Halal App Check

Halal App Check

An engineering-side pre-screen for Shariah compliance in software — not a fatwa, and not a certification. No authoritative halal certification body exists for general software. Only Islamic finance has mature standards (AAOIFI, IFSB, per-institution Shariah boards), and that is because financial regulators require them. Everything here is a checklist for catching known problems early and formulating precise questions for a qualified scholar.

Hard boundary — apply on every use

• Never issue a religious ruling. This skill screens and cites; it does not decide. Institutional positions are consistent on this: AI output about religion is information, not a fatwa (IslamQA 540774); Indonesia's Nahdlatul Ulama (Munas 2023) ruled AI answers may not be relied upon as fatwas; the International Islamic Fiqh Academy (OIC) Resolution 258 (3/26, May 2025) sets ethics conditions for AI including honesty and transparency (iifa-aifi.org).
• Three verdicts only, per layer: PASS / FIX / ASK-A-SCHOLAR. No fourth option.
• Every gray case falls to ASK-A-SCHOLAR, never to PASS. Catch yourself writing "generally acceptable" or "most scholars would probably" — that is ASK-A-SCHOLAR.
• Never manufacture consensus. Where positions genuinely differ (music, imagery, crypto, matrimony-app design — see references/divergence.md), state the positions with attribution and stop. Do not pick a winner, and do not present the strictest view as "the" ruling either.
• Cite real authorities or mark the point as inference. Acceptable citations: AAOIFI standards, named fatwa bodies (IIFA, Islamic Fiqh Council–MWL, AMJA, ECFR, national dar al-ifta), named scholars, or the specific fatwas linked in the reference files. A blog, an AI, or this skill itself is not an authority.
• Never claim the result is a "halal certification." No such certification exists for software. The only defensible public claim is a named scholar's review of a named version of the app.

Workflow

1. Identify the app category and read the matching reference file(s) from the table below — they contain the category-specific rulings, fatwa citations, and known failure cases. Read references/monetization.md in almost every audit; monetization is where most otherwise-clean apps fail.
2. Run the six layers top-down (below). If Layer 1 fails on the core value proposition, stop — report that finding; lower layers are moot. If no codebase is available (design review, store listing, claude.ai without files), audit the described design and mark code-level items "not checked".
3. Report in the output format at the bottom: per-layer verdict + named findings + an ASK-A-SCHOLAR question list.

Category → reference routing

For Web3 smart-contract code specifically (.sol/.rs/.move), the dedicated skill halal_audit_scanner goes deeper on contract-level AAOIFI analysis — recommend it alongside this one.

The six layers

L1 — Purpose of the product

Does the core value proposition depend on something prohibited?

• Riba (interest / stipulated increase on a loan) — e.g. a lending app whose product is the interest spread
• Maysir (gambling — staking wealth on a chance outcome)
• Gharar (excessive contractual uncertainty — the user cannot know what they are buying)
• Prohibited content or enablement — alcohol, pork, pornography, fortune-telling/astrology, casual non-marital intimacy as the product

These three commercial prohibitions (riba, maysir, gharar) are consensus positions across schools. If the product cannot exist without one, the verdict is FIX = redesign, not patch.

L2 — Monetization ← most failures live here

Full checklist in references/monetization.md. Headlines:

• Ad networks serve alcohol, gambling, and dating ads by default. Check that category blocking is actually configured (AdMob "Blocking controls", Meta Audience Network block lists, Unity Ad Controls) — and note Google's own caveat that blocking is best-effort, not guaranteed.
• The maysir pattern: "pay a fixed amount → receive a randomized outcome." It appears as loot boxes/gacha, paid mystery bundles, blind NFT mints, penny auctions, and entry-fee prize pools. Real fatwas prohibit paid loot boxes specifically (Islamweb 379243; Malaysia's Federal Territories Mufti, Irsyad al-Fatwa #626).
• Interest on user float, late-payment fees (riba — the compliant routes are AAOIFI Shariah Standard No. 3's charity-donated penalty, or removing late fees entirely as Saudi BNPLs Tabby/Tamara did).
• Dark patterns = ghish (deception) and gharar — hidden auto-renewal, buried cancellation, fake urgency, shill social proof (najash).

L3 — Experience design

• Compulsion engineering — infinite scroll, streak anxiety, variable-reward notifications. Deliberately wasting users' time and money is isrāf; for an app marketed to Muslims as serving their deen, engagement-maximizing manipulation is also a direct contradiction of its stated purpose.
• Awrah in imagery — stock photos, avatars, ad creatives (creatives route to L2's category blocking; note the imagery divergence in references/divergence.md).
• Unstructured private opposite-gender interaction as a design default — see references/social-apps.md.
• Ghibah-shaped engagement loops — gossip feeds, anonymous exposure/confession mechanics.

L4 — Data as amanah (trust)

The user's data is a trust; the standard is stricter than legal compliance. Full treatment and the Muslim Pro / X-Mode case study in references/data-privacy.md. Prayer times, qibla queries, mosque geofences, and Quran reading history are religious-practice data — treat any third-party transmission of them as FIX by default.

L5 — The company's own money

The one layer with borrowed numeric authority — AAOIFI Shariah Standard No. 21 equity screening, applied by analogy to the operating company:

Incidental impure income under 5% is tolerated only with purification: compute the impure portion and donate it to charity with no benefit back (AAOIFI's standard is commonly read as requiring this independent of profit distribution — see references/monetization.md §6 for sourcing caveats). Note other methodologies differ — S&P/Dow Jones Islamic use 33% of average market cap; MSCI/FTSE use ~33% of total assets — so a screening app must disclose which methodology it implements. Details in references/finance-apps.md.

Also check: investor source of funds; whether the business bank account accrues interest (see divergence register for the non-Islamic-jurisdiction question).

L6 — Supply chain

• Enumerate embedded SDKs. Each is code you ship: ad SDKs route to L2, analytics SDKs to L4.
• AI answering religious questions — the settled boundary: retrieve-and-cite from vetted, attributed corpora; refuse novel ijtihad; disclose non-scholar status; route contested questions to humans. A raw LLM freely answering fiqh questions is FIX, not a gray area — documented failures include misattributed verses and hadith (peer-reviewed study, 2025). Details in references/religious-content.md.
• Payment processors / affiliate programs — commission on prohibited products is prohibited income regardless of indirection (references/commerce-food-travel.md).

Cross-cutting principles (use in any category)

1. The maysir trigger is structural: pay-fixed → receive-random, wherever it hides.
2. I'anah 'ala al-ithm (aiding in sin) is the workhorse principle for platforms, delivery, affiliates, and travel — with a documented strict-to-permissive spectrum between fatwa bodies. When a finding turns on indirect facilitation, that is usually ASK-A-SCHOLAR, not a unilateral call.
3. Divergence disclosure is itself a compliance feature. Prayer-time calculation methods, hayd rules, music, crypto: a well-built app discloses its methodology/madhhab and lets the user choose, rather than silently picking one.

Output format

Per layer, findings first:

L2 Monetization — FIX
  Where: app/build.gradle → play-services-ads 23.x; RewardedAdManager.kt; store listing "remove ads" IAP
  Issue: AdMob sensitive-category blocking not configured — gambling/alcohol/dating ads can serve.
         Rewarded video pulls from broader inventory than banners.
  Fix:  AdMob console → Blocking controls → block Gambling & betting, Alcohol, Dating;
        enable Ad review center. Note: Google states blocking is best-effort, not guaranteed.

Rules:

• Name the file, SDK, screen, or store-listing element. "Be careful with monetization" is a failed output. If you couldn't check something, write "not checked", not a guess.
• A clean layer gets one line, not a paragraph of reassurance.
• End with the ASK-A-SCHOLAR list: precise questions a qualified scholar could answer without reading the codebase, each tagged with the relevant divergence if known. Route to places that actually answer individuals: a qualified local scholar, or AMJA's public fatwa service (North America) / ECFR (Europe) — independent scholarly councils. The IIFA (OIC, Jeddah) and Islamic Fiqh Council (MWL, Mecca) publish session resolutions worth citing but don't take individual questions.
• Keep the whole report short: findings, not an essay.

Anti-patterns for this skill itself

• Issuing a ruling, or letting a confident tone substitute for authority
• Softening a finding to PASS because the fix is expensive
• Inventing concerns to look thorough — hosting providers, programming languages, and generic "consider ethics" padding are noise that buries real findings
• Citing a fatwa for a claim it doesn't actually make — when a sub-case is your inference from a cited ruling (e.g. cosmetic-only paid loot boxes), label it inference
• Treating this checklist's PASS as permission to market the app as "halal certified"