone who has not verified their email, has not opted in, has unsubscribed, or whose address has bounced or been marked as a complaint. Unsubscribing stops optional news. It does not cancel the challenge registration, and essential challenge emails can still be sent.
11. Service providers
We use these providers:
- Email. Resend, when the site’s mailer is set to Resend, delivers verification and confirmation emails. If an optional campaign is later enabled, Resend would also receive the name and email of people in that audience. Delivery events can be sent back to this website by a webhook.
- Hosting and database. The database is kept on the same server as the website, on Test the Ummah’s Namecheap hosting account.
- Contributions. GoFundMe, if you choose to leave this site and contribute. We do not send your registration record to GoFundMe and we do not receive your card number. GoFundMe is responsible for the payment page.
12. International transfers
You may register from anywhere. Test the Ummah treats this website as UK-operated.
Resend processes email outside the UK.
The database runs on the same server as the website.
13. Storage and security
Registration records sit in the application database. Verification links are stored only as a hash. The production setup sends the session cookie only over HTTPS and encrypts session contents.
Administrator access is limited to signed-in admin users. The public cannot open the registration list. Administrators can export a CSV of registrations. The admin screens do not offer a delete button for a registration.
14. How long we keep information
The application does not contain an automatic deletion date. Registration records are kept while they are needed to run the challenge, remember who verified, show invitation counts, and respect an unsubscribe or a suppression so we do not keep emailing someone who should not receive optional news.
There is no fixed end date in the software. A record stays for as long as the reasons above still apply.
16. Public display
We do not publish a leaderboard of real participants. The homepage may show a count of verified registrations. It does not show your email address. Preview rankings on the homepage are fictional.
Your own welcome page, in the browser session after you register, shows your invitation link and your invitation count. If a future public leaderboard would show a name or a score, this notice must be updated first, including what name is shown and how to stay off a public list.
17. Your rights
Depending on your situation, UK data-protection law can give you the right to:
- ask whether we hold information about you and for a copy of it;
- ask for a correction;
- ask for deletion;
- ask us to restrict or stop certain uses;
- object to processing based on legitimate interests;
- receive information you provided, in a portable form, where the basis is contract or consent and the processing is automated;
- complain to the Information Commissioner’s Office.
These rights are not absolute. For example, we may need to keep a suppression record so that optional email does not start again. This website does not yet give you a logged-in page where you can exercise the rights yourself.
18. Withdrawing consent
Consent is only the basis for optional news, and only where an opt-in was actually recorded. You can withdraw it without affecting the challenge registration. A confirmation email that includes an unsubscribe link, and the unsubscribe address on that link, sets optional news off and records the time. Essential challenge emails are not based on that consent, so withdrawing it does not stop them.
There is nothing to withdraw if you never opted in. Registering and accepting the terms does not create marketing consent.
19. Correction and deletion
Before verification, you can change the email address on the verification screen. The public site does not offer a form to change your name or place after registration, and it does not offer a button to download or delete your registration.
To ask for access, a correction or deletion, email testtheummah@gmail.com. That is the same address used for support and other privacy requests.
20. Complaints
You can complain to the UK Information Commissioner’s Office, including through ico.org.uk/make-a-complaint. You do not have to contact us first. You can also email testtheummah@gmail.com.
21. Children
We do not ask for age. We do not knowingly want personal information from a child under 13. The form cannot currently tell a child’s registration from an adult’s. If we learn that we hold a child’s information and we should not, we will delete it. Parents and guardians can email testtheummah@gmail.com.
22. Changes and contact
The version and date at the top of this page are the notice currently published. This text is version 2.0, effective 30 October 2026. If we start collecting answers, scores, or a public leaderboard, this page will be updated first.
For general enquiries, support, privacy questions, and requests to access, correct or delete your information, email testtheummah@gmail.com. Challenge messages, such as verification and confirmation, are sent from notifications@testtheummah.com. Please use the Gmail address above for a reply or a request.
The Terms & Conditions explain the challenge itself.