In effect from 2026-10-12

Privacy Policy

This app is a free personal project. It is built so that there is as little to protect as possible: without an account nothing of yours reaches a server, and with one, what reaches the server cannot be read — not even by the person who runs it.

In short

Without signing in, no personal data is collected at all. Your writing stays in your own browser.
If you sign in, your email address and the encrypted copies of your records are stored on the server.
The records are encrypted on your device. The key is on your devices and in your recovery key — never on the server.
You can delete everything at any time, and the copy on the server is removed immediately.

If you do not sign in

Nothing is collected. Your reflections, marked verses, prayers, reading progress and app settings are stored only in your own browser, and the app makes no network request that carries them. Bible versions you add yourself are kept in your browser as well and are never uploaded. The app has no analytics, no advertising and no third-party scripts.

If you sign in

Signing in is optional and exists for one purpose: so the same records appear on your other devices. What is stored on the server is:

Email address — to identify your account and to send the sign-in link. Nothing else is sent to it.
Account identifier and sign-in times — created and kept by the authentication service.
Encrypted records — your writing, encrypted on your device before it leaves.
Hidden record names — the name of each record (such as the date it belongs to) is replaced by a one-way value so the server cannot tell what it is.
Your wrapped key — the data key, sealed with your recovery key. Without the recovery key it cannot be opened, by us or by anyone else.
Technical records of the requests themselves (such as time and IP address), kept by the service providers below.

What cannot be read, and what can still be seen

The encryption happens on your device, so the server stores ciphertext only. Nobody who has access to the server — including the person who runs this app — can read your writing, the dates you wrote on, or the chapters you read.

Being honest about the limits: the server can still see how many records you have, when each one changed, and your email address. That cannot be avoided while syncing record by record, and it reveals nothing of what you wrote.

Who processes it, and where

Supabase Inc. — authentication and storage of the encrypted records. The data is stored in the United States (East US, North Virginia).
Netlify, Inc. — serves the app and the pages you are reading now.

Using these services means your data is stored outside your country. Both receive only what is described above; neither receives your decryption key.

How long it is kept

While your account exists. When you delete your account, the records and the wrapped key on the server are deleted immediately — there is no grace period, because the original is on your device. The service providers keep their own technical logs according to their policies.

Your rights

You may ask to see, correct, delete or stop the processing of your personal data, and you may withdraw consent at any time. Two of these need no request at all: Export gives you every record as a file, and signing out or deleting your account removes the server copy. For anything else, write to the address below.

How it is protected

End-to-end encryption (AES-GCM), with the key derived on your device.
Row-level access rules on the database, so one account cannot read another account’s rows — verified by automated tests on every change.
HTTPS only, with a strict content security policy that allows the app to talk to no server other than the one above.
The least amount of data that makes the feature work.

Cookies and tracking

The app sets no cookies and uses no analytics or advertising. What it stores in your browser (your writing and settings, and when signed in, your key and session) is on your device and is not sent anywhere except as described above.

Children

The app can be used without an account at any age. If you are under 14, please do not create an account without the consent of a parent or guardian.

Changes to this policy

If this policy changes in a way that affects you, the new version will be posted here with a new effective date before it takes effect.

Contact

For anything about your personal data, write to the address below. Replies are sent from a different address, so please do not be surprised.

contact@joshuadevotion.org

Open the app About this app