PRIVACY · CURRENT RELEASE
Your words should not become a hidden cost.
This notice describes the current public and signed-in experience as of September 3, 2026. Provider-backed features remain subject to the readiness and availability statements shown in the product.
Anonymous first use
Text entered on the Begin page stays in page memory. It is not sent to a server, stored in the product database, or used to train AI. It clears when you leave or reload. Only a named starting choice can be carried into account setup, and only after a separate explicit choice.
Accounts and private space
Email, Google, or ChatGPT can verify your identity and open the same private space. Provider tokens are not stored in ordinary application tables, and passwords are handled by the authentication provider rather than this application. Private entries are account-scoped, excluded from analytics text, never exposed to church roles, and follow the retention choice shown before saving.
AI memory and Talk
Talk may use the OpenAI API for signed-in people with active Mission Access and for up to three guest responses in a rolling 24-hour period when the provider is ready. Before a request is sent, direct contact details are removed and a verified public-domain Scripture passage is selected by the application. OpenAI generates commentary—not Scripture—and API storage is not requested. If the provider is unavailable, the app identifies the reviewed fallback honestly. The current conversation remains in the browser tab and is not saved as history. Memory is off by default, unavailable for ages 13–17, and limited to exact facts an adult separately approves.
Guest allowance
Anonymous Talk uses a signed, opaque, secure browser cookie to enforce the three-response allowance. The cookie contains no message text, email address, name, or advertising identifier. Guest Talk does not create an account or save a transcript. When the allowance is reached, the draft stays on the device so the visitor can sign in or return after the rolling window.
Today
Public Today uses the pastorally screened Scripture calendar without creating an account. Signed-in Today stores the assigned Morning or Evening passage, the generated-or-reviewed commentary source, and an optional “moment received” choice so the same period stays stable and the 90-day personal Scripture boundary can be enforced. Talk, journal text, saves, and check-in text are not used to select the passage. A check-in is stored only after an explicit save. Quiet Mode is a preference on your device; it is not used to infer your mood, mental health, or spiritual condition.
Reminder delivery
Reminder preferences begin paused. Email and web push can be used only when the relevant provider, explicit release switch, browser permission, encrypted device record, and scheduled worker are ready. Saving a preference is not treated as delivery. Provider acceptance, retries, suppression, and dead-letter outcomes are recorded separately, and lock-screen copy remains neutral.
Gifts, receipts, and finance access
Stripe and payment collection are disconnected by owner decision. Payment records remain structurally separate from spiritual-care content. Before any future activation, merchant identity, disclosures, webhooks, receipts, reconciliation, permissions, refund terms, and qualified review must be complete.
Offline data
The shared offline package contains only public reviewed Scripture, a fallback Daily Moment, public journey steps, and emergency phone actions. It contains no private entries, saved contacts, highlights, notes, progress, account data, care requests, payment records, or queued private writes.
Church firewall and care requests
A church connection never grants access to Talk, AI memories, check-ins, journey progress, private prayers, journal entries, privacy settings, or mission-gift records. Church Edition care begins only when you deliberately connect a church, enter a request, review the exact text and selected profile fields, and confirm submission. External caregiver delivery is not claimed unless a provider has accepted it.
Device settings
Theme, contrast, text-size, install dismissal, and service-worker caches stay in your browser. Clearing site data removes them. Uninstalling removes the installed app, but browser-managed site data may remain until cleared.
Review status
Minor privacy, mandatory-reporting representations, jurisdictional differences, final legal identity, accessibility conformance, care and finance retention, charitable language, and production data flows still require qualified external review before public traffic or live payments.